\n\tSecurity experts have warned of a new vulnerability in Android smartphones which could plunge devices into a crash loop that can only be fixed by forcing a factory reset.<\/p>\n
\n\tBitdefender said it discovered the issue when an Android package (APK) it collected from the wild crashed the emulators in its labs. It found that the problem wasn\u2019t malware, but a bug in the Android OS itself.<\/p>\n
\n\t\u201cThe operating system mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length. Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file,\u201d it explained in a blog post.<\/p>\n
\n\t\u201cWe call it GhostMap: the malformed entry causes Android to map the file across memory that was never allocated, and the crash occurs when a process reads from that empty space.\u201d<\/p>\n
\n\tRead more on Android bugs: Google API Keys Quietly Gain Access to Gemini on Android Devices.\u00a0<\/a><\/p>\n \n\tBitdefender said that the crash loop persists after a reboot and continues in safe mode, meaning the only way out is a factory reset which erases all locally stored data.<\/p>\n \n\tThe bug affects all Android versions from Android 10 and above, but Google has so far failed to address it, claiming the issue is outside the scope of a security fix, the report noted.<\/p>\n \n\tIt was notified by the security vendor on August 20.<\/p>\n \tHow Threat Actors Could Abuse GhostMap<\/p>\n \n\tBitdefender warned that cybercriminals could theoretically hide the technique in a fake app to disable a victim\u2019s phone, or use the threat of GhostMap as leverage for extortion.<\/p>\n \n\tIt shared several possible scenarios:<\/p>\n \t\tBrick a victim\u2019s phone by first creating a malicious app containing a deliberately malformed resource that Android\u2019s system service needs to read. When it does, the resource triggers a crash in system_server which renders the phone unusable. This could be used for extortion<\/p>\n \t\tMake a malicious app impossible to remove. In this scenario an icon contains a malformed resource which triggers a crash when Android tries to display it. The launcher, the app list in Settings, and the app’s own info screen all crash when the user tries to access them to uninstall<\/p>\n \t\tDisable security tools. Mobile security apps, malware-analysis sandboxes and automated scanning pipelines need to use Android’s resource-parsing code to examine suspect apps. By embedding a malformed resource in an APK, hackers could trigger GhostMap to crash anything inspecting it<\/p>\n \t\tDelivery through an app update. An app looks trusted on download but, in theory, the malformed file could be introduced later. That would mean it could pass app-store checks and security scans to infect a much larger number of potential victims at once<\/p>\n \n\t\u201cThis is a flaw in Android itself and, as of publication, no fix is available, so users have limited options on the device to prevent it. The most practical defense is to recognize the file before the bug is triggered,\u201d Bitdefender concluded.<\/a><\/p>\n \n\t\u201cThat’s possible because the malformation is visible in the file’s structure, without installing or running the app. A scanner can distinguish a crafted file from a normal one by inspecting it, not by executing it.\u201d<\/p>\n \n\tThe vendor detects this issue as Android.Riskware.Ghostmap.rA.<\/p>\n","protected":false},"excerpt":{"rendered":"Security experts have warned of a new vulnerability in Android smartphones which could plunge devices into a crash…\n","protected":false},"author":2,"featured_media":825067,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[16],"tags":[2306,86,56,54,55],"class_list":["post-825066","post","type-post","status-publish","format-standard","has-post-thumbnail","category-mobile","tag-mobile","tag-technology","tag-uk","tag-united-kingdom","tag-unitedkingdom"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/825066","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/comments?post=825066"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/posts\/825066\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media\/825067"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/media?parent=825066"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/categories?post=825066"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/uk\/wp-json\/wp\/v2\/tags?post=825066"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}