Microsoft recently made a troubling discovery regarding the security of numerous Android applications, including some of the most widely used ones, each boasting over 500 million installations. After uncovering a common security weakness, Microsoft promptly notified Google’s Android security research team, prompting Google to release new guidance aimed at helping Android app developers identify and rectify the issue.
Among the applications found to be vulnerable were Xiaomi Inc.’s File Manager, boasting over 1 billion installations, and WPS Office, with around 500 million downloads. Although Microsoft confirms that the vendors of these products have since addressed the issue, they caution that there may be other apps out there still susceptible to exploitation due to the same security flaw.
The vulnerability in question pertains to Android applications that share files with other apps. To enable secure sharing, Android employs a feature known as “content provider,” which essentially serves as an interface for managing and exposing an app’s data to other installed applications on the device.
However, Microsoft’s research uncovered a significant oversight in many cases: when an Android app receives a file from another app, it often fails to adequately validate the content. Particularly concerning is the practice of using the filename provided by the sending application to cache the received file within the re
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.
This article has been indexed from CySecurity News – Latest Information Security and Hacking Incidents
Read the original article: