bk99.de entertain the web since 1997

bk99.de
g · SecurityCurated

The tricks with the Google security hole

Summary

In early 2020 Trend Micro found malicious apps in the Google Play Store that exploited an Android hole previously used by customers of the spyware maker NSO. Google itself had discovered the hole around a year and a half earlier. The apps Camero and Filecrypt Manager served as droppers and secretly installed the spy app Callcam.

Ideas

  • Harmless-looking apps download the actual malware afterwards.
  • A known hole that had not been closed everywhere remained exploitable for a long time.
  • The installation was hidden from the user.
  • Filecrypt Manager abused the accessibility function to hide installations behind a full-screen window.

Insights

  • With Android, a lot of time often passes between discovery and the fix reaching all devices.
  • State spyware techniques later end up with ordinary criminals.

Facts

  • The apps were discovered by the researchers Ecular Xu and Joseph C. Chen.
  • The apps were available in the official Play Store.
  • The privilege escalation worked on the Pixel 2, Nokia 3, LG V20, Oppo F9 and Redmi 6A, among others.
  • According to Trend Micro, the attackers had probably been active since March 2019.

References

Critique

  • The report does not give the identifier of the hole, which makes checking your own patch level harder.

Recommendations

  • Only use Android devices as long as they receive monthly security updates.
  • Install apps sparingly and check permissions and publishers.

Read the original article

Search the Web Archive

g · 2015

Google publishes Windows security hole

In early 2015 Google published a hole in Windows 8.1 after Microsoft had not closed it within 90 days. Via NtApphelpCacheControl, a user with restricted rights could gain administrator rights. Google’s experts had found the vulnerability at the end of September 2014 and informed Microsoft.

g · 2026

Broadcom hole lets attackers knock out entire Wi-Fi networks

In January 2026 researchers from Black Duck found a hole in Broadcom Wi-Fi chipsets through which an attacker within radio range can knock out a 5 GHz network with a single packet, without logging in and regardless of WPA2 or WPA3. All clients lose their connection until the router is restarted, and the attack can be repeated immediately. Testing was done on an Asus RT-BE86U; Broadcom had already patched, but how far manufacturers had passed this on remained unclear.

g · 2025

17,000 Linux servers vulnerable to critical rsync hole

In January 2025 six holes in rsync became known, including the critical CVE-2024-12084, which in combination allows servers with only anonymous read access to be taken over. According to Shadowserver, 17,475 freely reachable rsync servers worldwide were vulnerable on 16 January, with Germany in fifth place with 956. All versions up to 3.3.0 were affected; the fixes came in 3.4.0 and 3.4.1.