Researchers built a simple proof of concept (PoC) and found that “any app can invoke this broadcast component,” he said. “It receives the action ‘.install_completed’ and Extra Intent then calls the startActivity() function.” “We delved into the app’s code and found that it declares the broadcast receiver as ‘.DefaultReceiver,’” Duan explained in the post. Trend Micro also notified Google of the app’s issues, which lie in several flaws in its code that too easily give third parties permissions to take over legitimate app features, overwrite existing app files or even take over Android storage shared by multiple apps to execute malicious code, he said. “We decided to disclose our research three months after reporting this since many users might be affected by this attack, because the attacker can steal sensitive data and do anything with the apps’ permission,” Echo Duan, a mobile threats analyst for Trend Micro, wrote in the report.

Softonic, a company based in Barcelona, Spain, is the app’s developer and distributor. However, the flaws remain unpatched, according to a report posted online Monday. They were identified and reported to the app maker three months ago by researchers at Trend Micro. The flaws exist in an app called SHAREit, which allows Android app users to share files between friends or devices. An Android app that’s been downloaded more than 1 billion times is riddled with flaws that can let attackers hijack app features or overwrite existing files to execute malicious code, or launch man-in-the-disk (MiTD) attacks on people’s devices, researchers discovered.

Ushareit app