Hundreds of millions of UC Browser users for Android are threatened

guest · Mar 26, 2019

Hundreds of millions of UC Browser users for Android are threatened
March 26, 2019
https://news.drweb.com/show/?i=13176

As of now, UC Browser has been downloaded by over 500,000,000 Google Play users. Anyone who has installed this software may be in danger. Doctor Web has detected its hidden ability to download auxiliary components from the Internet. The browser receives commands from the command and control server and downloads new libraries and modules, which add new features and can be used to update the software.

A potentially dangerous updating feature has been present in the UC Browser since at least 2016. Although the application has not been seen distributing trojans or unwanted software, its ability to load and launch new and unverified modules poses a potential threat.

The vulnerable feature of UC Browser can be used to perform man-in-the-middle attacks (MITM). To download new plug-ins, the browser sends a request to the command and control server and receives a link to file in response. Since the program communicates with the server over an unsecured channel (the HTTP protocol instead of the encrypted HTTPS), cybercriminals can hook the requests from the application. They can replace the commands with ones containing different addresses.
Click to expand...

guest · May 8, 2019

UC Browser for Android Vulnerable to URL Spoofing Attacks
May 8, 2019
https://www.bleepingcomputer.com/ne...r-android-vulnerable-to-url-spoofing-attacks/

The latest versions of UC Browser and UC Browser Mini Android apps with a total of over 600 million installs expose their users to URL spoofing attacks as explained by security researcher Arif Khan who found the flaw and reported it to the apps' security team.
The URL spoofing issue
"URL Address Bar spoofing is the worst kind of phishing attack possible. Because it's the only way to identify the site which the user is visiting," said Khan.

As the researcher says in his advisory, UC Browser and UC Browser Mini make it possible for would-be attackers to "pose (his phishing domain) as the targeted site, for example, a domain blogspot.com can pretend to be facebook.com, by simply making a user visit www[.]google[.]com[.]blogspot.com[/?q=]www.facebook.com."

"This is happening primarily because some mobile browsers are using bad regex checks. They are trying to enhance user UX by displaying only search term when the user searches for something on search engines like Google," also said Khan.
Click to expand...

guest · May 16, 2019

Breaking UC Browser
May 16, 2019
https://habr.com/en/company/drweb/blog/452076/

Attack Vector
UC Browser’s manifest contains a service [...] When this service launches, the browser makes a POST request [...] In response, the browser may receive a command to download any update or a new module.
During our analysis, we never received such commands from the server, but we noticed that when trying to open a PDF file in the browser, it repeats the request to the above address, then downloads a native library.

Technically, UC Browser can download something without a user’s permission when given an appropriate response to a request sent upon startup. [...]
Consequences and developer’s response
In the same way, hackers can use this insecure feature of UC Browser to distribute and launch malicious libraries. These libraries will work in the context of the browser, resulting in full system privileges that the browser has.

We contacted the UC Browser developers and informed them about the problem we had found, tried to point out the vulnerability and its danger, but they refused to discuss the matter.
Click to expand...

guest · Oct 17, 2019

500+ Million UC Browser Android Users Exposed to MiTM Attacks. Again
October 17, 2019
https://www.bleepingcomputer.com/ne...-android-users-exposed-to-mitm-attacks-again/

The highly popular UC Browser and UC Browser Mini Android apps, with a total of over 600 million Play Store installs, exposed their users to man-in-the-middle (MiTM) attacks by downloading an Android Package Kit (APK) from a third party server over unprotected channels.

Doing this is in direct violation of Google's app store rules as Android apps "distributed via Google Play may not modify, replace, or update itself using any method other than Google Play's update mechanism,"

"Likewise, an app may not download executable code (e.g. dex, JAR, .so files) from a source other than Google Play," as Google also states on the Play Store's Privacy, Security, and Deception rules.
While analyzing the apps' behavior, Zscaler ThreatLabZ researchers discovered the following three issues: [...]
Security and privacy issues fixed
Zscaler reported the UC Browser's policy violation issues to Google on August 13 and exchanged e-mails with Google's team until September 25.
On September 27 Google confirmed the UC Browser and UC Mini issues discovered by the researchers and reached out to UCWeb to "update the apps and remediate the policy violation."
Click to expand...

ZScaler: UC Browser app abuses may have exposed 500 million users

Log in or Sign up

Hundreds of millions of UC Browser users for Android are threatened

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Hundreds of millions of UC Browser users for Android are threatened

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches