Google Play Store app, known as SHAREit A Security Risk

[UK Sentinel]

If you own an Android smartphone or tablet, you need to sit-up and listen. A popular Google Play Store app, known as SHAREit, which has been downloaded one billion times and received millions of positive reviews has “several” vulnerabilities. Security experts from Trend Micro discovered these issues, which can be leveraged by bad actors to gain access to sensitive data.

Hackers can use these vulnerabilities to execute arbitrary code and to possibly launch remote code execution attacks. The flaws could also let hackers run Man-in-the-disk (MITD) attacks, which can be used to crash a victim’s Android device.

Trend Micro published their findings on Monday, and at the time said the vulnerabilities in SHAREit hadn’t been fixed. According to the security experts, they had reported their findings to the SHAREit makers three months ago, and yet, the issues in the popular Android app still remain.

Trend Micro has also informed Google about the SHAREit vulnerabilities.

Outlining their findings online, Trend Micro said: “We discovered several vulnerabilities in the application named SHAREit. The vulnerabilities can be abused to leak a user’s sensitive data and execute arbitrary code with SHAREit permissions by using a malicious code or app. They can also potentially lead to Remote Code Execution (RCE).

“In the past, vulnerabilities that can be used to download and steal files from users’ devices have also been associated with the app. While the app allows the transfer and download of various file types, such as Android Package (APK), the vulnerabilities related to these features are most likely unintended flaws.

“SHAREit has over 1 billion downloads in Google Play and has been named as one of the most downloaded applications in 2019. Google has been informed of these vulnerabilities.”

According to the Google Play Store, the last time SHAREit was updated was on February 9, which was prior to the Trend Micro research was published. The file-sharing app, which lets users exchange photos, music, videos and GIFs, in total has 1.8billion users worldwide. In fact, according to App Annie, SHAREit was one of the top 10 most downloaded apps in the world in 2019.

© GOOGLE Android Play Store app warning for SHAREit And on the Google Play Store it boasts a 4.1 average rating based on 15.542million reviews. Trend Micro went on to add: “We reported these vulnerabilities to the vendor, who has not responded yet. We decided to disclose our research three months after reporting this since many users might be affected by this attack because the attacker can steal sensitive data and do anything with the apps’ permission. It is also not easily detectable.”

Until these vulnerabilities get patched out, you could always delete SHAREit from your Android device to be on the safe side. And if you have an anti-virus installed from a provider such as Trend Micro then be sure to run a scan to double check no malware has crept onto your device.

Full Story: https://www.msn.com/en-gb/money/technology/android-app-downloaded-one-billion-times-from-play-store-poses-serious-risk-to-your-phone/ar-BB1dMKGo?ocid=msedgntp

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

You need to login in order to vote

[UK Sentinel]

From Another source:

SHAREit app for Android said to share way too much: Billion-download code with holes no one wants to fix

Trend Micro claims software is full of security flaws that allow data out and malware in

Trend Micro has published a report claiming that data-sharing Android app SHAREit, which has over a billion downloads, contains multiple vulnerabilities after the app’s maker ignored advice to fix the flaws.

In a blog post published on Monday, Trend Micro researchers Echo Duan and Jesse Chang describe a series of vulnerabilities in SHAREit that could potentially allow a miscreant to leak data and run malicious code, locally or remotely.

They speculate that the bugs at issue are inadvertent and say that they have chosen to publicize them three months after disclosing their findings to Singapore-based Smart Media4U Technology because they’ve received no response from the app maker.

“We decided to disclose our research three months after reporting this since many users might be affected by this attack because the attacker can steal sensitive data and do anything with the apps’ permission,” the researchers said.

SHAREit for Android, they say, has over a billion downloads from the Google Play Store. Google, it’s claimed, has been made aware of Trend Micro’s concerns; the ad giant did not immediately respond to a request for comment.

According to Duan and Chang, the SHAREit app implements a broadcast receiver component called “com.lenovo.anyshare.app.DefaultReceiver” that can be invoked via Android’s Intent inter-app communication mechanism from any other app. They constructed a proof-of-concept Intent that shows “arbitrary activities, including SHAREit’s internal (non-public) and external app activities.”

 

 

Source: https://www.theregister.com/2021/02/16/shareit_app_flaws/

 

Share the knowledge

In a completely sane world, madness is the only freedom (J.G.Ballard).

You need to login in order to vote

[Author]

Posts