Security

U-M Researchers Expose Open Port Vulnerabilities on Android Apps

• By Sri Ravipati
• 05/03/17

Most security experts are aware of “wormhole” apps, popular Android apps with open ports that allow an attacker to remotely exploit a mobile device, but a new study from the University of Michigan (U-M) found that more Android apps are vulnerable to security breaches than previously thought.

Researchers at the Electrical Engineering and Computer Science (EECS) department conducted a study and identified 410 apps in the Google Play store that have open ports “with dangerous insecurities and 956 potential exploits in total,” the research report said. One of the apps comes pre-installed on several Android devices.

For the study, the U-M team designed OPAnalyzer, a static analysis tool that can identify and characterize vulnerable open port usage in Android apps. The researchers used the tool to examine more than 100,000 Android apps and found that 99 percent of mobile usage of open ports takes place for the following five reasons:

• Data Sharing: A usage path through which data from a device is sent to the remote host. The researchers found that HTTP is the most commonly used protocol for data sharing. Nearly 60 percent of data sharing paths do not require any client authentication.
• Proxy: A path used to forward remote input requests to other destinations. Commonly used for advertising and content filtering, a proxy path can lead to DDoS attacks.
• Remote execution: Used to trigger specific actions, such as sending an SMS message. Many app developers have left “backdoors” for this path type.
• VoIP: Used in apps to listen on incoming call requests, VoIP paths can be used to spoof caller IDs — making phishing attempts more achievable.
• PhoneGap: Paths on apps developed by Gap/Cordova, which serve JavaScript requests from the client and handle API calls. However, the U-M researchers determined these are mostly secured.

Using the tool, the U-M team found that affected apps have tens of millions of downloads, naming Wifi File Transfer, AirDroid, PhonePal and other popular apps to avoid.

Traditional solutions to protect an open port from online threats call for firewalls, but “the firewall solution suffers from usability in the mobile context,” according to the report. In other words, it can be difficult for individual users to configure suitable firewall rules on top of everything else.

Read the full report here.