BlueStacks Emulator For Windows Flaw Exposes Millions Of Gamers To Attack

A significant vulnerability was discovered in BlueStacks, the world’s fastest Android emulator and cloud gaming platform. When used against a victim, this gives attackers complete access to the machine.

The American technology business BlueStacks, also known as BlueStacks by now.gg, Inc., is well-known for developing the BlueStacks App Player and other cloud-based cross-platform applications.

The BlueStacks App Player allows Android applications to run on devices running Microsoft Windows or macOS. 

BlueStacks exchanges virtual machine configuration files amongst several OS users and keeps them in a world-writable directory, which makes it feasible for an unauthorized user to backdoor an image and obtain privileged user code execution capabilities.

Join our free webinar to learn about combating slow DDoS attacks, a major threat today.

Understanding The Vulnerability

The critical flaw is identified as BlueStacks privilege escalation via virtual machine backdooring tracked as CVE-2024-33352.

An attacker can automatically add executable code to the virtual machine by changing the BlueStacks configuration.

This allows the attacker to create a backdoor that will launch whenever an authorized user launches the emulator. 

Later, the code may be made to escape Virtual Box and enter the host operating system by reconfiguring the shared directory settings to include the entire C drive.

The attacker would edit the file on the C drive and alter it to enable a virtual machine escape, giving them complete access to the Windows filesystem.

Hence, the attacker installs malicious software on the Android virtual machine (VM), which has the ability to deliver a payload into the host system’s startup directory. 

This payload is run with the victim’s privileges when the victim restarts their computer, granting the attacker complete control.

The vulnerability was brought to light by researcher Maciej Miszczyk. BlueStacks for Windows (versions prior to 10.40.1000.502) are affected.

Protect Your Business Emails From Spoofing, Phishing & BEC with AI-Powered Security | Free Demo