<http://schema.org/articleBody>
"Four researchers representing some of Italy's top\u00A0universities\u00A0and research centres have identified and patched a Denial of Service exploit that affects all versions of Google's Android operating system, a fix that Google has said will be used in the next update for Android smartphones and tablets.\r\n\r\nAlessandro Armando, Head of the Research Unit &amp;quot;Security &amp;amp;amp; Trust&amp;quot; and coordinator of the Artificial Intelligence Laboratory at the University of Genoa, Alessio Merlo of Telematic University E-Campus, Professor.\u00A0Mauro Migliardi, a coordinator at the University of Padova and Luke Verderame, Computer Engineering graduate at the University of Genoa made the discovery, which was noted in a research paper\u00A0(PDF) hosted on a University of Genoa's website.\r\n\r\nAccording to the paper, the researchers present a &amp;quot;previously unknown vulnerability in Android OS that\u00A0allows a malicious application to force the system to fork an unbounded number\u00A0of processes and thereby mounting a Denial-of-Service (DoS) attack that makes\u00A0the device totally unresponsive.&amp;quot;\r\n\r\nThe test application was used on a number of smartphones, including the LG Optimus One smartphone and different tablets\u00A0including\u00A0the Samsung Galaxy Tab. The Optimius One froze in less than\u00A0a minute while others -- including the Galaxy Tab -- froze in under 2 minutes.\r\n\r\nBy invoking a process in the Linux layer that does not perform a binding operation with an Android app, the team was able to bypass the security policies within the OS, thereby occupying all of the memory resources on a smartphone or tablet, without needing to access malicious Android permissions.\r\n\r\nIf an enterprising malware app developer forced an application to load on boot, a reboot of the device would prove fruitless.\r\n\r\nThe team offered two fixes to patch the vulnerability. The first involved checking if the specific process comes from a 'legal source' -- one being the System Server -- with the second restricting the permissions on the target socket at the Linux layer.\u00A0The vulnerability was sent to Google, the Open Handset Alliance and the US-CERT.\r\n\r\nWith Google needing to ensure the bug was fixed quickly (as it could potentially affect so many devices), the company ended up using the fix provided in the paper, which will be rolled out in future Android OS updates in the near future."^^<http://www.w3.org/2001/XMLSchema#string>
<http://thenextweb.com/google/2012/03/26/google-to-patch-android-denial-of-service-exploit-using-fixes-provided-by-italian-researchers-that-found-it/>