Popular file sharing app SHAREit for Android has some serious security vulnerabilities that await a fix. Exploiting the issues allows remote code execution attacks.
SHAREit Android App Vulnerabilities
Researchers from Trend Micro have caught the Android version of the file sharing app SHAREit with major security issues. Given that the app boasts over 1 billion downloads on Play Store, the vulnerabilities risk a huge number of users.
Sharing the details in a blog post, the researchers revealed that the vulnerabilities exist because of improper restrictions regarding who can meddle with the app’s code.
In brief, the first issue was that any app can invoke broadcast component to view the app’s internet and external activities. Secondly, ay third-party can gain read/write access to the app’s content. Then, as the developers specified a huge storage path, anyone can access the all files in the /data/data/<package> folder. Also, anyone can run a code to read WebView cookies in addition overwriting existing files in app’s folders.
To sum up, these issues make it very easy for an MiTM attacker to amend the app code and transform it into a malicious one.
In turn, this will allow the adversary to abuse the app to access users’ sensitive data and execute remote codes.
Google Play Store Informed
Trend Micro has confirmed that they have informed the app developers about the vulnerabilities.
However, even after three months, the SHAREit app team hasn’t addressed the bugs.
Consequently, the researchers went ahead a public disclosure of these issues that are also difficult to detect.
Besides, they have also informed Google about the bugs. Yet, it seems no action has been taken yet since the app continues to exist on the Play Store.
Now that the exploits are out, Android users running SHAREit app on their devices should remain careful. iOS users, however, remain safe from these issues as the SHAREit iOS app runs of a different code.