A Novel Attack against Android Phones

In the first quarter of 2011, Android has become the top-selling operating system for smartphones. In this paper, we present a novel, highly critical attack that allows unprompted installation of arbitrary applications from the Android Market. Our attack is based on a single malicious application, which, in contrast to previously known attacks, does not require the user to grant it any permissions. 1 Responsible Disclosure We reported this vulnerability to Google on June 20, 2011. In order to give them time to fix the issue, we removed the main content of this paper and generalized title and abstract. This document merely serves as a timestamp of discovery. 2 Hash The SHA-512 hash of the full report as sent to Google is given below: 051426b1794e363544893b7123ba3d15c5d878a9ff736162b85479d063a 86940fe2d6280774fd98989cce8b1628d5d9428d0691ee4ffcc2c07da82 31ca79af5d