New Malicious Apps Can Gain System Privilege As Rom Is Signed With Default Platform Key


Status
Not open for further replies.

qwertyman

Members
Sep 23, 2017
20
15
It seems all xiaomi.eu ROMs are signed with the default Android platform private key. This is a severe security flaw. Any arbitrary userland apps (installed by users using apk files) can gain System privilege by claiming android:sharedUserId="android.uid.system" in the manifest xml file.

Here is an example app that is signed with platform key and has such field (Chinese website, translate it using Google Translate):

https://www.coolapk.com/apk/tc.mycompany.com.hstopapk

This app (hstopapk) can gain system privilege and disable/freeze any apps without root permission.
 

ingbrzy

Xiaomi.eu ROM leader
Staff member
Feb 11, 2012
9,498
322
Signing key of ROM zip has no any effect on ROM security..

did you try that app? doesn't work for me on Android 8.x and Android 7.x...
 

qwertyman

Members
Sep 23, 2017
20
15
Signing key of ROM zip has no any effect on ROM security..

did you try that app? doesn't work for me on Android 8.x and Android 7.x...
Thanks a lot for the reply. Yes, I tried that app. It will crash on my EU rom / Mix2 / latest beta. However, it is stopped by SELinux but not the package installer.

The probem is that the package can actually be installed into the system, which passes the signature check. So there still be possibility that a malicious app can run and gain system privilege.

Normally, such app should not even been installed in the first place. Stock MIUI rom will stop such app from installing.

Here is a Chinese forum discussing this issue. Users who are using the stock Roms mostly cannot install this example apk which is rejected by the system.

https://www.v2ex.com/t/446931
 

Igor Eisberg

Developer
Staff member
Oct 6, 2016
2,671
322
I just checked the digital signature (CERT.RSA) for "framework-res.apk", and it's the official Xiaomi signature.
The ZIP signature for the ROM has absolutely no relevance to ROM security.
 

MarkHUK

Founder of Xiaomi.eu
Staff member
Nov 6, 2010
5,226
1,000,000
This is not an issue for our ROM, closing thread down. If any reputable information can be provided to contradict that then im sure it can be investigated more.
 
Status
Not open for further replies.