Old Apache Code at Root of Android FakeID Mess

Bluebox Security disclosed the 'FakeID' vulnerability in Android (affecting Android 2.1 through 4.4) that stems from improper certificate-chain verification in package installer code derived from Apache Harmony. An attacker can craft an app whose certificate claims to be issued by a trusted vendor (e.g., Adobe), enabling silent privilege escalation and access to sensitive device resources; Google released a patch and mitigations (Google Play/Verify Apps), but many devices may remain unpatched due to ecosystem fragmentation.