# MA-463.032015: MyCERT Alert - Installer Hijacking Vulnerability in Android Devices

**Date:** 30 Mar 2015  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-463.032015  
**Advisory ID:** MA-463.032015

---

#### **1.0 Introduction**
A vulnerability in Google's Android OS has been discovered that could allow an attacker to change or replace a seemingly safe Android application with malware during installation. An attacker exploiting this vulnerability could access and steal user data on compromised devices without user knowledge.
**2.0 Impact**
- Android Installer Hijacking allows an attacker to modify or replace a seemingly benign Android app with malware, without user knowledge. This only affects applications downloaded from third-party app stores.
- The malicious application can gain full access to a compromised device, including usernames, passwords, and sensitive data.
**3.0 Affected Products**
- Devices running Android 4.3 and below
**4.0 Recommendation**
Palo Alto Networks has published a vulnerability scanner app, Installer Hijacking Scanner in the Google Play store. The app can be downloaded here:
- [Installer Hijacking Scanner](https://play.google.com/store/apps/details?id=com.paloaltonetworks.ctd.ihscanner)
A tutorial video on how to check the presence of this vulnerability is also available here:
- [Video on how to use Installer Vulnerability Scanner](https://www.youtube.com/watch?v=AgPEoYdHE34&feature=youtu.be)
Generally, MyCERT advises the users of this software to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: [[email protected]](/cdn-cgi/l/email-protection#bbd8c2d9dec9828282fbd8c2d9dec9c8ded8cec9d2cfc295d6c2) or [[email protected]](/cdn-cgi/l/email-protection#8de0f4eee8fff9cde0f4eee8fff9a3e2ffeaa3e0f4) 
Phone: 1-300-88-2999 (monitored during business hours)
Fax : +603 89453442 
Mobile: +60 19 2665850 (24x7 call incident reporting)
SMS : CYBER999 REPORT EMAIL COMPLAINT to 15888
Business Hours : Mon - Fri 09:00 AM - 18:00 PM MYT
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
Twitter: <http://www.twitter.com/mycert>
Cyber999 Mobile Apps: [IOS Users](https://itunes.apple.com/my/app/cyber999-mobile-application/id888552400?mt=8&ign-mpt=uo%3D4) or [Android Users](https://play.google.com/store/apps/details?id=my.cyber999.mobile)
**5.0 References**
- US-CERT: Installer Hijacking Vulnerability in Android Devices, <https://www.us-cert.gov/ncas/current-activity/2015/03/24/Installer-Hijacking-Vulnerability-Android-Devices>
- Android Installer Hijacking Vulnerability, <http://researchcenter.paloaltonetworks.com/2015/03/android-installer-hijacking-vulnerability-could-expose-android-users-to-malware/>