Hundreds of popular Android apps for mobile devices still contain vulnerabilities that allow remote code execution even if updated by users, researchers at Check Point have found.
The latest versions of popular apps hosted on the Google Play Store contain known vulnerabilities that allow remote code attacks.
Most people believe that if they update their mobile apps to the latest version, they correct critical vulnerabilities, but it is not.
According to researchers, who have discovered that older code, including known vulnerabilities, these vulnerabilities still exist in hundreds of popular apps on the Google Play Store, including Facebook and Instagram.
In a one-month study, CheckPoint reviewed the latest versions of these and other mobile applications for three known remote control (RCE) vulnerabilities dating back to 2014, 2015 and 2016.
The researchers assigned two signatures to each vulnerability, and ran a static engine to scan hundreds of mobile apps in the Google Play Store to see if old code and vulnerabilities still exist in the latest version of the app.
According to Check Point, research proves that updates sent by app manufacturers are not able to protect mobile devices from threats.
The report said: Theoretically actors can steal and modify Facebook posts, extract location data from Instagram, and read SMS messages in the WeChat application.
The problem lies in the very old code used in the form of reusable components called native libraries, which still work on Android applications and can not usually be fixed using the update.
There are only three vulnerabilities, all of which have been fixed for more than two years, that make hundreds of applications vulnerable to remote code attacks, the researchers wrote.
The app may continue to use the older version of code even after years of vulnerability detection and ostensibly fixing, and Check Point informed companies responsible for apps they found in their study that they were still at risk, including Google.
The security company is urging people to install an anti-virus application that in turn monitors high-risk applications on their mobile devices.
A Google spokesman said: Check Point contacted us about this problem, and we are currently investigating the results of the study, and we recently expanded the scope of the security rewards program for the Android store in order to encourage more cooperation between application developers and the security community.
A spokesman for Facebook opposed the study, saying that people who use Facebook services are not vulnerable to any of the problems highlighted by Check Point, because of the design of our systems that use this code.
Source : Check Point
