To use Fake ID, hackers fabricate a set of identities for a malware app that includes those of specially privileged parties in the identity chain. The set of permissions normally shown to the user can be kept minimal, so the malware doesn't need to ask for suspicious permissions during installation. Once the app is installed, "it's game over," said Bluebox Security CTO Jeff Forristal.
An Android vulnerability that exists in every version from v2.1 Eclair to v. 4.3 Jelly Bean could expose millions of users, Bluebox Security has warned.
The flaw lets attackers fake the certificates of specially privileged parties, such as Adobe and Google Wallet, and serve them up with malware that bypasses detection by Android.
Attackers then can take over every application running on an Android device.