Categories: Mobile

Millions Android Cyanogenmod users exposed to MitM attacks due to Code re-use

Researcher explains that vulnerable code re-use of zero-day in Android’s CyanogenMod exposes million users to Man-In-The-Middle attacks.

Security experts always discourage jailbreaking and rooting of mobile devices due to the risk related to the installation of not authorized applications that could hide malware and serious bugs.

At the Ruxcon Security Conference in Australia, an unnamed security researcher revealed that CyanogenMod developers “copy-pasted” Oracle’s “sample code for Java 1.5” could exposed Android devices with CyanogenMod at risk of man-in-the-middle attacks. The researcher decided to disclose the zero-day in CyanogenMod after he tried ethically to info CyanogenMod that did not respond. The expert described the fix as “fairly simple,” adding that “the exposure served as an academic exercise in the perils of code reuse.”

As warned by the expert, installing CyanogenMod on Android device, then the user’s device is vulnerable to a zero-day blamed on code re-use.

“If you go and create a SSL certificate for a domain you own, say evil.com and in an element of the certificate signing request such as the ‘organization name’ field you put the ‘value,cn=*domain name*, it will be accepted as the valid domain name for the certificate.” explained the researcher. “Cyanogenmod uses this implementation for its browsers so you can go now and MitM someone’s phone.”

The researcher highlights the improper validation of  SSL certificates made by the mobile devices which fail to perform the certificate pinning procedure when establishing a trusted connection to the service provider. The failure of the certificate pinning procedure exposes users to the risk of MitM attacks and consequent theft of sensitive information.

The expert warned that CyanogenMod and a “ton of others” OS installations reused flawed code that was reported to have SSL vulnerabilities back in 2012. Unfortunately, also the last version CM 11.0 M11 that was released October 8th hasn’t fixed the flaw and CyanogenMod hasn’t provided a reply on the  yet to respond to the zero-day allegation.

The experts consider this vulnerability critical due to the large number of CyanogenMod installations worldwide, which according the official statistics are more than 10 million as of December 2013.

Code re-use is a very common practice within development community, but in many cases it could act as vector for old vulnerability due to not accurate repackaging of source code.

“I was looking at HTTP component code and I was thinking I had seen this code before,” the researcher said. “They just copy-pasted the sample code and that’s what was vulnerable. “I checked on GitHub and found out a tonne of others were using it.”

Let’s wait for the reply of CyanogenMod.

Pierluigi Paganini

(Security Affairs –  CyanogenMod, Android)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

DORA Compliance Strategy for Business Leaders

In January 2025, European financial and insurance institutions, their business partners and providers, must comply…

15 hours ago

CISA adds Android Pixel, Microsoft Windows, Progress Telerik Report Server bugs to its Known Exploited Vulnerabilities catalog

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Android Pixel, Microsoft Windows, Progress Telerik Report…

22 hours ago

City of Cleveland still working to fully restore systems impacted by a cyber attack

Early this week, the City of Cleveland suffered a cyber attack that impacted multiple services.…

1 day ago

Two Ukrainians accused of spreading Russian propaganda and hack soldiers’ phones

Ukraine’s security service (SBU) detained two individuals accused of supporting Russian intelligence in spreading propaganda…

1 day ago

Google fixed an actively exploited zero-day in the Pixel Firmware

Google is warning of a security vulnerability impacting its Pixel Firmware that has been actively…

2 days ago

Multiple flaws in Fortinet FortiOS fixed

Fortinet released security updates to address multiple vulnerabilities in FortiOS, including a high-severity code execution…

2 days ago

This website uses cookies.