Hackers can compromise your Android phone with a single image file

Android phones vulnerable to maliciously crafted PNG images

What's the harm in opening a digital image?

While there isn't a record of the attack actually happening in the wild, the vulnerability in Android versions 7.0 to 9.0 would give hackers "privileged access" to run malicious code on any Android device that had opened a malicious PNG image file.

The vulnerability, found in Android 7.0 Nougat through to Android 9.0 Pie, was first disclosed by Google in an Android Security Bulletin published February 4. Should the user open the file, the exploit is triggered. However, given the ease in which the bug can be exploited, users should accept incoming updates to their Android builds as soon as possible.

Just by opening the evil PNG file on a chat app or email, the malware can start running on the device with high-level privileges.

Another byproduct of the Midwest’s extreme cold: ghost apples
The end result is a cool, ghostly shell that's just slightly less fragile but a lot more attractive than a rotten, mushy apple. However with a few of them, the mush slipped out of the bottom of the ice casing, leading to a "ghost apple".

As per Google's Android security bulletin, A flaw in the operating system's framework can let a remote attacker execute computer code on an Android smartphone using a specially crafted PNG file.

Unfortunately, it is unknown when third-party handset manufacturers will roll out the security updates on their phones, as many of them take weeks, if not months, to do roll them out.

Google also detailed a suite of other flaws its scraped off and fixed in Android, including one sever vulnerability at the "library" level which "could enable a remote attacker using a specially crafted file to execute arbitrary code within the context of an unprivileged process". Also, no cases have been reported yet of anyone exploiting the vulnerability.

Craig Young, computer security researcher for Tripwire Inc.'s Vulnerability and Exposure Research Team, told SiliconANGLE that it appears that the vulnerability is directly related to how Android parses, that is interprets, an image before rendering it. Moreover, Google has already notified all Android partners about the security bug one month prior to publishing details of the vulnerabilities and has also released the code patches to the Android Open Source Project (AOSP) repository.

Related:

Comments

Latest news

Power out in Donegal homes, trees cleared as Storm Erik blows out
Meanwhile, Dorset Police said officers were called on Friday morning after a tree fell on to a double-decker bus. Victoria Jones - PA Images via Getty ImagesA woman battles strong winds on London's Waterloo bridge on Friday.

Southampton boss Hasenhuttl impressed with Ward-Prowse change
Southampton has lost striker Danny Ings to a hamstring injury, with the forward expected to miss three weeks of action. Southampton are unbeaten in the league since December but remain threatened by relegation, now sitting in 16th place.

Mueller Probe Focuses On 2016 Manafort Meeting With Kilimnik
Legal experts say Manafort faces a possible seven- to 10-year sentence in his related Virginia federal case, which U.S. Kilimnik was indicted previous year with Manafort on witness tampering charges.

Tributes are pouring in for United Kingdom rapper Cadet, following his death
Rest in Paradise to UK Rap Superstar Callmecadet . "All our love & stength towards the Johnson family and his supporters". Award-winning artist Krept, cousin of the rapper, said he was "broken" following the devastating news.

England’s Chris Ashton to face France in Six Nations clash
The other player to miss the cut is rookie Bath wing Joe Cokanasiga, who is continuing his recovery from a knee injury. They are full of talent and have a lot of unpredictability.

Celtics, Irving have 'engagement,' Ainge says
Only time will tell if Irving remains as committed to the Celtics as they apparently are to him. Celtics fans can only hope that a deep playoff run will keep Irving on the parquet floor.

George's 45 tops Harden's 42 as Thunder eke out win
Less than three minutes into the final frame, the Thunder led 98-92, and the Rockets were left scrambling. Steven Adams had played a big hand in helping his Oklahoma City Thunder side beat the Houston Rockets .

French Minister 'Disgusted' by Yellow Vest Attacks
The activists waved Latvia's red-and-white flag, shouting slogans like "the French have woken up, while Latvians remain asleep". Paris police confirmed that a demonstrator injured in the hand been treated by paramedics, but did not elaborate.

Nitties equals world record at Vic Open
I definitely have the world record for best bounce-back stat because I holed the nine birdies and I preceded it with a double-bogey.

Alexandre Lacazette wishes Arsenal scored more against Huddersfield
But they are very big teams - we are outsiders because we are sixth. They have an advantage and there is a big difference between us.

Acting attorney general Matthew Whitaker testifies before House Judiciary Committee
When Whitaker tried to respond, the New York Democrat interrupted: "Mr Whitaker, that was a statement, not a question". As Whitaker noted several times during his almost six hour long hearing, he doesn't have much time left in his role.

Renault to alert prosecutors over ex-CEO Ghosn's wedding costs
Renault initially stood by Ghosn, but last month named a new CEO and chairman to replace him as his Japanese legal case drags on. The chateau said it was given 2.3 million euro (£2 million) by Renault to fund renovations in a 2016 philanthropic deal.

Ricky Ponting named Australia assistant coach
The news of Ponting's appointment comes close on the heels of David Saker's abrupt resignation as Australia's bowling coach. Ponting will take up the role following Australia's ODI tours against India and Pakistan.

Hindi film actor Mahesh Anand found dead at his home
After the news of his death became public, his wife told a portal that she never talked to her husband since 2002. Mahesh Anand in a still from Baaghi , starring Sanjay Dutt and Aditya Pancholi.

Los Angeles Clippers rally from 28 down, stun Celtics 123-112
The Clippers win keeps them at the No. 8 seed in the WConferencenferece, one game ahead of the ninth-place Sacramento Kings . Boston has two days of reflection before they head to Philadelphia on Wednesday to take on their rival 76ers.

Other news