Another Android Vulnerability to be Discovered

New vulnerability is called Man-in-the-Disk; popular apps are vulnerable
14 August 2018   1364

Cyber ​​security specialists from Check Point have revealed a new type of attack called Man-in-the-Disk (MitD), which exploits vulnerabilities in managing external memory applications on the Android OS. Vulnerable are mobile versions of translators from Google and Yandex, as well as the popular browser from Xiaomi.

How does Man-in-the-Disk work?
According to researchers, there are several reasons for the of the MitD attack. First, every application on Android can access data from another program contained in external memory. Secondly, most applications ask the user for permission to work with memory, and they usually agree, without thinking about the possible risk.

Check Point employees were able to recreate two versions of Man-in-the-Disk:

  1. The first option interferes with the files of the target application, loading malicious data into external memory. It causes an error in the program and leaves gaps for further malicious actions. In addition, this type of MitD allows you to obtain the permissions that the victim application had without additional actions:

    Man in the DIsk Attack
    Man in the DIsk Attack
     

  2. The second version of the attack replaces the temporary update files that applications store in external memory before they are installed. An attacker can force the program to install its malicious version or third-party malware

    Man in the DIsk Attack
    Man in the DIsk Attack

Which applications are vulnerable to attack?
Among the vulnerable applications there are: Google Translate, Google Voice Typing, Yandex Translate and Yandex Search, as well as Xiaomi Browser. It is noteworthy that the solutions from Google and Xiaomi are pre-installed on a large number of Android-devices.

How to defend yourself?
Check Point experts say that application developers, including Google, do not follow such security practices as the Android security guidelines. They recommend using the following Man-in-the-Disk protection:

  • Verify input validation when processing files in external memory;
  • Do not store executable files or classes in external memory;
  • sign and cryptographically check files in external storage before dynamic loading.

In addition, the Check Point team believes that Android security should be strengthened at the system level, rather than software. Only low-level protection can help in preventing such attacks, the company believes.

After detecting the attack, experts sent letters to Google and Xiaomi with a description of the problem. The first quickly responded and already released security updates for vulnerable applications, while the latter preferred not to respond to the developers' letter.

LineageOS Team to Report on Project Updates

Since March, the number of assemblies provided by the project replaced CyanogenMode has increased to 36 devices
03 July 2019   380

The developers of the LineageOS project, which replaced CyanogenMod after abandoning the project of Cyanogen Inc, published a report on the development of the LineageOS 16 branch based on the Android 9 platform. Since March, the number of assemblies provided by the project has increased to 36 devices. Recent changes are noted:

  • AOSP’s Night Display now controls night mode (on recent devices only, such as those with a Snapgragon 820 or more recent)
  • LiveDisplay remains available for all its other features
  • The volume panel can now be expanded to control all the various volume streams
  • The volume panel can now be optionally relocated to the left
  • Expanded quick settings are back
  • Detailed views for the following tiles are available: Wi-Fi, Bluetooth, Mobile Data, Location, Profiles
  • New default wallpaper and a new wallpapers app with many new, and old, wallpapers
  • Other than the usual nature, urban and abstract themed wallpapers, monochromatic and gradients wallpapers are now available
  • Privacy Guard now supports apps in the Work Profile
  • It’s possible to add up to two LockScreen shortcuts again
  • Circle battery is back after being missing since LineageOS 13.0
  • Notification ringtone level can be unlinked from phone calls ringtone level
  • GPS battery saving mode can now be enabled from the Settings
  • Vim has been updated to version 8.1
  • Nano has been updated to version 4.2
  • Fixed issue were using certain private DNS caused devices to crash thanks to backported fix from Q
  • Support for bluetooth SBC DualChannel HD has been added (both 15.1 and 16.0)
  • Performance improvements for Eleven (music player app) (both 15.1 and 16.0)
  • Updated call recording configurations (both 15.1 and 16.0)

Additionally, developers mark the termination of the formation of assemblies LineageOS 15.1 for Google Nexus 4, Asus Zenfone Max Pro M1, Nvidia Shield Tablet, Samsung Galaxy S9, Samsung Galaxy S9 + and ZTE Axon 7.

Get more info at official website.