Nearly All Google Pixel Phones Are Left Exposed by Unpatched Flaw in Hidden Android App

Google's flagship Pixel smartphone enactment touts information arsenic a centerpiece feature, offering guaranteed bundle updates for 7 years and moving banal Android that's meant to beryllium escaped of third-party add-ons and bloatware. On Thursday, though, researchers from the mobile instrumentality information steadfast iVerify are publishing findings connected an Android vulnerability that seems to person been contiguous successful each Android merchandise for Pixel since September 2017 and could exposure the devices to manipulation and takeover.

The contented relates to a bundle bundle called “Showcase.apk” that runs astatine the strategy level and lurks invisible to users. The exertion was developed by the endeavor bundle institution SmithMicro for Verizon arsenic a mechanics for putting phones into a retail store demo mode—it is not Google software. Yet for years, it has been successful each Android merchandise for Pixel and has heavy strategy privileges, including distant codification execution and distant bundle installation. Even riskier, the exertion is designed to download a configuration record implicit an unencrypted HTTP web transportation that iVerify researchers accidental could beryllium hijacked by an attacker to instrumentality power of the exertion and past the full unfortunate device.

iVerify disclosed its findings to Google astatine the opening of May, and the tech elephantine has not yet released a hole for the issue. Google spokesperson Ed Fernandez tells WIRED successful a connection that Showcase “is nary longer being used” by Verizon, and Android volition region Showcase from each supported Pixel devices with a bundle update “in the coming weeks.” He added that Google has not seen grounds of progressive exploitation and that the app is not contiguous successful the new Pixel 9 bid devices that Google announced this week. Verizon and SmithMicro did not respond to WIRED's requests for remark up of publication.

“I’ve seen a batch of Android vulnerabilities, and this 1 is unsocial successful a fewer ways and rather troubling,” says Rocky Cole, main operating serviceman of iVerify and a erstwhile NSA analyst. “When Showcase.apk runs, it has the quality to instrumentality implicit the phone. But the codification is, frankly, shoddy. It raises questions astir wherefore third-party bundle that runs with specified precocious privileges truthful heavy successful the operating strategy was not tested much deeply. It seems to maine that Google has been pushing bloatware to Pixel devices astir the world.”

iVerify researchers discovered the exertion aft the company's threat-detection scanner flagged an antithetic Google Play Store app validation connected a user's device. The customer, large information analytics institution Palantir, worked with iVerify to analyse Showcase.apk and disclose the findings to Google. Palantir main accusation information serviceman Dane Stuckey says that the find and what helium describes arsenic Google's slow, opaque effect has prompted Palantir to signifier retired not conscionable Pixel phones, but each Android devices crossed the company.

“Google embedding third-party bundle successful Android's firmware and not disclosing this to vendors oregon users creates important information vulnerability to anyone who relies connected this ecosystem,” Stuckey tells WIRED. He added that his interactions with Google passim the modular 90 time disclosure model “severely eroded our spot successful the ecosystem. To support our customers, we person had to marque the hard determination to determination distant from Android successful our enterprise.”