A booby-trapped app can lock an Android phone in a boot loop the moment it's installed

On August 12, an Android app downloaded from the internet crashed Bitdefender's emulators at the very moment of installation. It was a banking Trojan hidden under a layer of packaging, and it never had time to run. Looking for the cause, the Romanian security vendor found that the flaw did not come from the malware, but from Android itself.

Bitdefender published its findings on November 5 under the name GhostMap. According to the company, a malformed installation file (APK) can crash a phone in a loop. It needs no permissions and contains no executable code. The user does not even have to open it. Android 10 and later versions are affected, according to the researchers, who reproduced the attack on a Pixel 10 running Android 17 with the August 5 patch.

Two Android components that don't read the same file

An APK is a ZIP archive. Each item in it declares its compression method and its size. Two Android libraries check this information differently, Bitdefender explains. An item that declares an unsupported method slips between the two checks. The system then reserves more memory space than the file contains. The process reading that area is killed.

In the most troublesome variant, the booby-trapped file is read automatically by system_server, Android's core service, after installation. The service crashes, restarts, rereads the file and crashes again. In one test, the cycle repeated 110 times, with the screen frozen on the boot animation. Safe mode makes no difference. Bitdefender says it has not seen this loop used against anyone.

Google doesn't see this as a security patch matter

On August 20, Bitdefender reported the problem to Google, which classified it as “Won't Fix (Not Reproducible)”, outside the scope of its rewards program. On August 25, a second report arrived with a working demonstration. Google maintains that the issue does not warrant a security update, but passed it to the relevant team for possible inclusion in a future release. Asked by BleepingComputer, Google had not yet responded when the outlet published its article.

What to do if your phone is stuck in a loop

• A factory reset is the only reliable remedy described by Bitdefender. It erases all data: a recent backup makes all the difference.
• USB debugging can sometimes be used to delete the file from a computer, if it was enabled beforehand and only before the first full restart of the system.
• Be wary of APKs installed from outside the Play Store. Bitdefender does not say whether Google's store would detect these files.
• The mobile antivirus that Bitdefender sells detects the file and warns the user, and others might do the same, but no third-party app can block the installation.

For Bitdefender, the fix comes down to one rule: reject any compression method other than the two that Android can read. Whether Google will apply it, and in which version, remains to be seen.