0

The android app rekey claims that it can protect android device against "Master Key" vulnerabilities

on their website they have a test/proofOfConcept

To verify that your device has been patched, you can 
attempt to install a [PoC APK] to test whether it is properly 
blocked by ReKey."

I first installed rekey (version 1.0.4 dated July, 21th 2013) and then PoC APK but got no warning that PoC is not ok.

  • Does that mean does rekey does not work at all?
  • Or does it not work on my rooted android 2.2 smartfone?
  • Or is PoC APK not a proove of concept?

What is your experience/option?

Can you confirm that it is working or not working on your device?

Improve this question

1 Answer 1

Reset to default
4

I'd be extremely worried there!

The MasterKey vulnerability exploit works in the handling of ZipEntry (see below - Bug 8219321), which is buried deep in the ROM itself, its used in the PackageManager layer as well.

For such an application claiming "to patch" it, is misleading and false, because it is a user application and not at system level.

The real cure to get around the vulnerability is to modify the source code in Android in itself and rebuild the ROM.

The vulnerability exploits ROMs from Donut (1.6) right up to Jellybean (4.2).

In the FAQ of the app's website - this made my hairs stand up:

Can I trust ReKey with root access on my device?

Did you see those seals up above? They look pretty darn official and trustworthy. They have Latin phrases and everything.

I really do not know whether to laugh or cry!

Dynamically patching the bytecode in the Android's Java DalvikVM (Runtime engine to the uninitiated) is unheard of.

Verdict:

I would take those so-called "claims of a user-level app" patching in Masterkey exploit, with a pinch of salt and not get fooled by it.

Source:

Patches:

  • Bug: 8219321 - Remove duplicate entries in Zip.
  • Bug: 9695860 - unsigned Zip Entries.
Improve this answer
3
  • +1 thanks for the info. Maybe ReKey uses "patch" as a metapher. For example the app LBE Privacy Guard for android really protects my android: I can decide at runtime if an apps is allowd to access internet/contacts. This also looks like a patch. ReKey irrites me because i got the info about reky from the german heise security which has a good reputation in germany.
    – k3b
    Jul 23, 2013 at 19:45
  • There is a module for the Xposed framework that "patch" the bug, and it is at runtime...
    – Matthieu Harlé
    Jul 23, 2013 at 19:50
  • Xposed Framework - that looks like a breeding ground for malware ... I extended the /system/bin/app_process executable to load a JAR file on startup. The classes of this file will sit in every process (including the one for system services) and can act with their powers Another thing, its for ICS or later, and the author has refused to backport to older Androids...
    – t0mm13b
    Jul 23, 2013 at 20:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .