GhostMap Android Flaw Can Trigger Persistent Crash Loops From a Crafted App
Summary
Bitdefender researchers detail GhostMap, an Android ZIP-parsing flaw that can make a crafted app trigger a persistent system crash loop, potentially requiring a data-erasing reset. Reproduced on Android 10+; no in-the-wild use observed, and Google says no security fix.
Key points
- Researchers say libziparchive and libandroidfw handle ZIP compression methods differently, allowing a malformed entry's declared size to cause an oversized memory mapping and SIGBUS when read.
- Installing a crafted app can trigger crashes without the app being opened, requesting permissions, or containing executable code; a malformed resource can make system_server repeatedly crash and restart.
- Rebooting and safe mode do not stop the demonstrated crash loop. Recovery may require a factory reset, which erases local data; ADB may help only in limited conditions.
- Bitdefender reports reproducing the issue on a Pixel 10 running Android 17 and on Android versions from 10 onward.
- The investigation began with a banking dropper sample that crashed during installation. Researchers say it only caused a failed install and found no indication its author intended the crash.
- Researchers say they have not observed the persistent crash-loop scenario used against anyone. Google considered the issue outside the scope of a security update and referred it to a team for possible future consideration.
- Bitdefender says its mobile product detects the malformed files, but Android does not let third-party apps block installation or remove another app automatically.
Article Details
- Attack Vectors
- A malformed APK contains a ZIP entry whose compression method is neither stored nor deflated and whose declared uncompressed length exceeds the file. When Android parses or reads the entry, the resulting out-of-bounds mapping can cause a SIGBUS and crash the reading process.
- The malformed manifest can crash the installer during installation; the wild-collected sample caused this failure, but the article says there is no evidence its author intended it.
- In a demonstrated scenario, a malformed resource read automatically by a core Android service crashes system_server repeatedly, preventing the phone from completing startup. The researchers say they have not seen this used against anyone.
- Hypothetically, a malicious app could malform its icon so that launcher and settings screens crash when opened, obstructing its removal.
- A malformed APK can crash Android-based security scanners or analysis tools when they parse it. Researchers reproduced a crash in an ordinary app using the standard APK-parsing API.
- The researchers describe introducing a malformed file through a later app update as a theoretical delivery scenario, not an observed attack.
- Defensive Notes
- The article reports that no fix was available as of publication and that Google considered the issue outside the scope of a security update, referring it for possible consideration in a future version.
- The malformed file can be identified by inspecting its structure without installing or running the app.
- Bitdefender reports that Bitdefender Mobile Security detects the malformation in downloaded and installed apps; a user must act on the warning because Android does not let a third-party app block installation or remove another app on its own.
- If the phone enters the demonstrated crash loop, the researchers say a factory reset may be required and erases locally stored data. ADB-based deletion may work only in limited circumstances, including having Developer Mode enabled beforehand.
MITRE ATT&CK
T1027.002 · Software PackingThe wild-collected banking dropper was wrapped by a packer that rewrote the APK's internal structure so reverse-engineering tools could not read it; the article says the author may not have known the rewrite would trigger the crash.T1499.004 · Application or System ExploitationThe researchers demonstrated that a malformed APK resource can crash Android processes and cause a persistent system_server crash loop; they describe malicious use of this denial of service as hypothetical and not observed in the wild.
CVE
CVE-2013-4787Google · AndroidMaster Key (2013, CVE-2013-4787). An APK contained two files with the same name. Android checked the signature on the first and installed the second, so malicious code got in under a valid signature. CVE-2016-6724Google Inc. · AndroidInterestingly, Google has already patched a weaker version of this defect. From the November 2016 bulletin, CVE-2016-6724: CVE-2017-13156Google Inc. · AndroidJanus (2017, CVE-2017-13156). A single file could be a valid APK and a valid DEX at the same time. The signature check looked only at the ZIP entries and ignored extra bytes added to the front of the file, and the
Malware
AnatsaPalo Alto's Unit 42 found about 9,200 such samples in a single year, used by banking trojans including Anatsa, Cerberus and BianLian. This is the kind of packing our sample used. BianLianPalo Alto's Unit 42 found about 9,200 such samples in a single year, used by banking trojans including Anatsa, Cerberus and BianLian. This is the kind of packing our sample used. CerberusPalo Alto's Unit 42 found about 9,200 such samples in a single year, used by banking trojans including Anatsa, Cerberus and BianLian. This is the kind of packing our sample used.
Vendors
BitdefenderBitdefender Labs researchers found that installing a specially crafted app can leave an Android phone stuck in a crash loop, even if you never open it or grant it a single permission. The app contains no code and neverGoogleGoogle assessed the issue as outside the scope of a security fix.
Products
AndroidGhostMap: The Android flaw that crashes your phone before you open the appBitdefender Mobile SecurityIn our testing, Bitdefender Mobile Security detects apps with this malformation when they reach the device, whether as a downloaded file or an already installed app, and warns the user. However, Android's security modelGoogle Pixel 10Researchers reproduced the failure on a Pixel 10 running Android 17 with the Aug.