This article is more than 1 year old
Google and pals rush to repair Android dev tools, block backdoor risks
Involves big hitter Android Studio, APKTool and more
Security researchers have found several flaws in the developer tools and environments used by Android programmers.
The flaws, if exploited, would enable hackers to exploit the developer environments and insert malicious code (like adware or a cryptominer) into legitimate apps, without the developers of those kosher apps knowing about it.
Downloadable and cloud-based tools used by Java/Android programmers to build their companies’ business applications are vulnerable, according to security researchers at Check Point. Fortunately prompt action by the software tool-makers has prevented the repetition of the sort of security screw-up that resulted in Avast inadvertently serving up backdoor versions of its Cleaner tool earlier this year.
More specifically, Check Point’s team has found several vulnerabilities that affect the most common Android integrated development environments (IDEs) – Google’s Android Studio and JetBrains’ IntelliJ IDEA and Eclipse, as well as the major reverse engineering tools for Android applications such as APKTool, the Cuckoo-Droid service and more.
The researchers' first find was in APKTool, where it discovered the configured XML parser did not disable external entity references when parsing an XML file within the program. Check Point said the "vulnerability expose[d] the whole OS file system of APKTool users..."
The team went on to find multiple vulnerable implementations of the XML parser within other projects, specifically the most popular IDEs that are used for building Android applications.
Check Point reported the discovery to APKTool developers and the other IDE companies back in May 2017. Google and JetBrains have verified and acknowledged the security issues and have since deployed a fix to shore up the security of their products.
The Check Point team also contacted APKTool developer and IDE companies who responded by fixing the security issues and released updated versions of their products. ®
Biting the hand that feeds IT
