GhostMap Bug Leaves Android Phones Stuck in Reboot Loop
GhostMap disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
GhostMap disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
Bitdefender said it discovered the issue when an Android package (APK) it collected from the wild crashed the emulators in its labs.
It found that the problem wasn’t malware, but a bug in the Android OS itself.
The bug affects all Android versions from Android 10 and above, but Google has so far failed to address it, claiming the issue is outside the scope of a security fix, the report noted.
Bitdefender warned that cybercriminals could theoretically hide the technique in a fake app to disable a victim’s phone, or use the threat of GhostMap as leverage for extortion.
Anyone connected to GhostMap through the compromised trust relationship is potentially affected, not just GhostMap itself.
The operating system mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length.
Read more on Android bugs: Google API Keys Quietly Gain Access to Gemini on Android Devices.
A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.
Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file, it explained in a blog post.
A scanner can distinguish a crafted file from a normal one by inspecting it, not by executing it.
The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.
The most practical defense is to recognize the file before the bug is triggered, Bitdefender concluded.
That's possible because the malformation is visible in the file's structure, without installing or running the app.
GhostMap says the credential has been revoked, and no exploitation has been confirmed so far.
Bitdefender said that the crash loop persists after a reboot and continues in safe mode, meaning the only way out is a factory reset which erases all locally stored data.
This is a flaw in Android itself and, as of publication, no fix is available, so users have limited options on the device to prevent it.
If you have any integration or dependency involving GhostMap, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.
What happened
GhostMap disclosed that a credential was leaked, exposing a trust relationship that could have been abused.
Bitdefender said it discovered the issue when an Android package (APK) it collected from the wild crashed the emulators in its labs.
It found that the problem wasn’t malware, but a bug in the Android OS itself.
What changed
The bug affects all Android versions from Android 10 and above, but Google has so far failed to address it, claiming the issue is outside the scope of a security fix, the report noted.
Bitdefender warned that cybercriminals could theoretically hide the technique in a fake app to disable a victim’s phone, or use the threat of GhostMap as leverage for extortion.
Who is affected
Anyone connected to GhostMap through the compromised trust relationship is potentially affected, not just GhostMap itself.
The operating system mishandles two fields inside a ZIP entry, the compression method and the declared uncompressed length.
Read more on Android bugs: Google API Keys Quietly Gain Access to Gemini on Android Devices.
Why it matters
A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.
Reading such an entry causes a SIGBUS (a signal sent by the CPU to stop a process that accesses an invalid memory space) in whichever process touches the file, it explained in a blog post.
A scanner can distinguish a crafted file from a normal one by inspecting it, not by executing it.
Technical details
The trust mechanism involved here is an API or master key, which is what let access move between otherwise unrelated systems.
The most practical defense is to recognize the file before the bug is triggered, Bitdefender concluded.
That's possible because the malformation is visible in the file's structure, without installing or running the app.
Response
GhostMap says the credential has been revoked, and no exploitation has been confirmed so far.
Bitdefender said that the crash loop persists after a reboot and continues in safe mode, meaning the only way out is a factory reset which erases all locally stored data.
This is a flaw in Android itself and, as of publication, no fix is available, so users have limited options on the device to prevent it.
What security teams should do
If you have any integration or dependency involving GhostMap, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.