GhostMap: A New Vulnerability Traps Android Devices in Boot Loops
What is GhostMap and how does it work?
A disturbing new vulnerability has been identified in the cybersecurity landscape, posing a significant threat to devices running the Android operating system. Known as GhostMap, this flaw allows attackers to trap a device in a "boot loop," or a continuous cycle of reboots. Most alarmingly, a malicious application does not require any special permissions or even to be launched by the user to trigger this; installation alone is sufficient.
According to Bitdefender researchers, the issue stems from an inconsistency between two Android libraries. These libraries interpret ZIP archive compression methods differently. Consequently, a specially crafted APK file can bypass system checks and access memory areas it is not intended to reach. When the operating system process reads this corrupted file, a system error (SIGBUS) occurs, causing the process to crash.
A Threat at the System Level
Researchers demonstrated that it is possible to create an application that the system_server, a core component, reads automatically upon installation. Because this component is critical for the system's operation, its crash causes an immediate device reboot. However, after the restart, the system attempts to read the same malicious file again, triggering the cycle repeatedly. During testing on a Pixel 10 running Android 17, the device rebooted more than a hundred times, even while in "Safe Mode," effectively preventing the user from resolving the issue.
Why is there no solution yet?
Bitdefender notified Google about this vulnerability back in August. However, the tech giant deemed the issue "Not Reproducible" and stated that it fell outside the scope of security updates. Despite additional evidence provided by the researchers, an official patch has yet to be released.
At this stage, the only way to protect against GhostMap is through third-party security software capable of detecting and warning about malicious files during the installation process. If a device is already caught in a boot loop, the only radical solution is a Factory Reset, which unfortunately results in the total loss of data. Experienced users may attempt to delete the malicious file using ADB (Android Debug Bridge), though this requires that debugging mode was enabled beforehand and that the system provides enough time to execute the command.
For users, this incident serves as a reminder that applications should only be downloaded from the official Google Play Store, as installing APK files from unknown sources carries significant risks.