full-disclosure - [FD] Google's Android: remote install backdoor in Google Play Services

Open Source and information security mailing list archives

Message-ID: <47f369d6-8230-f4e0-cd28-58d7adf72615@metux.net>
Date: Fri, 10 Jul 2020 13:16:23 +0200
From: "Enrico Weigelt, metux IT consult" <info@...ux.net>
To: fulldisclosure@...lists.org, certbund@....bund.de
Subject: [FD] Google's Android: remote install backdoor in Google Play
	Services

=======================================================================
Advisory: Google's Android (play services) built-in backdoor for remote
app installation.
=======================================================================

Google's PlayServices has a built-in backdoor which allows Google Inc,
or anybody who has access to some device owner's Google account to
remotely silently deploy any apps (at least those listed in the AppStore).

Some technical background:

* PlayServices (GMS) frequently polls Google services for various kinds
  of push messages
* amongst those push message is one for triggering the GMS to *silently*
  download and install some app from Google app store
* there's no explicit notification, nor asking for confirmation
  (except for download progress shortly appearing in status bar)

Possible attackers:

* anybody who highjacked victim's Google account
* Malicious operatives at Google

Quick mitigation:

a) take away all permissions (especially changing system settings) from
   Google Play Services as well as Google Play Store

   --> dramatically reduced the ratio of successful remote deployments
       via Google App Store Web interface

b) disable / remove Google Play Services and Google App Store

Legal considerations:

It is clear that Google explicitly built in an backdoor for silent
remote deployment, without user concent - which is an criminal offense
in most jurisdictions. (eg. CFAA in the US, §303 StGB in Germany).

Law enforcemence agencies are called to start criminal prosecution,
victims (virtually any Android user) might consider filing criminal
charges against Google.

---
Enrico Weigelt, metux IT consult
Free software and Linux embedded engineering
info@...ux.net -- +49-151-27565287

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives