Researchers point out ways to circumvent Google's Bouncer (w/ Video)

June 7, 2012 by Bob Yirka report

(Phys.org) -- Back in February, Google announced that it had added a security program called Bouncer to its Android Market, a site similar to Apple’s iTunes, that would test applications that had been uploaded to the site, in an attempt to keep out those that contain malware. In the announcement, Google also said that Bouncer had been running for several months and that because of it, apps with malware uploaded to Android Market, which is now called Google Play, were down forty percent. Unfortunately, if that number is correct, it’s likely to change soon as two security analysts, Charlie Miller and Jon Oberheide have not only found some very serious security problems with Bouncer, but have created a video and posted it on YouTube showing exactly how to take advantage of the lapse.

The video will load shortly

Miller and Oberheide explain that the way Bouncer works is by creating a virtual phone environment every time an is uploaded to Play. It’s in that environment that Bouncer runs and tests the app in various ways to see if it can detect the presence of any malware. Unfortunately, as the two found, Bouncer only tests for five minutes. Any app that waits till after that time period has lapsed to carry out its nefarious functions will get a clean bill of health.

The duo discovered this flaw in Bouncer by creating an app that automatically connects to a server under their control, which allowed them to run Linux commands on an Android phone. Then, they created a false Google Play developer account and uploaded the app. Once it ran in the simulator, they were able to execute commands to find out how Bouncer worked and then to use that information to find weaknesses.

In so doing, they also found that Google had created just a single fake user account, email address, and two photo images to use for its testing purposes. If an app with malware tried to touch any of those, it was “bounced.” Unfortunately, using such a limited set of test information allows those working to subvert the system an easy means of identifying if they are running in a simulation or on a real phone. If it’s the simulation, then they can just do nothing so they won’t be detected.

The two researchers say there are other security holes they’ve discovered as well and have been in contact with Google to let them know what they’ve found and will be outlining their findings at this week’s SummerCon conference in New York.

Explore further: Shoplifters hit up Chrome Store for Facebook data

Related Stories

Shoplifters hit up Chrome Store for Facebook data

March 28, 2012

(PhysOrg.com) -- A cash-for-Facebook’s-“likes” hustle hanging out in Google Chrome Web Store has been discovered by Kaspersky Lab. The researchers first discovered extensions leading to the wave of hijackings ...

Android mug shots have no lock and key

March 4, 2012

(PhysOrg.com) -- If Google loyalists will persist that this Internet Goliath can do no evil, they at least need to admit, based on new evidence this week, that Google can do a lot of mindless harm. A security door in Android ...

Android users get malware with their apps

March 2, 2011

(PhysOrg.com) -- As new platforms make their way into the market there will always someone who is looking to exploit them for illegal or unethical ends. More proof of that fact has come today when Google was forced to removed ...

Google announces Floor Plan app for venue owners

April 8, 2012

(Phys.org) -- This week the team from Google Maps launched its Floor Plan Marker for Android in a bid to improve the accuracy if its indoor maps. Inside and outside Google, developers have seen real opportunity in introducing ...

Recommended for you

Swiss unveil stratospheric solar plane

December 7, 2016

Just months after two Swiss pilots completed a historic round-the-world trip in a Sun-powered plane, another Swiss adventurer on Wednesday unveiled a solar plane aimed at reaching the stratosphere.

Solar panels repay their energy 'debt': study

December 6, 2016

The climate-friendly electricity generated by solar panels in the past 40 years has all but cancelled out the polluting energy used to produce them, a study said Tuesday.

Wall-jumping robot is most vertically agile ever built

December 6, 2016

Roboticists at UC Berkeley have designed a small robot that can leap into the air and then spring off a wall, or perform multiple vertical jumps in a row, resulting in the highest robotic vertical jumping agility ever recorded. ...

0 comments

Please sign in to add a comment. Registration is free, and takes less than a minute. Read more

Click here to reset your password.
Sign in to get notified via email when new comments are made.