Google and pals rush to repair Android dev tools, block backdoor risks

Involves big hitter Android Studio, APKTool and more

Security researchers have found several flaws in the developer tools and environments used by Android programmers.

The flaws, if exploited, would enable hackers to exploit the developer environments and insert malicious code (like adware or a cryptominer) into legitimate apps, without the developers of those kosher apps knowing about it.

PHP, image via Shutterstock

Avast urges devs to secure toolchains after hacked build box led to CCleaner disaster


Downloadable and cloud-based tools used by Java/Android programmers to build their companies’ business applications are vulnerable, according to security researchers at Check Point. Fortunately prompt action by the software tool-makers has prevented the repetition of the sort of security screw-up that resulted in Avast inadvertently serving up backdoor versions of its Cleaner tool earlier this year.

More specifically, Check Point’s team has found several vulnerabilities that affect the most common Android integrated development environments (IDEs) – Google’s Android Studio and JetBrains’ IntelliJ IDEA and Eclipse, as well as the major reverse engineering tools for Android applications such as APKTool, the Cuckoo-Droid service and more.

The researchers' first find was in APKTool, where it discovered the configured XML parser did not disable external entity references when parsing an XML file within the program. Check Point said the "vulnerability expose[d] the whole OS file system of APKTool users..."

The team went on to find multiple vulnerable implementations of the XML parser within other projects, specifically the most popular IDEs that are used for building Android applications.

Check Point reported the discovery to APKTool developers and the other IDE companies back in May 2017. Google and JetBrains have verified and acknowledged the security issues and have since deployed a fix to shore up the security of their products.

The Check Point team also contacted APKTool developer and IDE companies who responded by fixing the security issues and released updated versions of their products. ?

Biting the hand that feeds IT ? 1998–2017

  • 1015111305 2018-02-19
  • 6607141304 2018-02-19
  • 5587621303 2018-02-19
  • 6265761302 2018-02-19
  • 6666351301 2018-02-19
  • 3788381300 2018-02-19
  • 9596221299 2018-02-19
  • 1153531298 2018-02-19
  • 8253311297 2018-02-19
  • 1614291296 2018-02-19
  • 107351295 2018-02-18
  • 9487041294 2018-02-18
  • 7763841293 2018-02-18
  • 5836761292 2018-02-18
  • 615581291 2018-02-18
  • 5081161290 2018-02-18
  • 321961289 2018-02-18
  • 776731288 2018-02-18
  • 9075261287 2018-02-18
  • 3005511286 2018-02-18