Although many people ignore it, Google states that Android apps available on the Play Store cannot be updated or modified from third-party sources, although web application security experts say it is possible to bypass this security measure.
A security report mentions that the developers of the popular UC browser has violated this security policy, which has caused its more than 500k users to be exposed to Man-inThe-Middle (MiTM) attacks, due to the download of a third-party APK using an unsecured channel. As mentioned in previous occasions, a MiTM attack occurs when a hacker infiltrates communications between two parties with malicious motivations.
The report, prepared by web application security researchers from ThreatLabZ, mentions that the UC browser has been sending users a request to download an additional Android Package Kit (APK) from an external domain to Play Store (9appsdownloading<.>com). UC Browser Mini, another of the company’s developments, which also has more than 100 million downloads, has also been sending these requests.
Experts claim that the company did download these additional APKs to the victims’ external storage units, although it failed in its attempt to install the package on the device, probably because this APK is still in development. The function to prevent the installation of software from unknown sources on Android might also influence this behavior.
However, even if the APK is not installed successfully, web application security experts claim that Android device users are still at risk, as downloading this APK is done via an unsecured channel.
This is not the first time UC Browser has exposed the security of users of this operating system. A few months ago, web application security experts from the International Institute of Cyber Security (IICS) reported the presence of similar activity linked to the UC browser, which downloaded an executable Linux library from a server controlled by an unknown company.
On that occasion, the experts tried to contact the developer company, but the developer refused to issue statements. Although Google was also alerted about this practice, apps never ceased to be available on the Play Store. Despite these security drawbacks, UC Browser remains one of the leading companies in mobile browsers.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
