Vulnerabilities in popular Android apps spotlight danger of dynamic code loading, warn researchers

guest · Jun 21, 2021

Intent redirection vulnerabilities in popular Android apps spotlight danger of dynamic code loading, warn researchers
Bug could allow a malicious app to steal a plethora of sensitive data from user’s device
June 21, 2021
https://portswigger.net/daily-swig/...nger-of-dynamic-code-loading-warn-researchers

Android app developers have been urged not to load code dynamically because of the heightened risk of code execution vulnerabilities.

Security researchers issued the warning after disclosing details of an ‘intent redirection’ vulnerability in the Google-for-Android app.

“This could have allowed any app installed on the same device to steal arbitrary data from it, for example, accessing a Google account, user’s search history, voice assistant interaction data, mail from Gmail, and to intercept app rights, including access to read and send SMS messages, contacts, call history (as well as making and receiving calls), calendar, microphone, camera, location, Bluetooth and NFC,” reads a blog post from Oversecured, developer of an eponymous mobile app vulnerability scanner.
Click to expand...

Despite Oversecured’s warning about the dangers posed, “almost every Android app dynamically loads code from native .so libraries or .dex files”, a process simplified by libraries such as Google Play Core, said the blog post.

“We want to convince developers not to load any code dynamically, because this unsafe practice can escalate a vulnerability that allows stealing/overwriting arbitrary files into critical code execution inside a vulnerable app.”
Google fixed the bug in question in May 2021.
Oversecured also disclosed details of a similar vulnerability in the TikTok app in September 2020.
Click to expand...

Log in or Sign up

Vulnerabilities in popular Android apps spotlight danger of dynamic code loading, warn researchers

guest Guest

Log in or Sign up

Vulnerabilities in popular Android apps spotlight danger of dynamic code loading, warn researchers

guest Guest

Useful Searches