Another Serious Android Vulnerability Discovered Called Certifi-gate

You may have heard of the security flaw recently reported in Google’s Android operating system called Stagefright. It may allow an attacker to gain remote access to the devices by sending a text. It has been referred to as potentially the worst vulnerability to be found on that operating system ever. Now there is a competitor for that title. This one, Certifi-gate, is related to the authorization methods used in Android that allows for remote support on the devices. The technical support representative can use these tools to replicate the screen and simulate actions remotely. If the flaws in this technology are exploited, it could give an attacker unrestricted access to the device.

What Android users can do is lobby their mobile service providers to release updates more quickly once they are made available by Google and the device manufacturers. Some vendors and carriers in the past have been slow to release fixes to their subscribers, even when Google gets them out quickly. The school of thought is purely business; they make money when users have to buy new devices rather than fixing the ones they have.

Google has now realized that it should consider a regular patch schedule and will begin issuing security updates on a monthly basis. This is similar to what Microsoft does with its patch Tuesday to address the numerous flaws found in Windows. Some manufacturers, such as LG and Samsung have announced they will also begin a monthly patch release program.

Remember that as soon as any security and critical patches are made available, apply them to all devices. If it is possible to configure them to automatically update, that is recommended. If an operating system is no longer supported, patches and updates are no longer issued, so consider upgrading older devices to stay as secure as possible.

The Stagefright and certifi-gate vulnerabilities reportedly exist in hundreds of millions of Android devices running several versions of the operating system, including the latest release “Lollipop” versions 5.0 and 5.1. Patches for the Nexus Player and Nexus versions 4 to 10 are starting to be released now for Stagefright and many manufacturers will be releasing them later in the week for their devices. A fix for certifi-gate is forthcoming but unfortunately cellular service providers have not yet announced when they will distribute the patches to their customers.