Certifi-gate, Android’s newest vulnerability, could be affecting millions of devices

With most carriers and device manufacturers are still working to address Stagefright, there could already be another major security vulnerability on Android’s horizon.

Dubbed Certifi-gate, the vulnerability is caused by software like TeamViewer, CommuniTake Remote Care and MobileSupport by Rsupport. These apps are used by a variety of carriers and OEMs, including Samsung, LG and HTC, to provide remote customer service to people that use their devices. They carry certificates that allow them to gain root access to the device’s operating system and hardware.

According to Check Point, the security firm that discovered the vulnerability, these apps are insecure, and there’s already at least one app on the Play Store that is taking advantage of them with malicious intent.

The firm released an app that allows Android users to check if their particular device is susceptible to the vulnerability. When the firm presented its findings at the BlackHat security conference in Las Vegas this past week, it said that 100,000 people had downloaded the app. Of those people, 30,000 had agreed to anonymously provide information on their device to Check Point.

Using that data, which was published in a blog post, the firm says it was able to ascertain that 58 percent of Android devices are vulnerable to the bug. Moreover, 15.84 percent of those 30,000 users already have the plugin installed on their device. The most vulnerable devices are LG handsets, at 72 percent.

Unfortunately, even though it’s possible to locate the offending apps, uninstalling them does little to solve the problem; according to Check Point, the permissions for remote access are programmed into Android and require a software update to fix.

[source]Check Point[/source][via]Ars Technica[/via]