First Malicious Use of 'Master Key' Android Vulnerability Discovered

Earlier this month, Symantec discussed the discovery of the Master Key vulnerability that allows attackers to inject malicious code into legitimate Android applications without invalidating the digital signature. We expected the vulnerability to be leveraged quickly due to ease of exploitation, and it has.

Norton Mobile Insight—our system for harvesting and automatically analyzing Android applications from hundreds of marketplaces—has discovered the first examples of the exploit being used in the wild. Symantec detects these applications as Android.Skullkey.

They found two applications infected by a malicious actor. They are legitimate applications distributed on Android marketplaces in China to help find and make doctor appointments.

Photo: Symantec

Symantec expects attackers to continue to leverage this vulnerability to infect unsuspecting user devices and just days later discovered four additional Android applications infected by the same attacker and being distributed on third-party app sites. The apps are a popular news app, an arcade game, a card game, and a betting and lottery app. All of these apps are designed for Chinese language users.

Obviously they suggest downloading from official sites such as Google Play with the exception of Majorgeeks, of course