New Android Bug Can Let Hackers Attack Phone With PNG Image File

Android vulnerability lets hackers wreak havoc using er a PNG file

We review products independently, but we may earn affiliate commissions from buying links on this page.

Opening a cute cat meme or innocent landscape photo may seem harmless enough, but if it happens to be in a.PNG format, your Android device could be critically compromised due to a new attack.

The most severe of these issues is a critical security vulnerability in Framework that could allow a remote attacker using a specially crafted PNG file to execute arbitrary code within the context of a privileged process.

The problem was disclosed this week in Google's Android security bulletin.

In Google's Android security update for February, the tech giant's advisory noted a critical vulnerability which exists in the Android operating system's framework. The severity assessment is based on the effect that exploiting the vulnerability would possibly have on an affected device, assuming the platform and service mitigations are turned off for development purposes or if successfully bypassed. A separate app can then read the image file and decrypt it to launch the hidden computer code inside.

More news: You Almost Have to Respect This $900,000 Kanye West Fashion Week Scam

"Vulnerabilities like these bring to light the disparate update strategies across Android phones", explained Tripwire VP, Tim Erlin. However, given the ease in which the bug can be exploited, users should accept incoming updates to their Android builds as soon as possible.

However, several third-party device makers take weeks or months to roll out security patches to their phones, so it leaves your device vulnerable until handset receives the 2019 February update.

Google engineers have not revealed any technical aspect of the vulnerabilities so far, the updates mention fixing 'heap buffer overflow flaw', "errors in SkPngCodec".

It's also worth noting that Google didn't report such an exploit being used in the real world, which probably suggests that hacking has moved a bit beyond inserting code into PNG files.

Related News:



Most liked

Florida Man Dances Through Field Sobriety Test, Is Arrested For DUI
At one point in the tests, Larson was instructed to walk heel-to-toe across a piece of tape stretched out on the ground. It may have looked like a party in the west Florida town of Holiday, but it was actually a roadside sobriety test.

Super League would have cost big clubs their popularity: Aleksander Ceferin
While long-standing UEFA-FIFA tensions have continued with these leaders, both first elected in 2016, Ceferin spoke warmly of another ally.

Storm Erik has left 1700 homes in Ireland without power
The Met Office's wind warning, which was in place until 15:00 BST on Saturday, has now been cancelled. DORSET POLICEThe massive tree struck the bus on Ringwood Road in Poole, police said.

Mavericks top Hornets 99-93 as Dallas deals Barnes to Kings
Trading him is one thing, but they actually trading Barnes while he was on the court and still playing for the team. The NBA trade deadline is tomorrow afternoon, so trades were obviously expected.

Wells Fargo Outage Continues as Company Works to Restore Systems
That prevented people from across the country from using its ATMs, the app on their phone, as well as the bank's online services. In response to the power shutdown, applications were systematically re-routed to backup data centers through Thursday.

No Xi summit before tariff date
The Kospi in South Korea declined 1.2 per cent to 2,177.05 and Australia's S&P ASX 200 was down 0.3 per cent at 6,071.50. US and Hong Kong media have reported that Trump and Xi may meet in late February - possibly around the time of a U.S.

Renault reports Ghosn's wedding to investigators
The French carmaker had previously said its internal investigation had found no evidence of wrongdoing by the former boss. Ghosn led both Renault and Nissan and championed their alliance as it grew into the world's biggest-selling auto maker.

M&S Launch A "Love Sausage" For Valentine's Day
Ideal for breakfast in bed, the £5 heart-shaped sausage is made with outdoor-bred pork and wrapped in gorgeous streaky bacon. And the retailer has high hopes for the cheeky product, expecting to sell over 15,000 to customers up and down the UK.

Kendall Jenner addresses those Kylie Jenner pregnancy and engagement rumors
Turning up the heat, Jenner replied with a racing auto emoji - seemingly implying she's on the way. There's nothing long-term or serious like that in my life", she told Harper's Bazaar in 2017.

Federal parliament was just hacked
However, Labor politicians and staff have said access to their emails had been intermittent. "I've had some briefings on it". The Australian Signals Directorate is now taking steps to secure the parliament's computer network.

Recent Match Report - New Zealand vs India 2nd T20I 2019
U.S. is the only country where they have not won a T20I match yet among countries in which they have played the shortest format. Ross Taylor was forced to run singles as the hit-me balls dried up and de Grandhomme was also slowed down.

Tottenham manager Pochettino: Liverpool still favourites
He's doing well, he's almost ready to play but we need to be realistic too and in between all the areas to take the best decision. Mauricio Pochettino says he is pessimistic that Tottenham would be able to move into their new stadium this season.

Epic Account Merging Is Finally Live in Fortnite
Fortnite account merges are now possible, a little over half a year after cross-platform incompatibility issues came to a head . It's a pretty inelegant solution to an awkward problem, but at least some sort of progress has been made.

Northam: Will Focus on Racial 'Equity' As Governor
Tyson's allegation, it needs to be investigated thoroughly because it impacts his ability to continue to serve the Commonwealth". Justin Fairfax , Trinity '00 and lieutenant governor of Virginia , now faces a second allegation of sexual assault.

Anthem Post-Launch and Endgame Content Revealed
To start, three extra difficulty modes will be unlocked once you reach pilot level 30, the game's level cap. Challenges occur on a daily, weekly, and monthly basis and reward you with materials and coin.