There have been recent revelations by Microsoft that an old version of the SHEIN Android application has been found reading the contents of the clipboard on Android devices irregularly.
With more than 100 million downloads from the Google Play Store, SHEIN’s Android app is one of the most popular in the marketplace. This Singapore-based retailer has been an online fast fashion retailer for over a decade, originally operating under the name ZZKKO.
It should be possible to send the contents of the clipboard to a remote server if a particular pattern can be identified. Despite this, Microsoft hasn’t identified any malicious intent behind the behavior and is not aware of any such activities.
It is important to understand the risks that the installed applications can pose even if SHEIN didn’t have malicious intent. As an example, this can include the popular apps that are loaded from the official app store of the platform since they are highly popular.
The Android Security Team at Google was tasked with investigating after Microsoft reported its findings to Google, which operates the Play Store.
There have been no updates to the app since the release of version 7.9.2 on December 16, 2021. Microsoft researchers reported that on March 6 they discovered this issue that has been fixed in the May 2022 update.
In order to prevent possible malicious attacks, users must make sure their installed application is up-to-date. Since mobile users frequently use clipboards to copy and paste sensitive information, clipboards are an appealing target for cyberattacks.
While in the clipboard users mainly perform the copy and paste of the following type of data:-
In order to identify and observe the code responsible for the particular behavior of the application, Microsoft’s cybersecurity analysts performed two types of analysis, and here they are mentioned below:-
By exploiting this clipboard vulnerability threat actors can easily modify the contents of the clipboard for several types of other malicious activities. The application triggers a POST request to the server “api-service[.]shein[.]com.” when any content copied to the clipboard is launched.
In the past few years, Google has taken steps to mitigate the privacy risks involved with Android in order to make it more secure.
Recommendations
Here below we have mentioned all the recommendations offered by the cybersecurity analysts at Microsoft:-
Network Security Checklist – Download Free E-Book
The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…
Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…
The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…
Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…
A security researcher discovered a vulnerability in Windows theme files in the previous year, which…
The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…