Android Heartbleed Alert: 150 Million Apps Still Vulnerable

Android developers are starting to patch OpenSSL flaws. Meanwhile, Apple ships an SSL fix for iOS and OS X.

Warning to Android users: No patches are available for 150 million downloaded Android apps that remain vulnerable to the OpenSSL vulnerability known as Heartbleed. That finding comes from the security firm FireEye, which scanned more than 54,000 apps available via Google Play that have been downloaded at least 100,000 times.
The good news, however, is that since the Heartbleed vulnerability
came to light
on April 7, developers have released patches covering about 70 million previously vulnerable apps, thus taking a big bite out of what had been 220 million unpatchable apps.
That decline reflects Android app developers updating their wares with a patched version of OpenSSL, thus helping safeguard users from the possibility of malicious servers exploiting the bug to steal data from their devices. We have notified some of the app developers and library vendors about the OpenSSL Heartbleed vulnerability found in their products, FireEye information security researchers Yulong Zhang, Hui Xue, and Tao Wei wrote in a
blog post
. Fortunately, it seems most app developers and library vendors take Heartbleed seriously, as we have started to see apps updated with proper fixes.
How can Android users know which apps are still vulnerable? In general, anyone using a version of Android that isnt 4.1.0 or 4.1.1 wont be vulnerable, at least from an operating system standpoint. But vulnerable apps might still be running on the device, and theres no clear-cut, reliable way to inventory or scan them all.
FireEye, for example, counts 17 Google Play antivirus offerings that
claim to detect Heartbleed
, but it says that only six scan the OpenSSL library for Android.
Furthermore, apps can tap buggy OpenSSL code in other ways. Android apps frequently use native libraries, which either directly or indirectly leverage vulnerable OpenSSL libraries, the FireEye researchers said. Therefore, even though the Android platform itself is not vulnerable, attackers can still attack those vulnerable apps. They can hijack the network traffic, redirect the app to a malicious server, and then send crafted [Heartbeat] messages to the app to steal sensitive memory contents.
One mitigating factor is that the majority of vulnerable apps appear to be games, so if attackers did exploit them, users would stand to lose their OAuth token, at most. However, enterprising attackers could use these tokens to attempt to hijack the game account and any social networks to which it connects, but thats arguably a lot of effort for little return.
But the second-most-prevalent type of vulnerable Android app appears to be office apps, which pose a greater risk when it comes to losing sensitive data. On the upside, FireEye found that, due to coding errors, many apps that contain vulnerable OpenSSL code are protected, oftentimes because developers appeared to accidentally call the OpenSSL library in Android OS, rather than a vulnerable, native library.
Android isnt the only mobile operating system sporting SSL vulnerabilities. On Tuesday, Apple pushed an iOS update -- version 7.1.1 -- that improves
Touch ID fingerprint recognition
and patches numerous flaws in WebKit, IOKit Kernel, CFNetwork HTTP, and Secure Transport. The flaw patched by Apple would have allowed an attacker who could eavesdrop on communications to subvert SSL.
In a triple handshake attack, it was possible for an attacker to establish two connections which had the same encryption keys and handshake, insert the attackers data in one connection, and renegotiate so that the connections may be forwarded to each other, according to
Apples iOS security advisory
. To prevent attacks based on this scenario, Secure Transport was changed so that, by default, a renegotiation must present the same server certificate as was presented in the original connection.
Apple also released an OS X update Tuesday for its 10.7, 10.8, and 10.9 operating systems, patching numerous vulnerabilities, including the same type of Secure Transport flaw that attackers could use to subvert SSL. According to
Apples OS X security advisory
, the flaw was fixed in 10.8 and 10.9; it didnt exist in 10.7 or earlier versions of the operating system.
IT is turbocharging BYOD, but mobile security practices lag behind the growing risk. Also in the
Mobile Security
issue of InformationWeek: These seven factors are shaping the future of identity as we move to a digital world (free registration required).

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Android Heartbleed Alert: 150 Million Apps Still Vulnerable