“ShareIt” Android app with over a billion downloads is a security nightmare – Ars Technica4 min read

https://arstechnica.com/gadgets/2021/02/shareit-android-app-with-over-a-billion-downloads-is-a-security-nightmare/

ShareIts incredible success of a billion Android downloads and 1.8 billion users worldwide (there are also iOS, Windows, and Mac apps) has led to what looks like an incredible amount of app bloat. Android prides itself on intra-app communication, partly due to the fact that any app can produce a material supplier and supply its material and services to other apps. A destructive developer needs to only call on the ShareIts file-content supplier and pass it a file path for the developer to get back any of the files that make up the ShareIt app.
The file paths ShareIt will use up are limited to its own information files, but that implies apps can modify the information ShareIt uses to run, consisting of the app cache that gets generated during runtime and set up. The user believes theyre installing the great app they just downloaded, however its actually an imposter harmful app.

When private storage isnt private
Android prides itself on intra-app communication, partially because any app can develop a material provider and offer its material and services to other apps. Its up to developers to sanitize these cross-app capabilities and just expose the essential file supervisor abilities to Gmail and other apps.
Passing along some approvals is regular, but Trend Micro discovered that ShareIt does not attempt to scope down its consents at all and will happily serve up its files to any app that asks. A destructive developer needs to just call on the ShareIts file-content supplier and pass it a file path for the designer to get back any of the files that make up the ShareIt app.
The file paths ShareIt will use up are limited to its own information files, however that implies apps can modify the information ShareIt utilizes to run, including the app cache that gets created during runtime and set up. The report says that “an attacker may craft a phony [app cache] file, then replace those files by means of the aforementioned vulnerability to perform code execution.” Typically these files live in private storage, but ShareIts private storage is open to the world.
Advertisement

Expand/ You cant argue with that green “safe” guard.

ShareIt also comes with its own Android app installer. The user believes theyre installing the good app they simply downloaded, but its really an imposter harmful app.
” The enemy can steal delicate information”
An entire extra problem is that ShareIts video game store can obviously download app information over unsecured HTTP, where it can be subject to a man-in-the-middle attack. The majority of apps force all traffic to HTTPS, but ShareIt does not.
Users need to most likely uninstall the app ASAP. If youre looking for a more safe and secure file-sharing alternative, Googles file supervisor can do regional sharing over Wi-Fi now and need to be written with better security practices.

Trend Micro says it has found “numerous” security defects in the popular Android app ShareIt. ShareIt has been downloaded over a billion times from the Play Store, and, according to App Annie, was one of the 10 most globally downloaded apps in 2019. The app was initially developed by Lenovo (it has actually given that spun off into its own company) and for a time was pre-installed on Lenovo phones.
ShareIts approvals, as a local file-sharing app, are pretty substantial. According to the Play Store permissions readout, ShareIt requests access to the whole user storage and all media, the camera and microphone, and place. Trend Micro states jeopardizing the app can lead to remote code execution.
ShareIts unbelievable success of a billion Android downloads and 1.8 billion users around the world (there are also iOS, Windows, and Mac apps) has actually led to what looks like an amazing quantity of app bloat. The app was considered among the very best for regional file sharing, but today the Play Store listing shows an app that uses “Infinite Online Videos,” “Tens of millions of premium tunes,” “GIFs, Wallpapers & & Stickers,” a “popular” media area that appears like a social media, a video game store, a retail motion picture download section, COVID-19 check-in activity and case statistics, and what looks like its own kind of currency. ShareIts website ( which, simply like the app, does not default to HTTPS) states the service is “now a leading material platform” and popular in Southeast Asia, South Asia, the Middle East, Africa, and Russia.
Ad

Leave a Reply

Your email address will not be published. Required fields are marked *