[MUST SEE] If These Apps Are Installed On Your Phone, You Can ‘Easily’ Be Hacked

Posted by E.L.E.X on April 02 2021 under Tech/Cybersecurity

When iPhone users claim their devices are more secure than Android alternatives, it’s security reports such as the latest from Check Point they have in mind. The cyber firm has suddenly warned that “countless Android apps” are vulnerable to a security threat that should have been patched six months ago, “jeopardizing hundreds of millions of users.” These are apps almost guaranteed to be on your phone right now.

Yet again the issue relates to a software library buried within multiple apps—ironically, though, this library was developed by Google itself as a shortcut for apps to interface with its Play Store. The “highly dangerous” CVE-2020-8913 was reported in detail back in August—a vulnerability in thousands of apps that would enable hackers to “steal users’ login details, passwords, and financial details, and read their mail.”

Such an attack requires fairly simple malware to be planted on your phone—think of all those rogue email attachments, texted links or viral images. That malware then attacks one of the popular apps carrying the vulnerability, piggybacking on that genuine app’s permissions to access data on your phone. As such, the new malware doesn’t need to ask you for new permissions, risking detection.

According to Check Point researcher Aviran Hazum, the threat is “very serious and easy to exploit.” It hasn’t been caught in the wild as yet, but given this latest publicity, attackers will now be aware of the problem which makes it much worse. A proof of concept, which attacked Google Chrome before it was patched, “used a Dropbox cookie (stored within Google Chrome) to steal files from the cloud storage platform.”

Google patched the flaw in its Play Core Library way back in April, but a huge number of apps have not bothered to update the library within their own software. “During the month of September,” Check Point says, “13% of Google Play applications we analyzed used this library, and 8% of those apps had a vulnerable version.”

So, should users be worried? Yes, according to Hazum. “Users should be worried about the data stored inside or accessible to applications. The malicious payload will have the same access as the hosting application. For example, injecting code into a messenger to steal all messages, or send messages on the user’s behalf. Or if a banking app is vulnerable, the attacker can steal credentials and even 2FA codes.”

Check Point also warns that the vulnerability can be used to “inject code into enterprise applications to gain access to corporate resources or into social media applications to spy on the victim and use location access to track the device.” As ever, a vulnerability with a popular app installed on tens of millions of devices provides a large attack surface for a targeted campaign. This becomes a soft entry point to steal credentials for a corporate network, for example, or to track persons of interest.

If you need convincing as to the severity of this, then let’s look at some of the apps that have just recently patched this vulnerability.

Booking.com told me “we can confirm we have already addressed this vulnerability with a patch to our Android app on November 11.” And Cisco confirmed that “on December 1, [we] published software updates for the Cisco WebEx Teams mobile app for Android that include fixed versions of the Google Play Core Library that contains the security vulnerability.”

Grindr told me that “we are grateful for the Check Point researcher who brought the vulnerability to our attention today. Our team quickly responded, and we have already issued a hotfix… We will continue to enhance our practices to proactively address these and similar concerns as we continue our commitment to our users.” And OkCupid confirmed “we were notified by Check Point earlier this week and have already released the fix. We’re grateful to partners like Check Point who together with OkCupid, put the safety and privacy of our users first.”

The issue is widespread. Check Point also lists Viber, Yango Pro and even Microsoft Edge among those apps it tested and says it found to be vulnerable, none of which responded to requests for comment before publishing. Moovit, which was also named, confirmed after publication that it had issued a fix. But to single any out would be misleading—these are just the ones Check Point “randomly” happened to test and name. One can assume those apps have patched or will soon patch the problem—it just requires the updated Google library. It’s the “countless” other apps that haven’t been tested by Check Point and so haven’t been notified that is the real issue here.

On one level, Google can’t do much about this. It’s for developers to manage the security of their apps. But, in truth, Google could mandate the fix and test apps in its Play Store to ensure they are running the updated library. But Android is much more fragmented and less well policed than iOS—that’s why those iPhone users feel better protected. As Forbes cybersecurity contributor Davey Winder said on his move from Android to iPhone, “four words explain it—security, privacy, fractured, ecosystem… I've been growing increasingly unhappy when it comes to security updates.”

The unhappy situation here is that those “hundreds of millions” of users can’t know which apps have been patched and which have not. And so advising users to update or delete apps is impossible. Instead, the only advice is to be very careful with the apps you install on your phone to avoid the risk that of allowing malware onto the phone that can target the permissions given to a popular app to steal your data.

That means no third-party app stores, no clicking indiscriminately on emailed or texted links, no saving images or videos onto your phone from social media sites or messengers unless you can be fairly sure that they were created by a trusted sender. You can also look to install an antivirus program onto your device, albeit make sure it’s from a reputable developer if you do, and that means a mainstream, paid for app.

[MUST SEE] If These Apps Are Installed On Your Phone, You Can ‘Easily’ Be Hacked

Watch Video

YOU MAY ALSO LIKE

Comments

Add Comment