Check Point Research: How Android allows ‘man-in-the-disk’ cyberattacks

guest · Aug 12, 2018

Check Point Research: How Android allows ‘man-in-the-disk’ cyberattacks
August 12, 2018
https://venturebeat.com/2018/08/12/...-android-allows-man-in-the-disk-cyberattacks/

Check Point Research said it has found a design flaw in Android’s Sandbox that allows external storage to be used as an avenue for cyberattacks.

Those attacks could result in undesired outcomes, such as silent installation of unrequested, potentially malicious, apps to the user’s phone. They could be used for denial of service for legitimate apps. They could even cause applications to crash, opening the door to potential code injection that could then run in the privileged context of the attacked application.

Google’s Android documentation says that application developers are advised on how they should use the external storage in their apps. [...] “However, we have seen a few examples where Google and other Android vendors do not follow these guidelines,” Check Point said.

[...] Google Text-to-Speech and Xiaomi Browser allowed for the Man-in-the-Disk to take root and resulted in overwriting their APK files.
Click to expand...

guest · Mar 13, 2019

Operation Sheep: Pilfer-Analytics SDK in Action
March 13, 2019
https://research.checkpoint.com/operation-sheep-pilfer-analytics-sdk-in-action/

Dubbed ‘Operation Sheep’, this massive data stealing campaign is the first known campaign seen in the wild to exploit the Man-in-the-Disk vulnerability revealed by Check Point Research earlier last year.

In the Tencent MyApp store alone, 8 of 12 infected applications have a staggering total number of over 111 million downloads. In theory, Shun Wang Technologies could have collected a third of China’s population names and contact numbers if not more.
[...] we became much more skeptical when the “CoreReceiver” module appeared in the app’s manifest. This module monitors a wide range of device activities including application installation / remove / update, phone restart and battery charge.
The Man-in-the-Disk Connection
With default settings, SWAnalytics will scan through an Android device’s external storage, looking for directory “tencent/MobileQQ/WebViewCheck”. This folder hosts QQ login data chache. By listing sub-folders, SWAnalytics is able to infer QQ accounts which have never been used on the device.
Operation Sheep is the first campaign we have observed in the wild that abuses similar concept since our MitD publication.
Click to expand...

Log in or Sign up

Check Point Research: How Android allows ‘man-in-the-disk’ cyberattacks

guest Guest

guest Guest

Log in or Sign up

Check Point Research: How Android allows ‘man-in-the-disk’ cyberattacks

guest Guest

guest Guest

Useful Searches