May 5, 2024 Microsoft has identified a serious vulnerability in Android apps that could allow malicious software to hijack legitimate apps and steal valuable user information. This flaw, named “Dirty Stream,” affects many popular apps with billions of combined downloads.
The “Dirty Stream” flaw takes advantage of Android’s content provider system, which is designed for secure data sharing between apps. However, incorrect implementation of the system can lead to exploitation, as attackers use “custom intents” to access sensitive areas of an app. For example, vulnerable apps might not properly validate file paths, allowing malicious code to be inserted.
Attackers exploiting the flaw could overwrite critical files in an app’s private storage, potentially gaining control over the app’s behaviour, accessing sensitive data, or intercepting login information. The flaw has been identified in popular apps like Xiaomi’s File Manager and WPS Office, affecting billions of installations.
Microsoft has notified developers of vulnerable apps, working with them to deploy fixes. Google has updated its app security guidelines to prevent similar vulnerabilities in the future.
Android users should stay vigilant with app updates and download apps only from official sources like the Google Play Store to minimize the risk of malicious apps.
