Skip to main content
  1. Home
  2. Mobile
  3. News

A two-year-old security flaw could give hijackers root access to your Android phone

By

Google Marshmallow
Image used with permission by copyright holder
Google warns that hijackers could get root access to your Android phone from an application using a security flaw that was first discovered two years ago.

Background

The flaw is part of the Linux Kernel, which is what Android is built on. It was actually fixed in April 2014, but it wasn’t flagged as a vulnerability at the time. Later in February 2015, the security implications were discovered, and it subsequently received the CVE-2015-1805 identifier. Even so, it wasn’t an issue for Android devices since it wasn’t ported to the Android software.

Recommended Videos

However, last month the CoRE Team found that this vulnerability could be exploited by hackers to achieve root on Android devices. A hacker with root access to your device would acquire superuser access, which is more control than even you or other third-party apps have. They would be able to access and modify all system files.

CoRE notified Google of the exploit and the company started working on a patch that would be included in a future security update. Unfortunately Google couldn’t work fast enough, as Zimperium, the security team who uncovered the Stagefright hack, told Google the exploit was already in use on a Nexus 5 phone.

This was done through an application in the Play Store that has already been blocked. Google actively blocks apps that attempt to achieve root access, but it’s unclear how long the app was in the wild. Google said in a security advisory, “Google has confirmed the existence of a publicly available rooting application that abuses this vulnerability on Nexus 5 and Nexus 6 to provide the device user with root privileges.”

Google classified this issue with a Critical severity rating, but the application in question wasn’t considered malicious. However, the Critical severity rating means that other hackers could use the same exploit to spread malware.

A patch is on the way

Google already published patches for the flaw in the Android Open Source Project (AOSP) for the 3.4, 3.10 and 3.14 versions of the Android kernel. Version 3.18 and above aren’t vulnerable.

These patches will be included in the April security update for Nexus devices. That’s the good news. The bad news is that Nexus devices only represent a handful of Android devices. It’s up to the manufacturers to issue patches for all the other Android devices around the world.

How to protect yourself

We know that exploits such as these can be scary, but you’re unlikely to fall victim to it if you make sure to download apps only from Google Play since Google will block any apps that use the exploit.

If you must install an app from a third party, make sure Verify Apps is turned on. To do this, open Settings, and find Google. Tap on it, followed by Security. Scroll down to the Verify Apps section and make sure that Scan device for security threats is turned on. Now any third-party apps that you install will be scanned for threats. Verify Apps is a good thing to turn on because it will protect you from all other exploits, not just this one.

If you want to find out if your device has received the patch, head into Settings, and tap on About Phone. Find the heading for the Android security patch level. If it’s April 1, 2016 or newer, you’re all set. If not, you can always contact the manufacturer of your phone and find out when the update will take place.

Editors' Recommendations

Topics
Robert Nazarian
Robert Nazarian
Former Digital Trends Contributor
Robert Nazarian became a technology enthusiast when his parents bought him a Radio Shack TRS-80 Color. Now his biggest…
Your Android phone just got an update that could save your life
A person holding the OnePlus 11 and Google Pixel 8.

When you’re in an emergency, every second matters. And if you already have your health information on your phone, it’s going to be even easier than ever to get that critical information over to operators. Now, when you make an emergency call on your Android phone, your health information can be sent directly to emergency services when you call 911.

This new feature update is made possible due to Google partnering with RapidSOS to allow data from Android ELS (Emergency Location Service) to be given to emergency contacts and first responders. The type of data that we’re talking about is critical medical information that can save your life, such as blood type, emergency contacts, and severe allergies. This is all information that the user sets up and is stored locally on their Android device.

Read more
Your Android phone is getting lots of fun new features this month
Android 14 logo on the Google Pixel 8 Pro.

It’s a big day for Android updates, as Google has announced more than a dozen new features spread across multiple devices and apps — including a host of fun new ways to make Google Messages more visually exciting and to mark a significant milestone in its use.

Ready to see everything that's new? Let's dig in.
Google Messages

Read more
Don’t update your Pixel phone — a new Android update might break it
Android 14 logo on the Google Pixel 8 Pro.

Android 14 introduced a host of convenient additions to Google’s Pixel phones, but a recent minor update has utterly broken the storage system for some users. Specifically, owners of the Google Pixel 6, Google Pixel 6 Pro, and Google Pixel 6a who run multiple profiles on their phones are reporting that their phones no longer have access to the storage pipeline for the main profile.

That means users are locked out of accessing the stored media and find themselves unable to add new files as well. A few users have reported on Reddit and Google’s official community forum that they can’t even click images using the camera app because it flashes an insufficient storage warning message. A few others say trying to install an APK package also returns a similar storage writing roadblock.

Read more