Bluebox have recently disclosed a vulnerability (Android security bug 8219321) in Android, that is getting a lot of coverage in the media.
The title of the post is "Uncovering Android Master Key" - I'm assuming this is just a media-friendly headline, and a master key doesn't come in to it.
From what they have disclosed so far, it allows for
APK code modification without breaking the cryptographic signature
Taking this at face value, if it is possible to take a signed Android application (APK) and modify it without invalidating the signature, what practical attacks are possible?
What is the risk to a typical Play-store-only user (probably only installing high ranking search results and featured apps in the Play store)?
Some more specific questions:
Given a validly signed (maliciously modified) APK, what are the barriers to getting the legitimate Play store version of the app updated with that file?
Would a man-in-the-middle attacker (e.g. malicious wifi hotspot) be able to exploit auto update in any way (this might be - are APKs delivered over HTTPS?)
They state that a signed app that appears to come from the device manufacturer allows full system access - are these permissions different to the normal Android permissions system? How does it work? Are system updates delivered as APKs and is there any risk here?
How much does this help phishing attacks? Presumably a user would still need to enable installation from "unknown sources"?
I appreciate that at this point the full details of the vulnerability are not publicly available*, so I'm looking for answers based on the above quote, and possibly extrapolating additional information from anything else Bluebox have said or from other reputable sources.
* presumably if this bug has been fixed in any publicly released updates, we will very quickly find out what it is from people analysing the deltas in the APK verification area.