Multiple unpatched vulnerabilities have been discovered in three
Android apps that allow a smartphone to be used as a remote
keyboard and mouse.
The apps in question are Lazy Mouse, PC Keyboard,
and Telepad, which have been cumulatively downloaded over
two million times from the Google Play Store. Telepad is no longer
available through the app marketplace but can be downloaded from
its website.
- Lazy Mouse (com.ahmedaay.lazymouse2 and
com.ahmedaay.lazymousepro) - PC Keyboard (com.beapps.pckeyboard)
- Telepad (com.pinchtools.telepad)
While these apps function by connecting to a server on a desktop
and transmitting to it the mouse and keyboard events, the Synopsys
Cybersecurity Research Center (CyRC) found[1]
as many as seven flaws related to weak or missing authentication,
missing authorization, and insecure communication.
The issues (from CVE-2022-45477 through CVE-2022-45483), in a
nutshell, could be exploited by a malicious actor to execute
arbitrary commands sans authentication or harvest sensitive
information by exposing users’ keystrokes in cleartext.
The Lazy Mouse server further suffers from a weak password
policy and doesn’t implement rate limiting, enabling remote
unauthenticated attackers to trivially brute-force the PIN and
execute rogue commands.
It’s worth noting that none of the apps have received any
updates for over two years, making it imperative that users remove
the apps with immediate effect.
“These three applications are widely used but they are neither
maintained nor supported, and evidently, security was not a factor
when these applications were developed,” Synopsys security
researcher Mohammed Alshehri said.
Found this article interesting? Follow us on Twitter [2]
and LinkedIn[3]
to read more exclusive content we post.
Read more https://thehackernews.com/2022/12/watch-out-these-android-keyboard-apps.html