Categories: News
Tags: FBI

Tags:  warning

Tags:  beta-testing

Tags:  malicious code

Tags:  crypto recovery

Tags:  scammers

The FBI has issued a warning about two related types of fraud, malicious beta-testing apps and crypto recovery schemes.



(Read more...)




The post Beware malware posing as beta versions of legitimate apps, warns FBI appeared first on Malwarebytes Labs.

The FBI has issued a warning that cybercriminals are embedding malicious code in mobile beta-testing apps in attempts to defraud potential victims. The victims are typically contacted on dating sites and social media, and in some cases they are promised incentives such as large financial payouts.

Beta-testing apps are new versions of software that are undergoing their final tests and aren't quite ready to be officially released. In the legitimate software ecosystem, beta testing gives users a chance to improve their favorite apps and get early access to new features. For criminals, "beta-testing" apps offer a plausible reason for vicitms to donwload software from unsafe places, away from the usual app stores, without raising their suspicions.

To make the apps look legitimate the criminals use familiar looking names, images, or descriptions that are similar to popular apps. Embedded in the apps  is malicious code used to defraud the victim or compromise the device. According to the FBI:

> “The malicious apps enable theft of personally identifiable information (PII), financial account access, or device takeover.”

The agency says it’s aware of fraud schemes where the victims are contacted and directed to download mobile beta-testing apps, such as cryptocurrency exchanges, that steal money instead of investing it.

In an earlier warning the FBI focused on scammers that haunt forums and comments sections, looking for victims who have lost cryptocurrency to fraud, scams, and theft. The scammers claim to provide cryptocurrency tracing and promise to recover lost funds.

_Example of an (intercepted) attempt to post recovery a advertisement in our blog comments_

These recovery scheme fraudsters will charge an up-front fee and either cease communication after receiving the initial deposit, or they will produce an incomplete or inaccurate tracing report and claim they need additional fees to recover the funds.

The fraudsters will even go as far as to claim they are affiliated with law enforcement or legal services to appear legitimate. It is important to realize that private sector recovery companies cannot issue seizure orders to recover cryptocurrency.

**Stay safe**

Beta-testing can be fun and rewarding, but check that you are testing the app from a legitimate source and trusted developer. For example, Malwarebytes offers their beta downloads on their own forums.

Do not send payment to someone you have only spoken to online, even if you believe you have established a relationship with them. Scammers specialize in making you think that.

Do not provide personal or financial information in email or messages, and do not respond to email or message solicitations, including links.

Do not download or use suspicious looking apps as a tool for investing unless you can verify the legitimacy of the app.

Shy away from advertisements for cryptocurrency recovery services. Research the advertised company and beware if the company uses vague language, has a minimal online presence, and makes promises regarding an ability to recover funds. Do not make things even worse.

Law enforcement does not charge victims a fee for investigating crimes. If someone claims an affiliation with the FBI, contact your local FBI field office to confirm.

As the FBI pointed out:

> “Cryptocurrency exchanges only freeze accounts based on internal processes or in response to legal process.”

**We don’t just report on Android security—we provide it**

Cybersecurity risks should never spread beyond a headline. Keep threats off your Android devices by downloading Malwarebytes for Android today.

Beware malware posing as beta versions of legitimate apps, warns FBI

Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to lead the vulnerable App to access an arbitrary website.

Published:2023/08/09  Last Updated:2023/08/09

**Overview**

"Rikunabi NEXT" App for Android provided by Recruit Co., Ltd. fails to restrict custom URL schemes properly.

**Products Affected**

*   "Rikunabi NEXT" App for Android prior to ver. 11.5.0

**Description**

"Rikunabi NEXT" App for Android provided by Recruit Co., Ltd. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly (CWE-939) which may be exploited to direct the App to access any sites.

**Impact**

A remote attacker may lead a user to access an arbitrary website via the vulnerable App. As a result, the user may become a victim of a phishing attack.

**Solution**

**Update the Application**  
Update the application to the latest version according to the information provided by the developer.  
The developer has released the following version that fixes the vulnerability.

*   "Rikunabi NEXT" App for Android ver. 11.5.0

**Vendor Status**

Vendor

Status

Last Update

Vendor Notes

Recruit Co., Ltd.

Vulnerable

2023/08/09

**References**

**JPCERT/CC Addendum**

**Vulnerability Analysis by JPCERT/CC**

CVSS v3 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Attack Vector(AV)

Physical (P)

Local (L)

Adjacent (A)

Network (N)

Attack Complexity(AC)

High (H)

Low (L)

Privileges Required(PR)

High (H)

Low (L)

None (N)

User Interaction(UI)

Required (R)

None (N)

Scope(S)

Unchanged (U)

Changed (C)

Confidentiality Impact(C)

None (N)

Low (L)

High (H)

Integrity Impact(I)

None (N)

Low (L)

High (H)

Availability Impact(A)

None (N)

Low (L)

High (H)

CVSS v2 AV:N/AC:M/Au:N/C:N/I:P/A:N

Access Vector(AV)

Local (L)

Adjacent Network (A)

Network (N)

Access Complexity(AC)

High (H)

Medium (M)

Low (L)

Authentication(Au)

Multiple (M)

Single (S)

None (N)

Confidentiality Impact(C)

None (N)

Partial (P)

Complete (C)

Integrity Impact(I)

None (N)

Partial (P)

Complete (C)

Availability Impact(A)

None (N)

Partial (P)

Complete (C)

**Credit**

Nao Komatsu of LAC Co., Ltd. reported this vulnerability to IPA.  
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

**Other Information**

CVE-2023-39507: "Rikunabi NEXT" App for Android fails to restrict custom URL schemes properly

Use after free in Offline in Google Chrome on Android prior to 116.0.5845.96 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

**Chrome Releases**

Release updates from the Chrome team

CVE-2023-2312: Stable Channel Update for Desktop

By Habiba Rashid
Emergence of Gigabud Banking Trojan Threatens Financial Institutions Globally.
This is a post from HackRead.com Read the original post: New Gigabud Android RAT Bypasses 2FA, Targets Financial Orgs

*   **New Malware Variant:** Gigabud introduces a fresh wave of sophisticated cyber danger.

*   **Global Operation:** Gigabud has targeted at least 25 companies, financial institutions, and government departments across several countries.

*   **Bypasses 2FA:** Gigabud malware can adeptly circumvent two-factor authentication (2FA).

*   **Targets Financial Giants:** Financial institutions face a growing threat from Gigabud’s focused attacks.

*   **Gigabud family:** Gigabud.Loan variant presents itself as a fake loan application, luring victims with promises of low-interest loans.

*   **Emerging Cyber Risk:** The rise of Gigabud underscores the evolving landscape of financial cyber threats.

A new banking trojan named Gigabud has emerged as a formidable adversary, posing a persistent danger to financial institutions worldwide. Originating as an Android Remote Access Trojan (**RAT**), Gigabud first came to the attention of security experts in September 2022 when it targeted a Thailand-based financial organization and its customers across the Asia-Pacific region.

Group-IB’s experts, in response to a customer’s request, undertook a comprehensive analysis of the malware to decode its intricate tactics. The defining feature of Gigabud is its cautious approach to executing malicious actions.

Unlike conventional malware that acts immediately upon infiltration, Gigabud waits for user authorization within the malicious application, a strategy that makes it notably elusive. Instead of relying on HTML overlay attacks, Gigabud employs screen recording to gather sensitive information, further complicating its detection.

One standout feature of Gigabud is its use of accessibility services, which allows it to perform actions on the victim’s device remotely. This capability, known as “TouchAction,” enables the attacker to perform gestures on the user’s device, giving them the power to evade defence mechanisms, including two-factor authentication (**2FA**).

Gigabud RAT has targeted at least 25 companies, financial institutions, and government departments across several countries, aiming to mimic their identities and deceive users.

Researchers also uncovered a parallel threat within the Gigabud family: Gigabud.Loan. This variant presents itself as a fake loan application, luring victims with promises of low-interest loans. Once users engage with the app, they are coerced into providing sensitive personal information, which can later be exploited by the threat actors.

Gigabud.Loan’s modus operandi involves impersonating fictional financial institutions from various countries, such as Thailand, Indonesia, and Peru.

The distribution strategy for both Gigabud.RAT and Gigabud.Loan centers around phishing websites. These websites are disseminated through tactics like “smishing,” where victims are sent misleading messages via instant messengers, SMS, or social networks, leading them to malicious links. In certain cases, the malware is even delivered directly through messages on platforms like **WhatsApp**.

Watch as Group-IB’s researchers looks into Gigabud RAT

Over the course of 2022 to 2023, Group-IB’s researchers detected over 400 Gigabud RAT samples and more than 20 Gigabud.Loan samples using advanced hunting techniques. 

To counteract the threat posed by Gigabud, **Group-IB suggests** a multi-pronged defence strategy. Organizations should prioritize proactive monitoring of user sessions, prioritize client education on safe online practices, and employ digital protection tools.

Users, in turn, are advised to exercise caution when clicking on links, refrain from downloading risky apps, and utilize **reliable VPNs** on public Wi-Fi networks.

**RELATED ARTICLES**

1.  FakeTrade Android Malware Attack Steals Crypto Wallet Data
2.  Android banking malware distributed with fake Google reCAPTCHA
3.  New Android banking malware Xenomorph found in Play Store apps
4.  Experts concerned over emergence of Android banking trojan S.O.V.A.
5.  Iranian Stalkerware ‘Spyhide’ Steals Data from 60,000 Android Devices

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

New Gigabud Android RAT Bypasses 2FA, Targets Financial Orgs

Account holders of over numerous financial institutions in Thailand, Indonesia, Vietnam, the Philippines, and Peru are being targeted by an Android banking malware called Gigabud RAT.
"One of Gigabud RAT's unique features is that it doesn't execute any malicious actions until the user is authorized into the malicious application by a fraudster, [...] which makes it harder to detect," Group-IB

Account holders of over numerous financial institutions in Thailand, Indonesia, Vietnam, the Philippines, and Peru are being targeted by an Android banking malware called **Gigabud RAT**.

"One of Gigabud RAT's unique features is that it doesn't execute any malicious actions until the user is authorized into the malicious application by a fraudster, \[...\] which makes it harder to detect," Group-IB researchers Pavel Naumov and Artem Grischenko said.

"Instead of using HTML overlay attacks, Gigabud RAT gathers sensitive information primarily through screen recording."

Gigabud RAT was first documented by Cyble in January 2023 after it was spotted impersonating bank and government apps to siphon sensitive data. It's known to be active in the wild since at least July 2022.

The Singapore-based company said it also identified a second variant of the malware minus the RAT capabilities. Dubbed Gigabud.Loan, it comes under the guise of a loan application that's capable of exfiltrating user-input data.

"The targets were individuals lured into filling out a bank card application form to obtain a low-interest loan," the researchers said. "The victims are convinced to provide personal information during the application process."

Both malware versions are spread via phishing websites, the links to which are delivered to victims via SMS or instant messages on social media networks. Gigabud.Loan is also distributed directly in the form of APK files sent through messages on WhatsApp.

Targets who are approached on social media are often coerced into visiting the sites under the pretext of completing a tax audit and claiming a refund.

While Android devices have the "Install from Unknown Sources" setting disabled by default as a security measure to prevent the installation of apps from untrusted sources, the operating system allows other apps on installed on the device, such as web browsers, email clients, file managers, and messaging apps, to request the "REQUEST\_INSTALL\_PACKAGES" permission.

Should a user grant permission to such apps, it allows the threat actors to install rogue APK files while bypassing the "Install from Unknown Sources" option.

Gigabud functions a lot like other Android banking trojans by requesting for accessibility services permissions to perform screen capturing and logging keystrokes. It's also equipped to replace bank card numbers in clipboards and perform automated fund transfers through remote access.

On the other hand, Gigabud.Loan functions as a tool to collect personal information such as full name, identity number, national identity document photo, digital signature, education, income info, bank card information, and phone number under the guise of submitting a loan request to the bank.

The findings follow the discovery of 43 rogue apps on the Google Play Store that load ads while the device's screen is turned off. The apps, with cumulative downloads of 2.5 million, have since been taken down or updated by the developers to remove the ad fraud component.

McAfee said the adware, once installed, seeks users' permissions to exclude the apps when saving battery and allow it to draw over other apps, effectively opening the door to further malevolent attacks, such as loading ads in the background and displaying phishing pages.

The ad fraud library used by the apps also employs delay tactics to evade detection and can be remotely modified by the operators using the Firebase messaging service, lending it an additional layer of complexity.

The disclosure comes as the U.S. Federal Bureau of Investigation (FBI) is warning of an increase in scammers pretending to be recovery and tracing companies that can help victims of cryptocurrency investment scams regain lost assets.

"Recovery scheme fraudsters charge an up-front fee and either cease communication with the victim after receiving an initial deposit or produce an incomplete or inaccurate tracing report and request additional fees to recover funds," the FBI said.

On top of that, the agency has cautioned that cybercriminals are embedding nefarious code in mobile beta-testing apps masquerading as legitimate cryptocurrency investment apps to defraud potential victims by facilitating the theft of personally identifiable information (PII) and financial account data.

"The apps may appear legitimate by using names, images, or descriptions similar to popular apps," the agency explained. "Cyber criminals often use phishing or romance scams to establish communications with the victim, then direct the victim to download a mobile beta-testing app housed within a mobile beta-testing app environment, promising incentives such as large financial payouts."

In these schemes, threat actors contact potential victims on dating and social networking apps and build trust with the ultimate aim to entice them into downloading pre-release versions of the apps.

"The victims enter legitimate account details into the app, sending money they believe will be invested in cryptocurrency, but instead the victim funds are sent to the cyber criminals," the FBI said.

It's worth noting that the abuse of Apple's TestFlight beta testing framework to conduct pig butchering scams was highlighted by cybersecurity firm Sophos last year.

Recent waves of the campaign, also called CryptoRom, have weaponized Apple's enterprise and developer ad-hoc app distribution schemes to deliver bogus crypto apps in a bid to slip past restrictions that prevent users from downloading iOS apps outside of the App Store.

In other instances, a seemingly innocuous app is trojanized after it is approved and published to the Apple and Google app storefronts by altering the remote code to point to an attacker-controlled server to introduce malicious behavior.

Found this article interesting? Follow us on Twitter __ and LinkedIn to read more exclusive content we post.

Gigabud RAT Android Banking Malware Targets Institutions Across Countries

By Waqas
Amid the data breach, Discord.io has shut down all of its operations indefinitely in the foreseeable future.
This is a post from HackRead.com Read the original post: Discord.io Admits Data Breach: Info of 760K Users Sold Online

*   **Massive Discord.io Data Breach Unveiled:** Hacker “Akhirah” exposes a vast data breach on Discord.io, an unofficial service that provides redirect and invite links to Discord servers.

*   **Over 760,000 Users Impacted:** The breach, occurring on August 14, 2023, has jeopardized the personal information of more than 760,000 users.

*   **Discord.io Halts Operations:** In response to the breach, Discord.io has taken the unprecedented step of shutting down its operations indefinitely.

*   **Hacker Talks to Hackread.com:** Akhirah wants Discord.io to remove malicious content from the site in order to put an end to the database sale.

*   **Exposed Data Includes Sensitive Details:** Stolen information from the breach includes usernames, Discord IDs, email addresses, and salted and hashed passwords.

*   **Urgent Call to Action:** Discord.io urges users to update their passwords to mitigate the impact of the breach, while financial information remains reportedly untouched. Hackread.com is actively seeking more details from the hacker to provide comprehensive insights into the incident.

A hacker using the pseudonym “Akhirah” has unleashed a massive data breach against Discord.io, a non-official service known for providing redirect and invite links to Discord servers. The data breach, which occurred on Monday, August 14, 2023, has put the personal information of approximately 760,000 users at grave risk.

Currently, the database is being sold on the **new version of Breach Forums** that surfaced recently under the leadership of the infamous ShinyHunter hackers.

Discord.io database on Breach Forums (Screenshot: Hackread.com)

Initial glimpses into the database are troubling, as usernames, Discord IDs, email addresses, and salted and hashed passwords have all fallen prey to this data breach. Although the hashed nature of passwords may offer a thin silver lining, the potential for decryption looms large, underscoring the urgent need for users to fortify their defences which is why Discord.io has urged users to reset and update their passwords.

Additionally, Discord.io maintains that no financial data has been infiltrated or exposed in this breach. However, while the extent of this breach is still unfolding, Discord.io has taken a drastic step in response. The service, which was already skating on thin ice, has decided to cease all operations indefinitely in the “foreseeable future.”

Visitors to Discord.io are now greeted with a message detailing the severity of the breach. The company, in an act of transparency, has laid out the compromised data fields. This initiative aims to provide clarity to affected users about what information is now exposed and what remains untouched in the cataclysmic wake of this incident.

> “We have cancelled existing premium subscriptions and we’ll be reaching out as soon as possible on an individual basis. As of this message, we have not yet been contacted by the people responsible for this breach nor have we reached out to them. As far as we currently know, the database itself has not yet been shared publicly.”
> 
> Discord.io

Here is a screenshot from Discord.io admitting the data breach and providing in-depth details about what data was stolen and which information remained untouched.

Homepage of Discord.io right now (Screenshot: Hackread.com)

**Interview with the hacker Akhirah**

Akhirah responded to Hackread.com, and we managed to ask him a couple of questions about the breach. Akhirah claims he is least interested in selling data; however, he wants Discord.io to remove malicious content from their site and get in touch with him to resolve the issue – no retribution or bounty required.

Hackread.com: Discord.io has shut down its operations. Would you share your thoughts on that? and share some details of how did you manage to breach them, and if you have access to their payment section as well?

Akhirah: First I have to say I hate Discord and its audience, I think most of them are paedophiles, I put the data on the market to sell but I’m not sure about it, and I haven’t sold it to anyone yet, but there are so many demands, I want to talk to the management of discord.io and agree on some issues. Plus, I don’t have access to payment-related data, just stuff I’ve shared an example of

Hackread.com: By talking to them do you mean resolving the issue and discarding the data or asking them for some sort of retribution?

Akhirah: I want to talk to him about sissy, femboy etc content and blacklisting of paedophile talks from now on.

Hackread.com: So if they remove the malicious content and people you would agree to safely discard the data and that would be the end of it?

Akhirah: Yes, that can be said. Too many children want to buy this data, it’s true that I sell data, but I’m not sure I want to sell this data. I just want to talk and agree with the admin about the sensitive issues I mentioned.

Hackread.com: Have you contacted Discord.io?

Akhirah: No, they are the victims right now and they didn’t try to talk to me, I invite them to talk, I would appreciate it if you could share this on your site.

Discord.io becomes the latest platform to shut down due to data breaches. Just a week ago, LetMeSpy Android Spyware Service also **announced its permanent closure** following a hacker’s successful breach and access to user data.

**RELATED ARTICLES**

1.  Teen “Hackers” on Discord Selling Malware for Quick Cash
2.  Roblox Data Breach: PII of Thousands of Developers Stolen
3.  Pink Drainer Posed as Journalists, Stole $3M from Discord Users
4.  Data Breach at New BreachForums: 4,000 members’ data leaked
5.  Original BreachForums Breached, PII Data of 210K Users Sold Online

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Discord.io Admits Data Breach: Info of 760K Users Sold Online

In setMediaButtonBroadcastReceiver of MediaSessionRecord.java, there is a possible permanent DoS due to resource exhaustion. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.



)\]}' { "commit": "06e772e05514af4aa427641784c5eec39a892ed3", "tree": "0a82d1a5e5179db0b679917ee76e2e43ca63110f", "parents": \[ "a65429742caf05205ea7f1c2fdd1119ca652b810" \], "author": { "name": "Iván Budnik", "email": "ivanbuper@google.com", "time": "Tue Apr 04 17:58:26 2023 +0000" }, "committer": { "name": "Android Build Coastguard Worker", "email": "android-build-coastguard-worker@google.com", "time": "Thu Jun 08 20:34:05 2023 +0000" }, "message": "Validate ComponentName for MediaButtonBroadcastReceiver\\n\\nThis is a security fix for b/270049379.\\n\\nBug: 270049379\\nTest: atest CtsMediaMiscTestCases\\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:c573c83a2aa36ca022302f675d705518dd723a3c)\\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:ba546a306217389a8ff9e5e948612651fd496081)\\nMerged-In: I05626f7abf1efef86c9e01ee3f077d7177d7f662\\nChange-Id: I05626f7abf1efef86c9e01ee3f077d7177d7f662\\n", "tree\_diff": \[ { "type": "modify", "old\_id": "84ecc06d172f9922beef8a77949df5eac5e14938", "old\_mode": 33188, "old\_path": "media/java/android/media/session/MediaSession.java", "new\_id": "09eff9e4e13aa7be73869dd7f92050300a0a13d5", "new\_mode": 33188, "new\_path": "media/java/android/media/session/MediaSession.java" }, { "type": "modify", "old\_id": "1bd50632ccbf7258d2addfb5667d791f877fcbe3", "old\_mode": 33188, "old\_path": "services/core/java/com/android/server/media/MediaSessionRecord.java", "new\_id": "cc4895ffaf24a7a3e0bab6d4c364801ea7b72d14", "new\_mode": 33188, "new\_path": "services/core/java/com/android/server/media/MediaSessionRecord.java" } \] }

CVE-2023-21280

In visitUris of RemoteViews.java, there is a possible cross-user media read due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.



)\]}' { "commit": "155b14600fb13553a47b4e45fe0acd163da07453", "tree": "3cf9fcc3aa0cdf2ce9f32a1f32b537fd445acc9e", "parents": \[ "70ec64dc5a2a816d6aa324190a726a85fd749b30" \], "author": { "name": "Ioana Alexandru", "email": "aioana@google.com", "time": "Tue May 23 16:26:41 2023 +0000" }, "committer": { "name": "Android Build Coastguard Worker", "email": "android-build-coastguard-worker@google.com", "time": "Thu Jun 08 20:34:18 2023 +0000" }, "message": "Check URIs in sized remote views.\\n\\nBug: 277741109\\nTest: atest RemoteViewsTest\\n(cherry picked from commit ae0d45137b0f8ea49a085bbce4d39f901685c4a5)\\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:902f020bc81e5b584d5cb0276568b888a728fc4a)\\nMerged-In: Iceb33606da3a49b9638ab21aeae17a168c1b411a\\nChange-Id: Iceb33606da3a49b9638ab21aeae17a168c1b411a\\n", "tree\_diff": \[ { "type": "modify", "old\_id": "25f97ab0994486e0671a4cc5f2b3d844db1a342e", "old\_mode": 33188, "old\_path": "core/java/android/widget/RemoteViews.java", "new\_id": "406c7694e5033d2967e0f893224fb9f4218f3e61", "new\_mode": 33188, "new\_path": "core/java/android/widget/RemoteViews.java" }, { "type": "modify", "old\_id": "350b7fc2926f728a097be4d0ffbd0a25db4f0e2f", "old\_mode": 33188, "old\_path": "core/tests/coretests/src/android/widget/RemoteViewsTest.java", "new\_id": "e0cccf2f52008ebfb7a63b47baa2e5eb417e5fe9", "new\_mode": 33188, "new\_path": "core/tests/coretests/src/android/widget/RemoteViewsTest.java" } \] }

CVE-2023-21279

In multiple locations, there is a possible way to obscure the microphone privacy indicator due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.



)\]}' { "commit": "49773f9d871dd8975128fccf71513928a5a97345", "tree": "0b2eafd1cd6da9c436a3632b188b8c94e71114d7", "parents": \[ "06e772e05514af4aa427641784c5eec39a892ed3" \], "author": { "name": "Johannes Gallmann", "email": "gallmann@google.com", "time": "Mon May 22 10:21:02 2023 +0200" }, "committer": { "name": "Android Build Coastguard Worker", "email": "android-build-coastguard-worker@google.com", "time": "Thu Jun 08 20:34:09 2023 +0000" }, "message": "Fix PrivacyChip not visible issue\\n\\nBug: 281807669\\nTest: Manual, i.e. posting the following sequence of events (within few milliseconds) to the scheduler and observe the behaviour with and without the fix: Mic in use -\\u003e Mic not in use -\\u003e Mic in use\\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:a45e1d045770eaabfdbf0e1212c9eb84caf1d565)\\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:20ea049a4a52dbc8d4e5ed957a2b6b9aa02a2f34)\\nMerged-In: I9851e6ed4cb956d0459ef56251eb0ef3210764b8\\nChange-Id: I9851e6ed4cb956d0459ef56251eb0ef3210764b8\\n", "tree\_diff": \[ { "type": "modify", "old\_id": "4e1404d0637b027eb488f3f6702b4afd7311e95a", "old\_mode": 33188, "old\_path": "packages/SystemUI/src/com/android/systemui/statusbar/events/StatusEvent.kt", "new\_id": "31d196b542d718e03798522869549cb356fcc96c", "new\_mode": 33188, "new\_path": "packages/SystemUI/src/com/android/systemui/statusbar/events/StatusEvent.kt" } \] }

CVE-2023-21278

In visitUris of RemoteViews.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.



)\]}' { "commit": "9b58aee2a4528c60b0aa2540bd0f48d2871d2dc7", "tree": "dd725ead57947a7429e13b3f6303e33a84b421b7", "parents": \[ "155b14600fb13553a47b4e45fe0acd163da07453" \], "author": { "name": "Ioana Alexandru", "email": "aioana@google.com", "time": "Thu May 25 11:43:43 2023 +0000" }, "committer": { "name": "Android Build Coastguard Worker", "email": "android-build-coastguard-worker@google.com", "time": "Thu Jun 08 20:34:21 2023 +0000" }, "message": "Visit URIs in themed remoteviews icons.\\n\\nBug: 281018094\\nTest: atest RemoteViewsTest NotificationVisitUrisTest\\n(cherry picked from https://googleplex-android-review.googlesource.com/q/commit:634a69b7700017eac534f3f58cdcc2572f3cc659)\\nMerged-In: I2014bf21cf90267f7f1b3f370bf00ab7001b064e\\nChange-Id: I2014bf21cf90267f7f1b3f370bf00ab7001b064e\\n", "tree\_diff": \[ { "type": "modify", "old\_id": "406c7694e5033d2967e0f893224fb9f4218f3e61", "old\_mode": 33188, "old\_path": "core/java/android/widget/RemoteViews.java", "new\_id": "04e46e8b031bc0a9ceebea2ac37cd98b35f6760e", "new\_mode": 33188, "new\_path": "core/java/android/widget/RemoteViews.java" }, { "type": "modify", "old\_id": "e0cccf2f52008ebfb7a63b47baa2e5eb417e5fe9", "old\_mode": 33188, "old\_path": "core/tests/coretests/src/android/widget/RemoteViewsTest.java", "new\_id": "a8f2b1d22aed7980b4635ef68e943fd687257bfd", "new\_mode": 33188, "new\_path": "core/tests/coretests/src/android/widget/RemoteViewsTest.java" } \] }

Tag

#android