Leak In Popular AirDroid App Let Assume Attacker Device

A vulnerability in the popular AirDroid Android app made it possible for attackers to take over vulnerable devices once the user opened a link. AirDroid is a free app for managing an Android smartphone or tablet from Windows, Mac, or the Web.

It also supports GPS tracking, sending text messages, change and manage files from other apps. AirDroid has been downloaded more than 20 million times. The app was found to contain a serious authentication leak allowing a remote attacker could take over someone's phone or tablet. The only thing needed to do this was an attacker sending a malicious link that was opened by a user, for example via a chat application on Windows or Mac. "The attack can be performed silently, meaning that works even when the app is not running. Only the installation on a device is sufficient," says researcher Matt Bryant Bishop Fox .

In case of a successful attack is possible for the attacker to take pictures, follow the GPS location of the victim and contacts from the address book to attack difficult. Everything AirDroid has access to is accessible to an attacker. The vulnerability was reported to the developers of AirDroid who have solved the problem in the most recent version of the app. This fix was published in February , but the vulnerability is only now disclosed. The video below demonstrates the attack.