A new security breach in the Android system was announced on Monday (2). The vulnerability, called "StrandHogg", could show fake login pages to perform scams from phishing and reach bank accounts. The bug can also allow fake apps to "hijack" legitimate applications and perform malicious tasks instead.
According to the report Promon, a Norwegian company specializing in digital protection, users trust the familiar software and, without being aware that it is fraudulent, end up granting permissions for hackers to break into the device. The security breach is present in all versions of the Google system.
IPhone messaging apps have sexual content, racism and bullying
The move that the malicious app makes to trick the user Photo: Reproduo / Promon
Want to buy cell phones, TV and other discounted products? Meet Compare dnetc
According to the information provided by Promon, StrandHogg is a flaw found specifically in Android's multitasking feature, in a screen switching method called "task repair". At that moment, when the user touches the icon of a legitimate app, the fake appears in the foreground of the screen. Upon not realizing the visual difference between the two, the user ends up granting entry permissions or providing his personal data.
The report indicates that no version of the Google operating system is free of the flaw, including the most recent, Android 10. Because of this, the Promon tested the 500 most downloaded applications from the Google Play Store and found that they all have the potential to be exploited by the detected vulnerability, even if the fault is not necessarily theirs.
Installed malicious apps lose unexpected access permissions Photo: Reproduo / Promon
Although the BBC bring the word of Google saying that it has suspended the mentioned apps and is working on improvements to Google Play Protect, the chief technology officer at PromonTom Hansen told the British website that the flaw can still be exploited on Android 10 screens. Researchers informed the operating system developers about the bug more than 90 days ago.
THE Promon he discovered StrandHogg after a financial sector company in the Czech Republic, for which he provides security consultancy, for having informed that some banks in that country had several current customer accounts cleared. After analyzing the case closely, analysts found that up to 36 different apps may have exploited the vulnerability.
For the user, for now, care should be taken not to provide data and permissions when they are not needed, and to always read what is written on the screen and what the app is really asking to do. If you've been using that app for months and it never asked for your data before, why would you be asking for it now? something to consider. Finally, it is always worth keeping antivirus software installed on your mobile phone to see the best options for Android in 2019.
How to remove viruses on an Android phone
