U-M Researchers Expose Open Port Vulnerabilities on Android Apps

Most security experts are aware of “wormhole” apps, popular Android apps with open ports that allow an attacker to remotely exploit a mobile device, but a new study from the University of Michigan (U-M) found that more Android apps are vulnerable to security breaches than previously thought.

Researchers at the Electrical Engineering and Computer Science (EECS) department conducted a study and identified 410 apps in the Google Play store that have open ports “with dangerous insecurities and 956 potential exploits in total,” the research report said. One of the apps comes pre-installed on several Android devices.

For the study, the U-M team designed OPAnalyzer, a static analysis tool that can identify and characterize vulnerable open port usage in Android apps. The researchers used the tool to examine more than 100,000 Android apps and found that 99 percent of mobile usage of open ports takes place for the following five reasons:

  • Data Sharing: A usage path through which data from a device is sent to the remote host. The researchers found that HTTP is the most commonly used protocol for data sharing. Nearly 60 percent of data sharing paths do not require any client authentication.
  • Proxy: A path used to forward remote input requests to other destinations. Commonly used for advertising and content filtering, a proxy path can lead to DDoS attacks.
  • Remote execution: Used to trigger specific actions, such as sending an SMS message. Many app developers have left “backdoors” for this path type.
  • VoIP: Used in apps to listen on incoming call requests, VoIP paths can be used to spoof caller IDs — making phishing attempts more achievable.
  • PhoneGap: Paths on apps developed by Gap/Cordova, which serve JavaScript requests from the client and handle API calls. However, the U-M researchers determined these are mostly secured.

Using the tool, the U-M team found that affected apps have tens of millions of downloads, naming Wifi File Transfer, AirDroidPhonePal and other popular apps to avoid.

Traditional solutions to protect an open port from online threats call for firewalls, but “the firewall solution suffers from usability in the mobile context,” according to the report. In other words, it can be difficult for individual users to configure suitable firewall rules on top of everything else.

Read the full report here.

About the Author

Sri Ravipati is Web producer for THE Journal and Campus Technology. She can be reached at [email protected].

Featured

  • AI robot with cybersecurity symbol on its chest

    Microsoft Adds New Agentic AI Tools to Security Copilot

    Microsoft has announced a major expansion of its AI-powered cybersecurity platform, introducing a suite of autonomous agents to help organizations counter rising threats and manage the growing complexity of cloud and AI security.

  • modern college building with circuit and brain motifs

    Anthropic Launches Claude for Education

    Anthropic has announced a version of its Claude AI assistant tailored for higher education institutions. Claude for Education "gives academic institutions secure, reliable AI access for their entire community," the company said, to enable colleges and universities to develop and implement AI-enabled approaches across teaching, learning, and administration.

  • central cloud platform connected to various AI icons—including a brain, robot, and network nodes

    Linux Foundation to Host Protocol for AI Agent Interoperability

    The Linux Foundation has announced it will host the Agent2Agent (A2A) protocol project, an open standard originally developed by Google to support secure communication and interoperability among AI agents.

  • open laptop in a college classroom with holographic AI icons like a brain and data charts rising from the screen

    4 Ways Universities Are Using Google AI Tools for Learning and Administration

    In a recent blog post, Google shared an array of education customer stories, showcasing ways institutions are using AI tools like Gemini and NotebookLM to transform both learning and administrative tasks.