조심하세요 – 이 Android 원격 키보드 apps 심각한 보안 결함이 있음

세 Android apps designed to let users use their phones as a 건반 A에 대한 워크 스테이션 may be exposing key presses to threat actors and allowing them to execute remote code.

에 따르면 멍청한 컴퓨터 (새 탭에서 열립니다), analysts at electronic design automation (EDA) company Synopsys have found critical vulnerabilities in “PC Keyboard”, “Lazy Mouse”, and “Telepad”, and published an 주의보 (새 탭에서 열립니다) on its Application Security Blog regarding seven distinct security flaws.

The free and paid versions of these apps, both of which are affected, have a combined install base of over two million. Synopsys didn’t receive a response from any developers of the apps concerned within a 90-day period after first making contact in August 2022, and now recommend uninstalling the apps.

Android 원격 키보드 앱 보안 결함

“CyRC research uncovered weak or missing authentication mechanisms, missing authorization, and insecure communication vulnerabilities in the three apps,” reads Synopsys’ advisory.

“Although the vulnerabilities are all related to the authentication, authorization, and transmission implementations, each application’s failure mechanism is different.”

The flaws in question are CVE-2022-45477, CVE-2022-45478, CVE-2022-45479, CVE-2022-45480, CVE-2022-45481, CVE-2022-45482 and CVE-2022-45483. Together, they permit unauthenticated users access to the apps’ remote servers and allow them to commit “man in the middle attacks” and read all keystrokes in plaintext.

Lazy Mouse, in particular, doesn’t require a password to be set for the server within the app, and doesn’t set one by default, which is sure to catch out less security conscious users and put them at the risk of exposing sensitive personal data, which could be used against them in a case of 신분 도용.

Plenty of safe remote keyboard apps for Android are listed on the Google Play Store.

To avoid accidentally installing 악성 코드, make sure the app comes from there as a trustworthy source, has great user reviews, recommendations from figures in the tech industry, a recent update history, and a description with perfect spelling and grammar.

However, users will only ever be truly safe from compromise if they can guarantee that all of their keystrokes are encrypted. A trustworthy app will usually tout this feature, but you may also find it in the app’s privacy policy, typically available on its Play Store page.

출처