Security News > 2021 > February > Unpatched Android App with 1 Billion Downloads Threatens Spying, Malware
An Android app that's been downloaded more than 1 billion times is riddled with flaws that can let attackers hijack app features or overwrite existing files to execute malicious code, or launch man-in-the-disk attacks on people's devices, researchers discovered.
The flaws exist in an app called SHAREit, which allows Android app users to share files between friends or devices.
Trend Micro also notified Google of the app's issues, which lie in several flaws in its code that too easily give third parties permissions to take over legitimate app features, overwrite existing app files or even take over Android storage shared by multiple apps to execute malicious code, he said.
This type of attack allows someone to intercept and potentially alter data as it moves between Android external storage and an installed app, and is possible using SHAREit "Because when a user downloads the app in the download center, it goes to the directory," Duan wrote.
As a result, a pop-up of the fake Twitter app appeared on the main screen of the SHAREit app, Duan wrote.
Two years ago researchers discovered two high-severity flaws in the app that allowed an attacker to bypass the file transfer application's device authentication mechanism and ultimately download content and arbitrary files from the victim's device.
News URL
https://threatpost.com/unpatched-android-app-billion-downloads-malware/163976/
Related news
- TrickMo malware steals Android PINs using fake lock screen (source)
- Russia targets Ukrainian conscripts with Windows, Android malware (source)
- Android malware "FakeCall" now reroutes bank calls to attackers (source)
- New FakeCall Malware Variant Hijacks Android Devices for Fraudulent Banking Calls (source)
- New Android Banking Malware 'ToxicPanda' Targets Users with Fraudulent Money Transfers (source)
- Cyber crooks push Android malware via letter (source)