Google will disclose information about vulnerabilities in third-party Android devices

Google Inc. introduced initiative Android Partner Vulnerability, aimed at disclosing data on vulnerabilities in Android devices from various OEM manufacturers. This initiative will make it easier for users to receive information about vulnerabilities specific to firmware modifications from third-party manufacturers.

Until now, official vulnerability reports (Android Security Bulletins) reflected only issues in the main code provided in the AOSP repository, neglecting problems specific to OEM modifications. Already disclosed issues affect manufacturers such as ZTE, Meizu, Vivo, OPPO, Digitime, Transsion, and Huawei.

Among the identified issues:

• In Digitime devices, instead of checking additional permissions for access to the OTA update installation service API, a hardcoded password was used, allowing an attacker to silently install APK packages and change access rights for the application. In a popular alternative browser used by some OEM manufacturers,
• it was implemented Phoenix password manager in the form of JavaScript code executed in the context of each page. An attacker-controlled site could gain full access to the user's password storage, which was encrypted using the unreliable DES algorithm and a hardcoded key. The System UI app on Meizu devices
• loaded additional code from the network without encryption and connection verification. When monitoring the HTTP traffic of the victim, the attacker could launch their code in the context of the application. On Vivo devices, the
• checkUidPermission method of the PackageManagerService class was modified to grant additional permissions to certain applications, even if those permissions were not specified in the manifest file. In one version, the method granted any permissions to applications with the identifier com.google.uid.shared. In another version, permissions were verified by checking the package names against a list.

Source: opennet.ru