<p dir="ltr">Google implemented a Play scan for this bug. Apps from Google Play ONLY have been checked. Other repos are vulnerable.<br>
Now to see if phone vendors push an update. Not holding my breath.</p>
<div class="gmail_quote">On Jul 6, 2013 10:40 AM, "Charles Shapiro" <<a href="mailto:hooterpincher@gmail.com">hooterpincher@gmail.com</a>> wrote:<br type="attribution"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>Be careful out there. ( <a href="http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/" target="_blank">http://bluebox.com/corporate-blog/bluebox-uncovers-android-master-key/</a> ). This basically means that it's possible to grab an application from Google Play and undetectably modify it to do Evil. It's more-or-less the equivalent of a privilege escalation exploit in Unix. Nothing in the wild yet.<br>
<br></div>-- CHS<br><br></div>
<br>_______________________________________________<br>
Ale mailing list<br>
<a href="mailto:Ale@ale.org">Ale@ale.org</a><br>
<a href="http://mail.ale.org/mailman/listinfo/ale" target="_blank">http://mail.ale.org/mailman/listinfo/ale</a><br>
See JOBS, ANNOUNCE and SCHOOLS lists at<br>
<a href="http://mail.ale.org/mailman/listinfo" target="_blank">http://mail.ale.org/mailman/listinfo</a><br>
<br></blockquote></div>