Three Android apps designed to let users use their phones as a keyboard for a workstation may be exposing key presses to threat actors and allowing them to execute remote code.
According to BleepingComputer (opens in new tab), analysts at electronic design automation (EDA) company Synopsys have found critical vulnerabilities in “PC Keyboard”, “Lazy Mouse”, and “Telepad”, and published an advisory notice (opens in new tab) on its Application Security Blog regarding seven distinct security flaws.
The free and paid versions of these apps, both of which are affected, have a combined install base of over two million. Synopsys didn’t receive a response from any developers of the apps concerned within a 90-day period after first making contact in August 2022, and now recommend uninstalling the apps.
Android remote keyboard app security flaws
“CyRC research uncovered weak or missing authentication mechanisms, missing authorization, and insecure communication vulnerabilities in the three apps,” reads Synopsys’ advisory.
“Although the vulnerabilities are all related to the authentication, authorization, and transmission implementations, each application’s failure mechanism is different.”
The flaws in question are CVE-2022-45477, CVE-2022-45478, CVE-2022-45479, CVE-2022-45480, CVE-2022-45481, CVE-2022-45482 and CVE-2022-45483. Together, they permit unauthenticated users access to the apps’ remote servers and allow them to commit “man in the middle attacks” and read all keystrokes in plaintext.
Lazy Mouse, in particular, doesn’t require a password to be set for the server within the app, and doesn’t set one by default, which is sure to catch out less security conscious users and put them at the risk of exposing sensitive personal data, which could be used against them in a case of identity theft.
Plenty of safe remote keyboard apps for Android are listed on the Google Play Store.
To avoid accidentally installing malware, make sure the app comes from there as a trustworthy source, has great user reviews, recommendations from figures in the tech industry, a recent update history, and a description with perfect spelling and grammar.
However, users will only ever be truly safe from compromise if they can guarantee that all of their keystrokes are encrypted. A trustworthy app will usually tout this feature, but you may also find it in the app’s privacy policy, typically available on its Play Store page.
English
Arabic
Belarusian
Bengali
Bosnian
Bulgarian
Chinese (Simplified)
Croatian
Czech
Danish
Dutch
Estonian
Filipino
Finnish
French
Georgian
German
Greek
Gujarati
Hausa
Hebrew
Hindi
Hmong
Hungarian
Igbo
Indonesian
Italian
Japanese
Javanese
Kazakh
Korean
Kurdish (Kurmanji)
Kyrgyz
Lao
Latvian
Lithuanian
Macedonian
Malagasy
Norwegian
Persian
Polish
Portuguese
Punjabi
Romanian
Russian
Serbian
Slovak
Slovenian
Spanish
Swedish
Thai
Turkish
Ukrainian
Vietnamese
Yoruba