A significant vulnerability was discovered in BlueStacks, the world’s fastest Android emulator and cloud gaming platform. When used against a victim, this gives attackers complete access to the machine.
The American technology business BlueStacks, also known as BlueStacks by now.gg, Inc., is well-known for developing the BlueStacks App Player and other cloud-based cross-platform applications.
The BlueStacks App Player allows Android applications to run on devices running Microsoft Windows or macOS.
BlueStacks exchanges virtual machine configuration files amongst several OS users and keeps them in a world-writable directory, which makes it feasible for an unauthorized user to backdoor an image and obtain privileged user code execution capabilities.
Join our free webinar to learn about combating slow DDoS attacks, a major threat today.
The critical flaw is identified as BlueStacks privilege escalation via virtual machine backdooring tracked as CVE-2024-33352.
An attacker can automatically add executable code to the virtual machine by changing the BlueStacks configuration.
This allows the attacker to create a backdoor that will launch whenever an authorized user launches the emulator.
Later, the code may be made to escape Virtual Box and enter the host operating system by reconfiguring the shared directory settings to include the entire C drive.
The attacker would edit the file on the C drive and alter it to enable a virtual machine escape, giving them complete access to the Windows filesystem.
Hence, the attacker installs malicious software on the Android virtual machine (VM), which has the ability to deliver a payload into the host system’s startup directory.
This payload is run with the victim’s privileges when the victim restarts their computer, granting the attacker complete control.
The vulnerability was brought to light by researcher Maciej Miszczyk. BlueStacks for Windows (versions prior to 10.40.1000.502) are affected.
Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…