Serious security bug found in Android 2.2 (2.3 exploit to follow next week)

CrowdStrike

Dmitri Alperovitch, chief technology officer and co-founder of CrowdStrike, has found a serious security exploit in the brower of Android 2.2. The exploit allows for total control of the handset, inlcuding listening and recording phone calls.

The exploit works via a specially crafted link sent by email. When the link is opened in the default browser on Android 2.2 it infects the device with malware that can be used to remotely access it. This is one of the ways desktop computers are infected, too.

Android 2.2′s marketshare is currently 28%, so quite many users are in danger. Dimitri Alperovitch stated that an exploit for Android 2.3 will be ready by next week, increasing the users in danger by another 59%!

Let’s hope that Google fixes the vulnerability as soon as possible.