Microsoft discovered a path traversal-affiliated vulnerability pattern in multiple popular Android applications that could enable a malicious application to overwrite files in the vulnerable application’s home directory.
The implications of this vulnerability pattern include arbitrary code execution and token theft, depending on an application’s implementation. Arbitrary code execution can provide a threat actor with full control over an application’s behavior. Meanwhile, token theft can provide a threat actor with access to the user’s accounts and sensitive data.
Read more…
Source: Microsoft
Related:
- Multiple Vulnerabilities Found in NVIDIA, Qualcomm, Huawei Bootloaders
September 6, 2017
Six exploitable flaws in chipsets used by Huawei, Qualcomm, MediaTek and NVIDIA were found in popular Android handsets, according to a report by University of California at Santa Barbara computer scientists. Each of the flaws exist in phones sold by Huawei, Sony and Google, and are tied to each of the phones’ bootloader firmware. The vulnerabilities ...
- WireX DDoS Botnet: An Army of Thousands of Hacked Android SmartPhones
August 28, 2017
Do you believe that just because you have downloaded an app from the official app store, you’re safe from malware? Think twice before believing it. A team of security researchers from several security firms have uncovered a new, widespread botnet that consists of tens of thousands of hacked Android smartphones. Dubbed WireX, detected as “Android Clicker,” the botnet ...
- Over 500 Android Apps On Google Play Store Found Spying On 100 Million Users
August 22, 2017
Over 500 different Android apps that have been downloaded more than 100 million times from the official Google Play Store found to be infected with a malicious ad library that secretly distributes spyware to users and can perform dangerous operations. Since 90 per cent of Android apps is free to download from Google Play Store, advertising ...
- New Virus Called “Invisible Man” Going After Android Users
August 3, 2017
Security researchers warn that a new form of malware is targeting Android devices, posing as a Flash update that needs to be installed as soon as possible. SophosLabs, however, warns not only that this is fake update, but also that it includes a form of malware known as Invisible Man and officially flagged as Andr/Banker-GUA. The ...
- After Windows and Android, Operation Emmental Starts Targeting Apple Users
July 11, 2017
Security experts have discovered new malware that is specifically aimed at Apple customers, after previously targeting users running Windows and Android on their devices. Believed to be part of Operation Emmental, which was first spotted in 2012, the new malware is called Dok and is primarily targeting customers of Swiss banks, according to an in-depth analysis ...
- Ultrasonic Beacons Are Tracking Your Every Movement
May 5, 2017
More than 200 Android mobile applications listen surreptitiously for ultrasonic beacons embedded in audio that are used to track users and serve them with targeted advertising. Academics from Technische Universitat Braunschweig in Germany recently published a paper in which they describe their research into the practice of using these beacons to monitor a consumer’s shopping and ...