Security researchers at Bitdefender have identified a critical flaw in the Android operating system that renders devices unusable. The vulnerability, dubbed GhostMap, allows a specially crafted application to trigger a continuous system crash loop upon installation. Unlike typical malware that requires complex permission requests or code execution, this exploit activates immediately when the operating system attempts to process the app file.
How the GhostMap Vulnerability Works
The issue stems from how Android handles ZIP entry compression methods within application package files. During an investigation in August, analysts examined a malicious banking-related APK found in the wild. The application caused emulators to crash, but the root cause was not the malware itself. Instead, the crash resulted from the operating system misinterpreting compression data inside the APK container.
Researchers developed a proof-of-concept APK to demonstrate the severity of the flaw. Installing this file repeatedly crashes system_server, a core process responsible for managing system-wide services. The device enters a state where the service dies and restarts every few seconds. Users see a black screen with no applications opening and no indication of which app caused the failure.
“It crashes, Android restarts it, and on restart the service goes through the installed apps again, reads the same file again, and crashes again,” Bitdefender stated in its report. “The phone never finishes starting. This is the crash loop.”
Google Response and Recovery Challenges
Bitdefender reported the finding to Google through the Android & Devices Vulnerability Reward Program. The company submitted two separate reports. The first was closed with a status of Won’t Fix, citing that the issue was not reproducible. The second submission included a working proof of concept and detailed reproduction instructions.
Google’s response to the second report indicated that the issue was outside the scope of a standard security update fix. The tech giant forwarded the finding to the relevant team for review, but no patch has been released. This leaves users with limited options for recovery. Fixing the problem requires either performing a factory reset or using Android Debug Bridge (ADB) to delete the malicious file from the device.
The vulnerability has not been observed in active wild exploits. However, the public disclosure of the GhostMap flaw changes the risk landscape. Threat actors now have the technical details needed to reproduce the exploit. This increases the potential for malicious actors to target users with crafted APKs designed to disable devices.
Public awareness of the flaw places additional pressure on Google to provide a resolution. Until a fix is available, users are advised to exercise caution when installing applications from unknown sources. The lack of a quick patch highlights the complexity of addressing low-level operating system errors in a widely used mobile platform.
Source: Android Authority
