Serious failure renders Android phones unusable and locks them into an infinite loop

According to specialist Alecsandru Cătălin DAJ, from Bitdefender, the flaw is in the process of checking installed applications, carried out by an Android service called system_server. During this analysis, the system tries to read information about the compression of the ZIP files that make up the applications. However, certain compression data causes the service to stop working.

When this happens, Android restarts system_server and tries to check apps again. As it encounters the same problematic file, the service crashes again and begins a cycle that prevents the cell phone from completing initialization. Therefore, installing a malicious app is enough to trigger the attack, even if it is never opened. During the process, the user does not receive any error messages or warnings on the screen that indicate which application caused the problem.

Bitdefender has already reported the vulnerability to Google, but the company initially closed the call with the status “Won’t Fix (Not Reproducible)”. The justification was that the security team was unable to reproduce the error.

The security company sent a second report, this time with a proof-of-concept application capable of demonstrating the problem. Even so, Google refused the request again, on the grounds that the vulnerability was “outside the scope of a security update fix”.

With this classification, the failure was forwarded to another Google team, responsible for analyzing the case and evaluating a possible correction in the system. To date, however, there is no confirmation of an update to resolve the issue.

Faced with the lack of a solution, Bitdefender decided to publicly disclose the vulnerability. With the alert, however, criminals can try to create legitimate-looking malicious applications and even upload them to the Play Store to reach more victims. However, this could also put pressure on Google for a solution.

Until Google makes a fix available, the recommendation is to avoid installing applications from unknown or suspicious sources. As the failure does not depend on special permissions or opening the app, care must begin at the time of download and installation.

Affiliate Disclosure: Articles published by Silicon Dispatch may include verified affiliate partner links. If you purchase through these links, we may earn an affiliate commission at no additional cost to you.