気をつけてください – これらの Android リモートキーボード apps 重大なセキュリティ上の欠陥がある

スリー Android apps designed to let users use their phones as a キーボードのために may be exposing key presses to threat actors and allowing them to execute remote code.

による 逃げるコンピュータ （新しいタブで開きます）, analysts at electronic design automation (EDA) company Synopsys have found critical vulnerabilities in “PC Keyboard”, “Lazy Mouse”, and “Telepad”, and published an アドバイザリー通知（新しいタブで開きます） on its Application Security Blog regarding seven distinct security flaws.

The free and paid versions of these apps, both of which are affected, have a combined install base of over two million. Synopsys didn’t receive a response from any developers of the apps concerned within a 90-day period after first making contact in August 2022, and now recommend uninstalling the apps.

Android リモートキーボードアプリのセキュリティ上の欠陥

“CyRC research uncovered weak or missing authentication mechanisms, missing authorization, and insecure communication vulnerabilities in the three apps,” reads Synopsys’ advisory.

“Although the vulnerabilities are all related to the authentication, authorization, and transmission implementations, each application’s failure mechanism is different.”

The flaws in question are CVE-2022-45477, CVE-2022-45478, CVE-2022-45479, CVE-2022-45480, CVE-2022-45481, CVE-2022-45482 and CVE-2022-45483. Together, they permit unauthenticated users access to the apps’ remote servers and allow them to commit “man in the middle attacks” and read all keystrokes in plaintext.

Lazy Mouse, in particular, doesn’t require a password to be set for the server within the app, and doesn’t set one by default, which is sure to catch out less security conscious users and put them at the risk of exposing sensitive personal data, which could be used against them in a case of 個人情報の盗難.

Plenty of safe remote keyboard apps for Android are listed on the Google Play Store.

To avoid accidentally installing マルウェア, make sure the app comes from there as a trustworthy source, has great user reviews, recommendations from figures in the tech industry, a recent update history, and a description with perfect spelling and grammar.

However, users will only ever be truly safe from compromise if they can guarantee that all of their keystrokes are encrypted. A trustworthy app will usually tout this feature, but you may also find it in the app’s privacy policy, typically available on its Play Store page.

ソース