Slashdot Mirror
Epic's First Fortnite Installer Allowed Hackers To Covertly Download and Install Anything on Users' Android Phones, Google Researchers Say (androidcentral.com)
Epic decided to ditch Google Play Store for its sleeper hit Fortnite. By doing so, while Epic may have saved some money that it would have had to split with Google, it also ran into an issue that it could have avoided had it not parted ways with Google. AndroidCentral reports: Google has just publicly disclosed that it discovered an extremely serious vulnerability in Epic's first Fortnite installer for Android that allowed any app on your phone to download and install anything in the background, including apps with full permissions granted, without the user's knowledge. Google's security team first disclosed the vulnerability privately to Epic Games on August 15, and has since released the information publicly following confirmation from Epic that the vulnerability was patched.
[...] When you go to download "Fortnite" you don't actually download the whole game, you download the Fortnite Installer first. The Fortnite Installer is a simple app that you download and install, which then subsequently downloads the full Fortnite game directly from Epic. The problem, as Google's security team discovered, was that the Fortnite Installer was very easily exploitable to hijack the request to download Fortnite from Epic and instead download anything when you tap the button to download the game. It's what's known as a "man-in-the-disk" attack.
[...] When you go to download "Fortnite" you don't actually download the whole game, you download the Fortnite Installer first. The Fortnite Installer is a simple app that you download and install, which then subsequently downloads the full Fortnite game directly from Epic. The problem, as Google's security team discovered, was that the Fortnite Installer was very easily exploitable to hijack the request to download Fortnite from Epic and instead download anything when you tap the button to download the game. It's what's known as a "man-in-the-disk" attack.
They have an installer for everything, or a "launcher" which is an repackaged web browser that downloads things for you or lets you access their web store for content.
Epic could let you just download directly from your browser but then the walled garden Apple wanna-be aspirations would be gone.
So glad its not walled
I swear, it's like our surveillance devices (phones) are deliberately being compromised. I know it sounds like tinfoil hat territory, but in this day and age it should be rare and unusual news when this kind of thing happens, not a daily occurrence.
I wonder what he has to say.
When you go to download "Fortnite" you don't actually download the whole game, you download the Fortnite Installer first.
so this is actually a common method for a lot of applications in the play store as well. its the lazy app developers "curl|sudo /bin/bash" approach to installation. The difference being many of these other apps paid their play store fe--er, i mean those applications are protected by Google.
Good people go to bed earlier.
or something
Wanna see a stupid way of doing things? https://www.cnbc.com/2018/08/24/trump-paid-michael-cohen-more-than-what-he-stated-in-financial-disclosure.html
Another? https://www.washingtonpost.com/opinions/tax-crimes-brought-down-al-capone-what-about-trump/2018/08/23/996cea04-a710-11e8-8fac-12e98c13528d_story.html
So a big-time publisher decides to avoid the 30 percent Troll (google) tax for their app.. and suddenly Google is there to the rescue to immediately identify an issue that hundreds of publishers already know and have dealt with in the past. This article is directly supporting the bottom line of the walled-garden methodology. The wall-owner is hell-bent on letting world+dog on why their wall is the best wall and if you don't like the wall.. and won't pay for the wall... you are somehow complacent in a lack of good judgment.
Peace out.
Epic Fail?
So a generic installer for a game allows other apps to install additional software.
If an app is using the Fortnight/Epic installer, your phone has already been compromised--pretty much a non-issue
Maybe Google should offer a reverse progressive "store tax", but then the smaller developers would freak out about it. Cost plus 20% would be reasonable, but then Google would reveal its costs to the competitors. 30% of the app price should really be too much for any publicly listed company that wants to generate revenue and profit. Something must be done.
That's just what these RIDICULOUS NAZI FAGGOTS want you to think, their whole thing is being faggots online to demoralize "the left" lol. You're looking at it wrong, it's fucking hilarious.
When Trump hangs they'll know too.
If you buy a cheap piece of crap you get a cheap piece of crap.
If you get a decent device running android its way better than the 5 years behind IOS devices
Leave it to Samsung to write code that allows apps to install without asking you to confirm permissions.
"Everybody's naked underneath" -- The Doctor
including apps with full permissions granted
No doubt that 90% or more of those have no real need for those full permissions. Thanks Google, for allowing, even encouraging such behaviour.
Exactly this and my thoughts.
What this says to me is there's no checks on an application calling files belonging to another within Android.
Granted security apps would need this ability, but by default android should block this and only grant by given permission, and in that case it doesn't seem like the Play Store would have helped as there's other Android apps I've downloaded from the Play Store that do similar things (including with purchasing optional add-ons etc)
Maybe not so much now given someone appears to have lit a fire under Gaben's ass to take security seriously but Steam and many games on it do the same thing. I stopped reporting things like this to Valve because they don't respond nor really give a damn.
The entire Steam installer could be hijacked because not only did they not use SSL for many things, but in places where they did, it wasn't verified. Google really shouldn't be throwing stones anyway when they themselves live in glass homes (no pun intended).
After downloading and running that installer on my Redmi 5A (it failed due to my phone not being in the list of supported devices), I rebooted it and got a weird message that the encrypted partition was corrupted (yes, I do use device encryption).
I had to factory-reset it (as the message suggested), but it's probably compromised now.
Dammit.
Android is broken... but you can fix it yourself with the source code!
How many of these other applications that use similar installers have such vulnerabilities (irrespective of program, or the platform they run on)? This is a trend I'm seeing a lot, "installers" that download the program, rather than just installing them.
If you believe in privacy, and believe you have "nothing to hide" at the same time, you're a goddammed idiot
If I ever got a mod point I'd probably give that one a funny, though there's an element of insight, too. Other aspects of the problems are too obvious for comment.
Instead, I'll just ask again for solution approaches. Obviously signed code from reliable sources is one, but I'd prefer to see the Google stop abusing everyone and start using some of the information in our favor. In the Android app case, that would involve sharing the financial information to help the potential victims recognize the probably crooks.
Freedom = (Meaningful - Coerced) Choice != (Speech | Beer^2), and sad sock puppets' bad mods avail them naught.