Tuesday, July 23, 2024

500 Million UC Browser Android Users are Vulnerable to Man-in-the-Middle Attacks

Researchers discovered various unusual activities in UC Browser for Android and it abusing the Google play policies and exposing more than 500  users to Man-in-the-Middle attacks.

UC browser is the most popular browser in the Android platform with more than 500 million users and UC Browser Mini has 100 million downloads from the Google Play store alone.

GBHackers on Security has been reported several UC browser-based incidents including malicious activities, vulnerabilities before and it is a very serious concern that needs to be addressed for any unusual behaviors since it will directly affect the hundreds of millions of users.

Recent research from Zscaler reveals that the UC Browser and UC Browser Mini apps unusually made a request over unprotected (HTTP) channel to download an additional Android Package Kit from the remote server.

There are 3 main unusual  activities found from  UC Browser app in this research :

  1. Downloading an additional APK from a third party – in violation of Google Play policy
  2. Communication over an unsecured channel – opening doors to man-in-the-middle attacks
  3. Dropping an APK on external storage (/storage/emulated/0) – allowing other apps, with appropriate permissions, to tamper with the APK

Downloading an additional APK

After completing the installation process, researchers noticed that the app sending multiple requests and finally drop an APK on the user’s device.

Unsecured Requests

The APK dropped into external storage but there is no sign of installation process. Researchers believe that the functionality is still under development

According to Google Play policy, Apps should not download and APK from any third-party source.

An app distributed via Google Play may not modify, replace, or update itself using any method other than Google Play’s update mechanism. Likewise, an app may not download executable code (e.g., dex, JAR, .so files) from a source other than Google Play.”

Unsecured channel Communication

UC browsers download the APK from completely unencrypted communication that possibility open for man-in-the-middle (MiTM) attacks.

In March 2019, We have already reported a similar issue in which hidden future that uncovered in UC browsers let attackers download and run untested code in any of the Android devices and also its bypass the Google Play servers by downloading the auxiliary software modules that allow hackers to hijack Android devices via Man-in-the-Middle Attacks.

Researchers believe that “It could be that the same app had been uploaded again on Google Play with a different name and developer along with modified or enhanced code to download additional APKs.” 

Dropping an APK on external storage

An APK file that being by UC browser from the remote server is stored on external storage which is world-readable by default.

 “An APK being placed on external storage, or any other app with storage permission (android:name=android.permission.READ/WRITE_EXTERNAL_STORAGE) can have access to this location and can tamper with the downloaded APK.” 

Since there wasn’t any installation behavior, the researcher manually tried to install the downloaded APK file and find found that the APK was a third-party app store named “9 Apps.

UC Browser app icon

Further analysis revealed that the 3rd Party app store distributing several adult apps. When we tried to download any app, it downloaded from 9appsdownloading[.]com

After Google’s intervention, the latest version of both the apps, UC Browser and UC Mini, has stopped downloading the third-party app store and the UC browser users are advised to update the latest version.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates


Latest articles

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....

Hackers Registered 500k+ Domains Using Algorithms For Extensive Cyber Attack

Hackers often register new domains for phishing attacks, spreading malware, and other deceitful activities. Such...

Hackers Claim Breach of Daikin: 40 GB of Confidential Data Exposed

Daikin, the world's largest air conditioner manufacturer, has become the latest target of the...

Emojis Are To Express Emotions, But CyberCriminals For Attacks

There are 3,664 emojis that can be used to express emotions, ideas, or objects...

Beware Of Fake Browser Updates That Installs Malicious BOINC Infrastructre

SocGholish malware, also known as FakeUpdates, has exhibited new behavior since July 4th, 2024,...

Data Breach Increases by Over 1,000% Annually

The Identity Theft Resource Center® (ITRC), a nationally recognized nonprofit organization established to support...

UK Police Arrested 17-year-old Boy Responsible for MGM Resorts Hack

UK police have arrested a 17-year-old boy from Walsall in connection with a notorious...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles