WORLDTECHBitdefender reports Android flaw that can crash phones after app install
Researchers at Bitdefender have disclosed an Android vulnerability that can push a device into an endless crash loop once a specially crafted app is installed. The flaw could leave affected devices unusable, although no in-the-wild exploitation has been identified.
How the flaw is triggered
The weakness sits in the way Android handles ZIP compression methods, and according to the report from Android Authority, simply installing a specially crafted APK is enough to make the core system_server process crash repeatedly.
Normally, malicious apps must request permissions and execute code before they can attack a device. This flaw works differently, because the installation step alone is what the attack depends on.
Public disclosure raises the risk
No in-the-wild exploitation has been identified so far. The public disclosure of the details, however, could make it easier for threat actors to build a working exploit.
Google, an Internet and software company based in Mountain View, is the company whose platform is affected. The available facts do not describe any fix or response from Google.
Open questions
- Will Google release a patch that closes the ZIP handling weakness?
- Which Android versions and devices are affected?