Google Issues Warning On Major Android Exploit

A huge percentage of Android users choose to root their devices, but most have no idea about the dangers a rooted Android device is exposed to. Rooting gives apps elevated privileges and attackers are known to take advantage of this.



Rooting in itself may be harmless for those who know exactly what they are doing but it becomes rather dangerous when it becomes a gateway to vulnerability.

An Android security flaw left unpatched for almost two years is now being exploited. This vulnerability in Android’s Linux-based kernel lets a certain app gain root access and elevated privileges. Warning about the severity of the problem, Google said in its recent Android security advisory:

This issue is rated as a Critical severity issue due to the possibility of a local privilege escalation and arbitrary code execution leading to local permanent device compromise.

Zimperium, a mobile security team, claims there are publicly available apps that are already making use of this exploit. Before now, another security outfit, C0RE Team, had notified Google that the flaw could be used to gain escalated privileges on Android devices.

Google has already issued a patch which is available on AOSP. However, it’s rather unfortunate that such important patch will not make it to lots of devices on time as manufacturers may be unable to push the update to all of their devices.

Even devices on Android Marshmallow are affected. For now, only Android devices with security patch level of March 18, 2016 are safe.

It is for this reason Google prohibits rooting apps in its Play Store:

Customers who install an application that seeks to exploit this issue are at risk. Rooting applications (like the one that is exploiting this issue) are prohibited in Google Play, and we are blocking the installation of this application outside of Google Play through Verify Apps. An attacker would need to convince a user to manually install an affected application.

The only way to stay safe is to ensure your device isn’t rooted and you’re not installing applications outside Google Play Store. If you’re the adventurous type, you should be aware of the risks.

Rooting isn’t as bad as it seems, but you open your device up to attacks with a rooted device. It becomes easier for an intruder to gain access to your personal information.