Approx 500 Million UC Browser Android Users are Vulnerable to Man-in-the-Middle Attacks

Researchers discovered various unusual activities in UC Browser for Android and it abusing the Google play policies and exposing more than 500 users to Man-in-the-Middle attacks.

UC browser is the most popular browser in the Android platform with more than 500 million users and UC Browser Mini has 100 million downloads from the Google Play store alone.

GBHackers on Security has been reported several UC browser-based incidents including malicious activities, vulnerabilities before and it is a very serious concern that needs to be addressed for any unusual behaviors since it will directly affect the hundreds of millions of users.

Recent research from Zscaler reveals that the UC Browser and UC Browser Mini apps unusually made a request over unprotected (HTTP) channel to download an additional Android Package Kit from the remote server.

There are 3 main unusual activities found from UC Browser app in this research :

Downloading an additional APK from a third party – in violation of Google Play policy
Communication over an unsecured channel – opening doors to man-in-the-middle attacks
Dropping an APK on external storage (/storage/emulated/0) – allowing other apps, with appropriate permissions, to tamper with the APK

Downloading an additional APK

After completing the installation process, researchers noticed that the app sending multiple requests and finally drop an APK on the user’s device.

The APK dropped into external storage but there is no sign of installation process. Researchers believe that the functionality is still under development

According to Google Play policy, Apps should not download and APK from any third-party source.

“An app distributed via Google Play may not modify, replace, or update itself using any method other than Google Play’s update mechanism. Likewise, an app may not download executable code (e.g., dex, JAR, .so files) from a source other than Google Play.”

Unsecured channel Communication

UC browsers download the APK from completely unencrypted communication that possibility open for man-in-the-middle (MiTM) attacks.

In March 2019, We have already reported a similar issue in which hidden future that uncovered in UC browsers let attackers download and run untested code in any of the Android devices and also its bypass the Google Play servers by downloading the auxiliary software modules that allow hackers to hijack Android devices via Man-in-the-Middle Attacks.

Researchers believe that “It could be that the same app had been uploaded again on Google Play with a different name and developer along with modified or enhanced code to download additional APKs.”

Dropping an APK on external storage

An APK file that being by UC browser from the remote server is stored on external storage which is world-readable by default.

“An APK being placed on external storage, or any other app with storage permission (android:name=android.permission.READ/WRITE_EXTERNAL_STORAGE) can have access to this location and can tamper with the downloaded APK.”

Since there wasn’t any installation behavior, the researcher manually tried to install the downloaded APK file and find found that the APK was a third-party app store named “9 Apps.

Further analysis revealed that the 3rd Party app store distributing several adult apps. When we tried to download any app, it downloaded from 9appsdownloading[.]com

After Google’s intervention, the latest version of both the apps, UC Browser and UC Mini, has stopped downloading the third-party app store and the UC browser users are advised to update the latest version.

10 Best Forum Software For Webmasters

10 Best Forum Software For Webmasters Do you want to create your online discussion forum or online community where people can discuss about their favorite topics? In this article, you can see 10 best forum software (scripts for setting up discussion forums) that can be used free of cost. Although some scripts are paid but rest of these forum scripts are free to use.You only need to buy hosting space and domain name for your website and after then you can install any of these forum scripts to start your own discussion forums on the internet. Online discussion forums generate huge page views because thousands of people want to join online discussion forums to ask questions or share knowledge. Some of online marketers join forums to discuss about their products with community members. You don't need to acquire any kind of technical skill to run a professional discussion forums because these days, almost all web hosting providers offer one click script installer which h...

|Bypass Symlink on 2013 Server With Different .htaccess and Methods by Sen Haxor |

Hi, Guys, Please a wonderfull tutorial provided bt Sem;\ Today I gonna Explain how to bypass Symlink on 2013 Server With Different .htaccess and Methods. So let's Get Started :) Note: This method is not applicable for Godaddy, Bluehost, Hostgator and Hostmonstor Servers. For This First You Need the Following Files : 1 -> Sen Haxor CGI Shell 2 -> sen.zip 3 -> passwd-bypass.php 4 -> Turbo Brute force Cpanel 5 - > Port.py First Before Starting to symlink we need to create php.ini and ini.php to Disable Safe mode and Disabled Functions on the server . Use the Following Code : Make a php.ini with the following code safe_mode=Off And ini.php with <? echo ini_get("safe_mode"); echo ini_get("open_basedir"); include($_GET["file"]); ini_restore("safe_mode"); ini_restore("open_basedir"); echo ini_get("safe_mode"); echo...

How to Hack WhatsApp using just a GIF

A picture is worth a thousand words, but a GIF is worth a thousand pictures. Today, the short looping clips, GIFs are everywhere—on your social media, on your message boards, on your chats, helping users perfectly express their emotions, making people laugh, and reliving a highlight. But what if an innocent-looking GIF greeting with Good morning, Happy Birthday, or Merry Christmas message hacks your smartphone? Well, not a theoretical idea anymore. WhatsApp has recently patched a critical security vulnerability in its app for Android, which remained unpatched for at least 3 months after being discovered, and if exploited, could have allowed remote hackers to compromise Android devices and potentially steal files and chat messages. WhatsApp Remote Code Execution Vulnerability The vulnerability, tracked as CVE-2019-11932 , is a double-free memory corruption bug that doesn't actually reside in the WhatsApp code itself, but in an open-source GIF image parsing library that What...

Hacks

Search This Blog