Google Confirms Hidden Android Security Threat Affecting A Billion Users
A new threat at a vast scale has just been revealed, and it impacts multiple Android apps with hundreds of millions of installs—here’s what you need to know…
New ‘Dirty Stream’ warning affects billions of users
Microsoft has discovered a serious new security vulnerability that impacts popular Android apps and puts billions of devices at risk. “The implications of this vulnerability pattern” its report warns, “include arbitrary code execution and token theft, depending on an application’s implementation.”
The vulnerability relates to ContentProvider in Android enabling one app to securely share files with another. “If the client application does not properly handle the filename provided by the server application,” Google’s own advisory confirms, “an attacker-controlled server application may be able to implement its own malicious FileProvider to overwrite files in the client application’s app-specific storage.”
Exploiting the flaw, Microsoft says, could “provide a threat actor with full control over an application’s behavior,” and “access to a user’s accounts and sensitive data.”
Now the vulnerability has been exposed and reported through a co-ordinated Microsoft/Google release, developers have been provided with mitigation advice.
Microsoft gives two examples of popular apps that were susceptible to this risk, but which have both now been patched: “Xiaomi Inc.’s File Manager (1B+ installs) and WPS Office (500M+ installs).”
Because Android assigns separate memory space to apps to enforce device security, a common space is required to share files. But if both sides of the exchange don’t follow the rules, it’s possible for a sending app to use a crafted filename to trick the receiving app into overwriting legitimate files with malicious alternatives and content. Those malicious files can then be inadvertently executed on the device.
There’s nothing that users can do other than ensure they update apps as soon as those updates come available, and take…
