New Malicious Apps Can Gain System Privilege As Rom Is Signed With Default Platform Key

[qwertyman]

It seems all xiaomi.eu ROMs are signed with the default Android platform private key. This is a severe security flaw. Any arbitrary userland apps (installed by users using apk files) can gain System privilege by claiming android:sharedUserId="android.uid.system" in the manifest xml file.

Here is an example app that is signed with platform key and has such field (Chinese website, translate it using Google Translate):

https://www.coolapk.com/apk/tc.mycompany.com.hstopapk

This app (hstopapk) can gain system privilege and disable/freeze any apps without root permission.

 

[qwertyman]

Please help check this problem: @ingbrzy

 

[ingbrzy]

Signing key of ROM zip has no any effect on ROM security..

did you try that app? doesn't work for me on Android 8.x and Android 7.x...

 

[qwertyman]

Signing key of ROM zip has no any effect on ROM security..

did you try that app? doesn't work for me on Android 8.x and Android 7.x...

Thanks a lot for the reply. Yes, I tried that app. It will crash on my EU rom / Mix2 / latest beta. However, it is stopped by SELinux but not the package installer.

The probem is that the package can actually be installed into the system, which passes the signature check. So there still be possibility that a malicious app can run and gain system privilege.

Normally, such app should not even been installed in the first place. Stock MIUI rom will stop such app from installing.

Here is a Chinese forum discussing this issue. Users who are using the stock Roms mostly cannot install this example apk which is rejected by the system.

https://www.v2ex.com/t/446931

 

[demarkIV]

wow!

 

[Danacy]

Any update on this? Is the signature truly not effecting security?

 

[Igor Eisberg]

I just checked the digital signature (CERT.RSA) for "framework-res.apk", and it's the official Xiaomi signature.
The ZIP signature for the ROM has absolutely no relevance to ROM security.

 

[MarkHUK]

This is not an issue for our ROM, closing thread down. If any reputable information can be provided to contradict that then im sure it can be investigated more.