Three printer apps spread malware on Android: urgent update
A flaw in three official Android apps that allow the control and management of some printer models from well-known global vendors would be targeted by cyber criminals. Here's the attack pattern and how to mitigate the risk
According to Japanese Vulnerability Notes (JVN) , a flaw in three official apps for Android that allow the control of printers of well-known vendors globally, would be targeted by cyber criminals to spread malware .
“The vulnerability present in the Kyocera app, in particular, is extremely insidious”, comments Pierluigi Paganini , cyber security analyst and CEO of Cybhorus, “as it allows an attacker to have access to resources on the device for which he is not authorized ” .
The flaw opens the door for other malicious apps to spread malware to affected devices. In fact, hackers exploited the vulnerability to download and install malware on victims' devices. The flaw allows attackers to manage permissions in an advanced way.
The three apps are: Kyocera Mobile Print v3.2.0.230119 and earlier; Utax/TA Mobile Print v3.2.0.230119 and earlier; Olivetti Mobile Print v3.2.0.230119 and earlier versions . The uopdate to higher versions is therefore urgent.
The Kyocera app has been downloaded a million times on Google Play, while that of Utax/TA has exceeded 100,000 downloads on the Google app store and the Olivetti app has 10,000.
To enter your Android device, however, cybercriminals need to download and install a second infected app. They must therefore enable the download of the payload through the official application with a reliable and secure appearance.
In fact, "it must be said that, in assessing the severity of this flaw", Paganini adds, "it must be borne in mind that although it is an app that has about a million installations, the presence of a second malicious application on the target device”.
"This aspect implies the need to structure an attack in several stages, although not complex to implement," warns the cybersecurity expert.
How to protect yourself
The developers of the apps at risk have healed the flaw, to take cover from the cybercriminal offensive. In fact, Kyocera invites users to update the printing app to version v3.2.0.230227, already made available on Google Play.
The update of the three Android apps to their latest version is urgently needed to remedy the flaw at risk.
“Finally,” concludes Paganini, “future versions of Android support security features that can prevent the exploitation of flaws like these.” In fact, from Android 14 , the exchange of intents between apps will be restricted, since it will require the definition of specific recipients from the senders, the declaration of what information an app needs to receive from other apps, and whether or not the recipients should be limited to system broadcasts.
Comments
Post a Comment