Microsoft has issued an alert about a serious security vulnerability in Android, known as “Dirty Stream”, which puts at risk the integrity of several apps with hundreds of millions of installations. This security breach, which allows malicious apps to take control of legitimate apps, is related to the ContentProvider system, used by many popular Android apps and essential for communication between apps and file sharing in the Android ecosystem.
Two apps affected by this vulnerability are File Manager from Xiaomi (the default file manager for Xiaomi mobile phones) and WPS Office, with over 1 billion and 500 million installations respectively. Microsoft discovered that these apps were vulnerable to arbitrary code execution, but both have released updates to fix the issue.
The complexity of Dirty Stream lies in how it manipulates the ContentProvider system. Hackers can create “custom intents” to bypass security measures, sending disguised malicious files to other apps through these intents. Once compromised, a vulnerable app can overwrite critical files, which can result in the execution of unauthorized code, data theft, and even hijacking of the app without the user’s knowledge.
“The arbitrary code execution can give a criminal full control over the behavior of an app,” Microsoft said in a blog post a few days ago. “On the other hand, token theft can give a criminal access to user accounts and confidential data.”
Microsoft’s research revealed that Dirty Stream is not an isolated problem, but it affects many popular Android apps due to incorrect implementations of the ContentProvider system. Although some vulnerable apps have been identified and patched, it is difficult to determine the full extent of the threat, as many other legitimate apps could be at risk.
