Security News > 2021 > February > Unpatched Android App with 1 Billion Downloads Threatens Spying, Malware

An Android app that's been downloaded more than 1 billion times is riddled with flaws that can let attackers hijack app features or overwrite existing files to execute malicious code, or launch man-in-the-disk attacks on people's devices, researchers discovered.

The flaws exist in an app called SHAREit, which allows Android app users to share files between friends or devices.

Trend Micro also notified Google of the app's issues, which lie in several flaws in its code that too easily give third parties permissions to take over legitimate app features, overwrite existing app files or even take over Android storage shared by multiple apps to execute malicious code, he said.

This type of attack allows someone to intercept and potentially alter data as it moves between Android external storage and an installed app, and is possible using SHAREit "Because when a user downloads the app in the download center, it goes to the directory," Duan wrote.

As a result, a pop-up of the fake Twitter app appeared on the main screen of the SHAREit app, Duan wrote.

Two years ago researchers discovered two high-severity flaws in the app that allowed an attacker to bypass the file transfer application's device authentication mechanism and ultimately download content and arbitrary files from the victim's device.

News URL

https://threatpost.com/unpatched-android-app-billion-downloads-malware/163976/