German security research firm Curesec has gone public on a bug in the Android 4.3 ‘Jelly Bean' operating system after accusing Google of failing to respond quickly enough to its warning about the problem.
Curesec has discovered a ‘permission bypass' vulnerability which enables any rogue application to remove the user locks on an Android 4.3-based mobile phone.
Android offers a choice of locks, including pin, password and facial recognition to secure a device. But Curesec said bug CVE-2013-6271 means that malicious users can control what lock mechanism the device should have, and remove all existing device locks activated by a user.
The company said it reported the issue to Google on 11 October and received a response the following day. But after Curesec asked Google for feedback three times during October and November, it eventually went public on the problem on 27 November.
In an advisory issued last week and updated this Tuesday, the company said: “Curesec disclosed this vulnerability as Google Android Security Team was not responding any more about this issue.”
A Google representative is reported as saying the problem was fixed in Android Kit Kat 4.4. But currently KitKat represents only 1.1 per cent of the current Android user base, according to the latest Developer Dashboard figures.
A Google spokesperson was unable to comment to SCMagazineUK.com at the time of writing.