Security

We're all sick of Fortnite, but the flaw found in its downloader is the latest way to attack Android

Man-in-the-Disk technique able to add malicious files to a device's external storage

By John Leyden

51 SHARE

A newfound way to hack Android using a technique dubbed "Man-in-the-Disk" is central to the recent security flap about Fortnite on the mobile platform.

Man-in-the-Disk can circumvent sandboxes and infect a smartphone or tablet using shared external storage through a seemingly harmless Android application.

Sandboxing isolates applications from each other. The idea is that even if a malicious application found its way on to an Android device, it wouldn't be able to steal data associated with other apps.

Check Point researcher Slava Makkaveev explained, during a presentation at the DEF CON hacking jamboree in Las Vegas, how an application with no particularly dangerous or suspicious permissions can escape the sandbox.

The technique – named after the well-known Man-in-the-Middle type of attack – works by abusing calls to read or write to external storage, a routine function of mobile applications.

External storage is also often used for temporarily storing data downloads from the internet. An application may use the area to store supplementary modules that it installs to expand its functionality, like additional content or updates.

Ah, um, let's see. Yup... Fortnite CEO is still mad at Google for revealing security hole early

READ MORE

The problem is that any application with read/write access to the external storage can gain access to the files and modify them, adding something malicious. Google has already warned app developers to be wary of malfeasance in this area.

Makkaveev discovered that not all app developers, not even Google employees or certain smartphone manufacturers, follow the advice. Makkaveev demonstrated exploitation of the vulnerability in Google Translate, Yandex.Translate, Google Voice Typing, and Google Text-to-Speech, as well as system applications by LG and the Xiaomi browser.

He warned that vulnerable apps are likely numerous, an observation evidenced by events over the last few days.

Google researchers recently discovered that the same Man-in-the-Disk attack can be applied to the Android version of the popular game Fortnite. To download the game, users need to install a helper app first. This, in turn, is supposed to download the game files.

But by using the Man-in-the-Disk attack, a crook can trick the helper into installing a malicious application.

Fortnite's developer, Epic Games, is aware of this vulnerability and has already issued a new version of the installer. Players should be using version 2.1.0 to stay safe. If you have Fortnite already installed, remove it then reinstall from scratch using the patched version of the software.

Epic Games is none too pleased that Google went public with the exposure of Fortnite to this class of vulnerability, as previously reported. Kaspersky Lab CTO Nikita Shvetsov noted on Monday that the flaw stemmed from the same "Man-in-the-Disk" attack some Google apps were revealed as being vulnerable to earlier this month.

Kaspersky Lab's explanation of the Man-in-the-Disk vulnerability – and how consumers can minimise their exposure to the problem – can be found here. ®

Sign up to our NewsletterGet IT in your inbox daily

51 Comments

More from The Register

Google hands out roses to preferred Android MDM vendors

Lucky few get Chocolate Factory's endorsement as Enterprise Mobility Management

Google pholds! Just kidding. But Android Q Beta 2 drop supports those cool bendy mobes

Toying with UI, burstin' bubbles

Google rolls out Android Easter Egg for Europe – a Microsoft antitrust-style browser, search engine choice box

Now how about we forget these fines, eh, mes amies? Meine Freunde? Mis amigos?

Google takes a page from Microsoft of old and revives browser ballot on Android

There's no place like Chrome, but... here are the other guys

EU Android latest: Critics diss Google's money-spinning 'cure'

You shouldn't profit from punishment

You're not still writing Android apps in Oracle's Java, are you? Google tut-tuts at dev conf

Google I/O Ad giant pushes Kotlin language, Q beta 3, Flutter, ChromeOS, and more

Google shaves half a gig off Android Poundland Edition

Always believe in Go ...

Surprising no one, Google to appeal against European Commission's €4.34bn Android fine

We'll just take our time here

Google freezes Android P: Get your shoes on, tire-kicking devs

Final 'droid P APIs, latest system images

So, about that Google tax on Android makers in the EU – report pegs it at up to $40 per phone

Fee offset if Search and Chrome included alongside Play Store, of course