Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

bleepingcomputer.com

Post reply on HN
Print view View original

1–10 of 62 posts

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#2

Post by saagarjha »

> Android apps "distributed via Google Play may not modify, replace, or update itself using any method other than Google Play's update mechanism. Likewise, an app may not download executable code (e.g. dex, JAR, .so files) from a source other than Google Play."

Obvious question: why did this get approved, and will Google amend their process to close this loophole?

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#3

Post by [deleted] »

saagarjha wrote: post #2

> Android apps "distributed via Google Play may not modify, replace, or update itself using any method other than Google Play's update mechanism. Likewise, an app may not download executable code (e.g. dex, JAR, .so files) from a source other than Google Play." Obvious question: why did this get approved, and will Google amend their process to close this loophole?

[deleted]

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#7

Post by ignoramous »

saagarjha wrote: post #2

> Android apps "distributed via Google Play may not modify, replace, or update itself using any method other than Google Play's update mechanism. Likewise, an app may not download executable code (e.g. dex, JAR, .so files) from a source other than Google Play." Obvious question: why did this get approved, and will Google amend their process to close this loophole?

Fwiw, Firefox Mobile lets you download add-ons and plugins, as well, that modify behaviour of the app. Not sure what justification UCWeb might have given here to Google, though, it is more likely that with certain apps, external install, command, and control is a valid and exceptional use-case.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#9

Post by Kipters »

ignoramous wrote: post #7
saagarjha wrote: post #2

> Android apps "distributed via Google Play may not modify, replace, or update itself using any method other than Google Play's update mechanism. Likewise, an app may not download executable code (e.g. dex, JAR, .so files) from a source other than Google Play." Obvious question: why did this get approved, and will Google amend their process to close this loophole?

Fwiw, Firefox Mobile lets you download add-ons and plugins, as well, that modify behaviour of the app. Not sure what justification UCWeb might have given here to Google, though, it is more likely that with certain apps, external install, command, and control is a valid and exceptional use-case.

In Firefox's case, the user willingly searchs for and installs add-ons, UC Browser did it on its own without informing the user

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#10

Post by austincheney »

> using unprotected channels

It's not man in the middle. I have seen this mistake a lot lately. Man in the middle only involves encryption. Otherwise it is just injection or redirection. It is not a man in the middle attack merely because something happened in the middle of a transmission. There is always stuff that happens in the middle of transmission if you want to get technical about packet switching ARP resolution.

Specifically man in the middle deals with intercepting a certificate or key request in the middle of a transmission so that the encrypted tunnel is between one end point and the attacker. The attacker then establishes a second encrypted tunnel between themselves and the other end point.

Wikipedia page - https://en.wikipedia.org/wiki/Man-in-the-middle_attack

I am certain about this because I had to study it in order to pass the CISSP exam (first time go back when it was a 250 question paper test).

Post reply on HN