Researchers have devised an attack that gains unfettered "root" access to a large number of Android phones, exploiting a relatively new type of bug that allows adversaries to manipulate data stored in memory chips.
Two researchers demonstrated how they were able to push a malicious information-stealing app onto Google Play, even while Google's Bouncer custom malware scanner is watching.
They circumvented Bouncer, an automated scanner, with a JavaScript trick that transformed a benign Android app into a malicious one on Google Play, Nicholas Percoco, head of Trustwave Spider Labs, told attendees at Black Hat security conference in Las Vegas on Wednesday.
