On a Monday-morning-style ordinary device, a phone can be pulled into a loop it cannot climb out of, stuck between a boot animation and restart after restart. Bitdefender has now made public a flaw in how Android reads the compressed structure inside app packages, a fault that can silence a phone without ever stealing from it. The company's warning reaches back to a long human habit of trusting what a machine reads without checking how another part of the same machine reads it. Whether the system's makers choose to mend this now or later will decide how much that trust is worth to the people h
Malformed APK Flaw Can Trap Android Phones in Crash Loops, Bitdefender Warns
The app contains no code and never needs to run.
Mark
So what actually makes this one different from an ordinary crashing app?
Mimi
The app never runs. Android itself reads a malformed ZIP entry, and if system_server is the reader, the phone can't finish booting.
Mark
And safe mode doesn't rescue it?
Mimi
Bitdefender says the service reads the file before safe mode takes effect, so the loop continues.
Luke
Worth noting that's Bitdefender's testing. The reproduction on a Pixel 10 with Android 17 is their account, and I don't see independent confirmation in the reporting.
Mark
Google apparently first called it not reproducible.
Mimi
Yes, then after a proof of concept it said the issue was outside the scope of a security update fix and referred it for a possible future version update.
Luke
That's Bitdefender relaying Google's response. We don't have Google's own statement here.
Mark
Is anyone being attacked with this?
Mimi
Bitdefender says it hasn't observed the crash-loop technique used in the wild. The attack scenarios are theoretical.
Luke
Right, and the original sample was a banking dropper, but that's the trigger for the discovery, not evidence of this abuse.
Mark
So the practical advice?
Mimi
Avoid crafted apps. ADB removal might work if USB debugging was already on, but a full reboot could end that option.
O Pulso
- A single malformed app file can trap a phone in an endless reboot loop that survives even safe mode.
- Recovery usually means a factory reset, which erases the owner's data along with the fault.
- Bitdefender's first report to Google was closed as not reproducible, and the second was deferred outside the security update process.
- No patch exists yet, and users can only watch for suspicious apps and wait for a future Android version to address the parsing flaw.
On a Monday-morning-style ordinary device, a phone can be pulled into a loop it cannot climb out of, stuck between a boot animation and restart after restart. Bitdefender has now made public a flaw in how Android reads the compressed structure inside app packages, a fault that can silence a phone without ever stealing from it. The company's warning reaches back to a long human habit of trusting what a machine reads without checking how another part of the same machine reads it. Whether the system's makers choose to mend this now or later will decide how much that trust is worth to the people holding the devices.
A phone sits on its boot animation and refuses to move past it. It restarts, shows the animation again, and restarts again. Bitdefender says a specially crafted app can cause exactly this on Android 10 and later, and that the usual way out is a factory reset that wipes everything on the device.
The unsettling part is that the app need not be opened, need not ask for any permissions, and need not contain runnable code. The researchers reached the flaw by accident. A sample kept crashing their emulators during installation, and following that thread led them to how Android parses the ZIP entries inside APK files. Two malformed fields, the compression method and the declared uncompressed length, can cause a crash that, if it happens inside a core system service after installation, keeps the device from ever finishing its startup.
Bitdefender reported the issue twice through Google's bug reward programme. The first report was closed, and the second was answered with the news that the problem fell outside the security update process and had been passed to a team for possible consideration in a future version. No code runs, no data is stolen, and no privileges are gained, but the denial of service is real. For now, the people holding these phones are left to watch for suspicious apps and hope a fix arrives before someone uses the technique.
A phone sits on its boot animation and never gets past it. It restarts, shows the animation again, restarts again. Bitdefender says this is what can happen to an Android device after a specially crafted app is installed, and that in most cases the only way out is a factory reset. The company disclosed the flaw this week, saying it affects devices running Android 10 and later.
According to Bitdefender, the app does not have to be opened, does not need to request any permissions, and does not need to contain executable code. In testing, the crash loop survived a reboot and carried on in safe mode. Alecsandru Cătălin Daj, Team Lead in the Mobile Security & Forensics Unit at Bitdefender, put it this way: the app contains no code and never needs to run.
The researchers came to the problem sideways. An APK collected in the wild kept crashing emulators during installation. They described the sample as a banking dropper wrapped in a packer that altered the file's internal structure. Following that thread, they say, led to a deeper problem in how Android handles ZIP entry data inside APK files.
Specifically, Bitdefender says Android mishandles two fields in a ZIP entry: the compression method and the declared uncompressed length. When both are malformed in a particular way, a process reading the file can hit a SIGBUS fault and crash. What happens next depends on which file inside the APK is malformed and which Android component reads it. If the file is parsed during installation, the installer crashes and the app simply fails to install, with no lasting effect. If a core system service reads it after installation, the crash can occur inside system_server, the central process that hosts many Android system services. When that process crashes repeatedly, the device may never finish starting up.
Bitdefender says it reproduced the behaviour on a Pixel 10 running Android 17 with the August security patch, and saw the same on versions going back to Android 10. The screen stayed on the boot animation while the cycle repeated. Safe mode did not help, the researchers said, because the affected service read the malformed file before safe mode took effect.
The researchers say they reported the issue twice through Google's Android & Devices Vulnerability Reward Program. According to Bitdefender, the first report was closed as not reproducible and outside the programme's scope. A second report added a proof of concept and reproduction steps for a persistent system crash loop. Google's reply, as Bitdefender describes it, was that the issue fell outside the scope of a security update fix and had been passed to a relevant team for possible consideration in a future version update.
Bitdefender argues this is a significant denial-of-service risk, since it can make a phone unusable without code execution or elevated permissions. It also says it has not seen the persistent crash-loop technique used against victims in the wild. The company outlines theoretical abuses: a fake app that disables a victim's handset, forcing a choice between an unusable device and a factory reset that wipes data; or an app that keeps working while a malformed icon crashes the launcher and the settings screens used to remove it. The same parsing behaviour could also crash security products and analysis tools that use Android's native APIs, including scanners relying on standard package inspection calls.
The researchers place the bug in a long-running class of parser differential problems, where different parts of Android read the same APK structure differently. They link it to earlier flaws such as Master Key and Janus, and to recent APK tampering techniques malware authors use against analysis tools. The bug allows no code execution, data theft or privilege escalation.
No fix exists. Bitdefender says that where USB debugging was already enabled, a user might remove the file through Android Debug Bridge before the next crash, though a full reboot could close even that window. Its mobile security product flags the files as Android.Riskware.Ghostmap.rA, but Android does not let third-party apps block installs or remove other apps, so the response is left to the user. Whether Google schedules a fix in a future version is the thing to watch.
Citações Notáveis
The app contains no code and never needs to run.— Alecsandru Cătălin Daj, Team Lead, Mobile Security & Forensics Unit, Bitdefender
Quer a matéria completa?
Leia o original em IT Brief Australia ↗
Technology