Flaw Leaves 900M Android Devices Vulnerable

**Executive Summary:** A Bluebox Security researcher disclosed a flaw in Android's application signing and verification that affects devices running Android 1.6 and later (an estimated ~900 million devices). The vulnerability allows modification of APK code without invalidating the cryptographic signature, enabling malicious applications to access device data and potentially compromise sensitive apps such as VPN clients; Google was notified but fixes depend on OEM firmware updates and user installation.