Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

bleepingcomputer.com

Post reply on HN
Print view View original

31–40 of 62 posts

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#31

Post by zamadatix »

userbinator wrote: post #30

"It’s impossible to be sure that cybercriminals will never get ahold of the browser developer’s servers or use the update feature to infect hundreds of millions of Android devices." Apparently they didn't consider the same sentence would be just as valid if they replaced "browser developer" with Google... This is an example of the authoritarian security sensationalism that's far too common today, and it only leads to…

If you continue reading you find the key difference to the comparison you just made:

> This unofficial update feature present in UC Browser can also be used by would-be attackers to perform man-in-the-middle attacks (MitM) attacks, potentially leading to remote code execution on compromised devices, because the app communicates with its servers using an unencrypted channel over HTTP.

It's a lot easier to use the update feature to infect millions of people when it's just using plain HTTP.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#32

Post by fencepost »

wastedhours wrote: post #29
40dslf wrote: post #26

Earlier quoted context omitted.

You misunderstood me. I firmly believe UC is owned by Alibaba, but I insist that I don't understand why is that important.

Useful context for me as I haven't heard of the browser so no knowledge as to how they can have such a large userbase. I don't think the intention was draw a correlation between Alibaba and security lapses.

Some of it may be inertia from early days of Android - for a long time I still had the Dolphin browser installed because for a time back in the Android 2.x days it was the best option around and IIRC included its own build of Chromium's rendering engine ("Dolphin Jetpack").

UC Browser is likely also available on devices not using Google Play where Chrome may not be an option.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#33

Post by Matsta »

40dslf wrote: post #26
outloudvi wrote: post #25

Earlier quoted context omitted.

https://www.uc.cn/ If you are meaning of the evidence of UC connected to Alibaba, I think this site is convincing enough. [EDIT: Fix link]

You misunderstood me. I firmly believe UC is owned by Alibaba, but I insist that I don't understand why is that important.

I only posted it because it didn't mention Alibaba was the parent company in the article.

Maybe the article author would have had more luck getting a statement from Alibaba since it has a more significant international presence compared to UCWeb Inc.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#34

Post by gruez »

Spare_account wrote: post #28
austincheney wrote: post #10

> using unprotected channels It's not man in the middle. I have seen this mistake a lot lately. Man in the middle only involves encryption. Otherwise it is just injection or redirection. It is not a man in the middle attack merely because something happened in the middle of a transmission. There is always stuff that happens in the middle of transmission if you want to get technical about packet switching ARP resoluti…

> Man in the middle only involves encryption. This doesn't feel right to me, so I would like to explore it if you are willing to help me understand. I've grabbed a couple of sources below which appear to contradict your assertion, but I'll admit I'm not expert on this topic so if I'm misunderstanding things, I'd appreciate being put right. The Wikipedia article you linked to includes the following section: > A notabl…

Yes, technically because it's conducted by someone in the middle of the transport path, you can call it man in the middle. The problem is that if you call all attacks that, what do you call the attack where asymmetric key exchange is being replicated by some attacker in the middle?

Also, it's possible to pull this particular attack off without being in the "middle",. For example, by using DNS cache poisoning or arp spoofing

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#35

Post by zoom6628 »

FWIW UC Browser is prob the most popular web browser used on Android phones in China. Every device ive seen, or owned, has it pre-loaded or is top choice for getting loaded. I have also tried it out myself, but as other posters has written already, its awful.

Wondering out loud i would ask if the vulnerability to MiTM is actually required. From reports here in HN 2-3 years ago MiTM is basically what the GFW achieves, and it inserts its own headers to route away from intended(and blocked) servers and to benign local China servers(such as baidu). Perhaps this vulnerability exists in their need to be compliant to local Chinese law which basically prevents one bypassing/nullifying the GFW without permission?

This is an open and honest question, not an opinion. Hope someone can answer with facts. I lived in China past 12 years and have had enough hearsay, rumour, and opinion to last me multiple lifetimes :-)

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#36

Post by austincheney »

Spare_account wrote: post #28
austincheney wrote: post #10

> using unprotected channels It's not man in the middle. I have seen this mistake a lot lately. Man in the middle only involves encryption. Otherwise it is just injection or redirection. It is not a man in the middle attack merely because something happened in the middle of a transmission. There is always stuff that happens in the middle of transmission if you want to get technical about packet switching ARP resoluti…

> Man in the middle only involves encryption. This doesn't feel right to me, so I would like to explore it if you are willing to help me understand. I've grabbed a couple of sources below which appear to contradict your assertion, but I'll admit I'm not expert on this topic so if I'm misunderstanding things, I'd appreciate being put right. The Wikipedia article you linked to includes the following section: > A notabl…

The OWASP definition is correct. The gist of a MITM is that each end of the transmission trusts that the malicious actor in the middle is the target destination. When this occurs at the application layer it is almost universally centered on encryption. Keep in mind that in TCP/OSI terms the web is an application riding the internet. Without encryption how do you trust that the destination is who they claim to be?

MITM can occur on routers if the router is compromised by someone malicious or if it lacks integrity from the service provider. Routers are layer 3 devices that connect different networks. If a router is compromised so that traffic is sent to a different network with spoofed domains and content. One resolution is that form of attack is IPSEC. IPSEC is not often used across the public internet, because much of the public internet is still IPv4 and still reliant on NAT and PAT to compensate for a shortage of IP addresses.

Even more rare than that is certificate spoofing. This is hard to execute, which is why public certificates are usually good for as long as a year, but it does occasionally happen. This is why there are certificate revocation procedures.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#39

Post by m-p-3 »

diogenescynic wrote: post #38

If you care about security or privacy, it seems like you’d avoid Android.

But unless you can get Apple to make cheap devices for the masses (like Android One and Android Go) in developing countries, their high price point will push you towards giving up your privacy to have a smartphone and be reachable online.

Re: UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

#40

Post by teknologist »

40dslf wrote: post #26
outloudvi wrote: post #25

Earlier quoted context omitted.

https://www.uc.cn/ If you are meaning of the evidence of UC connected to Alibaba, I think this site is convincing enough. [EDIT: Fix link]

You misunderstood me. I firmly believe UC is owned by Alibaba, but I insist that I don't understand why is that important.

Maybe it was because Alibaba operate a huge payments service network? This would be like PayPal making their own browser and having a load of vulnerabilities in it
Post reply on HN