Security

We're all sick of Fortnite, but the flaw found in its downloader is the latest way to attack Android

Man-in-the-Disk technique able to add malicious files to a device's external storage

By John Leyden

51 SHARE

A newfound way to hack Android using a technique dubbed "Man-in-the-Disk" is central to the recent security flap about Fortnite on the mobile platform.

Man-in-the-Disk can circumvent sandboxes and infect a smartphone or tablet using shared external storage through a seemingly harmless Android application.

Sandboxing isolates applications from each other. The idea is that even if a malicious application found its way on to an Android device, it wouldn't be able to steal data associated with other apps.

Check Point researcher Slava Makkaveev explained, during a presentation at the DEF CON hacking jamboree in Las Vegas, how an application with no particularly dangerous or suspicious permissions can escape the sandbox.

The technique – named after the well-known Man-in-the-Middle type of attack – works by abusing calls to read or write to external storage, a routine function of mobile applications.

External storage is also often used for temporarily storing data downloads from the internet. An application may use the area to store supplementary modules that it installs to expand its functionality, like additional content or updates.

Ah, um, let's see. Yup... Fortnite CEO is still mad at Google for revealing security hole early

READ MORE

The problem is that any application with read/write access to the external storage can gain access to the files and modify them, adding something malicious. Google has already warned app developers to be wary of malfeasance in this area.

Makkaveev discovered that not all app developers, not even Google employees or certain smartphone manufacturers, follow the advice. Makkaveev demonstrated exploitation of the vulnerability in Google Translate, Yandex.Translate, Google Voice Typing, and Google Text-to-Speech, as well as system applications by LG and the Xiaomi browser.

He warned that vulnerable apps are likely numerous, an observation evidenced by events over the last few days.

Google researchers recently discovered that the same Man-in-the-Disk attack can be applied to the Android version of the popular game Fortnite. To download the game, users need to install a helper app first. This, in turn, is supposed to download the game files.

But by using the Man-in-the-Disk attack, a crook can trick the helper into installing a malicious application.

Fortnite's developer, Epic Games, is aware of this vulnerability and has already issued a new version of the installer. Players should be using version 2.1.0 to stay safe. If you have Fortnite already installed, remove it then reinstall from scratch using the patched version of the software.

Epic Games is none too pleased that Google went public with the exposure of Fortnite to this class of vulnerability, as previously reported. Kaspersky Lab CTO Nikita Shvetsov noted on Monday that the flaw stemmed from the same "Man-in-the-Disk" attack some Google apps were revealed as being vulnerable to earlier this month.

Kaspersky Lab's explanation of the Man-in-the-Disk vulnerability – and how consumers can minimise their exposure to the problem – can be found here. ®

Sign up to our NewsletterGet IT in your inbox daily

51 Comments

More from The Register

Google shaves half a gig off Android Poundland Edition

Always believe in Go ...

Google freezes Android P: Get your shoes on, tire-kicking devs

Final 'droid P APIs, latest system images

Google-free Android kit tipped to sell buckets

China, you see, has its own chocolate factories

Sur-Pies! Google shocks world with sudden Android 9 Pixel push

One critical question remains: Who ate all the Pies?

Google accidentally reveals new swipe-happy Android UI

We did what? Look again, it's not there

Android devs prepare to hit pause on ads amid Google GDPR chaos

Hey Google. How will we eat?

Android Oreo mic drop fury: Google ups tempo for Pixel mobe audio fix

Hardware flaws may be amplified by slapdash software, tuning out bug now a priority

New Android P beta is 'very close', 'near-final' but also just 'early'

How excited to be? Cautiously, unless you need to get cracking with testing for P's big changes

Fork it! Google fined €4.34bn over Android, has 90 days to behave

Analysis Vows to appeal as Euro competition commissioner says: Stop it now

Meet the Frenchman masterminding a Google-free Android

Interview What open-sourcery is this?