Originally Posted by
joeldf I'm confused. It says a user installs an app, but doesn't say what app. Then says the system app is the Phone app.
Well, these are phones, so is the Phone app the problem, or the app a user installs?
Or, is it that a third party app takes advantage of a weakness in the Phone app?
From what I can tell, your last possibility is the closest, but still not the entire picture. It sounds like the vulnerability is in the Phone app (it's a phone, but everything runs on an app, even making phone calls), but requires another app specifically programmed to exploit the vulnerability.
The article is written in a way to make you think any app, even from the Play store, could exploit the vulnerability. This sort of fear mongering is common with malware/vulnerability announcements. The section I quoted above is the likely key to assessing your own risk, because apps from the Play store and similar official marketplaces are not likely to have modified apps that can do such things. The Play store also routinely scans itself and removes malware suspect apps. It's pirated apps that are the biggest concern. They have already been hacked to steal premium content/services from the developers, so it's a trivial matter to insert code that takes advantage of a vulnerability. Nothing is ever free.
but seems February security patch fixed it anyways
