Alerts

MasterKey Hack Applications Spotted in the Play Store

July 17, 2013
2 Min Read

A number of applications that harmlessly use the MasterKey vulnerability have been spotted on Google Play.

Two of the apps, Rose Wedding Cake Game – “air.RoseWeddingCakeGame v 1.1.0” and Pirates Island Mahjong Free “air.PiratesIslandMahjong v 1.0.1”, respectively have been last updated  in mid-May and are increasingly popular with Android users: while the Pirates Island Mahjong Free has been installed by between 5,000 and 10,000 users, Rose Wedding Cake Game has between 10,000 and 50,000 installs.

There is no need to panic right away: the applications contain two duplicate PNG files which are part of the game’s interface. This means that the applications are not running malicious code -“ they are merely exposing the Android bug to overwrite an image file in the package, most likely by mistake. In contrast, malicious exploitation of this flaw focuses on replacing application code.

One thing that is particularly interesting about today’s discovery is the fact that the two applications with this behavior managed to make their way into the Play Store without raising any red flags. However, patched Android distributions such as CyanogenMod will refuse to install the application with the mention that the “Package file was not signed correctly”.

If you’re running an unpatched distribution of Android, you might want to try out our Bitdefender Mobile Security & Antivirus or to install the Antivirus Free scanner for Android, which are both available via the Play Store and detect the MasterKey exploit.

Tags

About the author

View All Posts

Bogdan BOTEZATU

Bogdan Botezatu is living his second childhood at Bitdefender as senior e-threat analyst. When he is not documenting sophisticated strains of malware or writing removal tools, he teaches extreme sports such as surfing the web without protection or rodeo with wild Trojan horses. He believes that most things in life can be beat with strong heuristics and that antimalware research is like working for a secret agency: you need to stay focused at all times, but you get all the glory when you catch the bad guys.

7 Comments

Click here to post a comment

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Promo

Time Machine

January 2020
M T W T F S S
« Dec    
 12345
6789101112
13141516171819
20212223242526
2728293031