Security researchers have found several flaws in the developer tools and environments used by Android programmers.
The flaws, if exploited, would enable hackers to exploit the developer environments and insert malicious code (like adware or a cryptominer) into legitimate apps, without the developers of those kosher apps knowing about it.
Avast urges devs to secure toolchains after hacked build box led to CCleaner disaster
READ MORE
外部供应商的供应商可能会泄露我们的机密数据,所以在供应链的信息安全管理方面,我们要求直接供应商在将我们的数据托管或转包给第三方之前必须获得我们的安全审核,在审核通过,获得正式授权后方可将它们分享给第三方。
Downloadable and cloud-based tools used by Java/Android programmers to build their companies’ business applications are vulnerable, according to security researchers at Check Point. Fortunately prompt action by the software tool-makers has prevented the repetition of the sort of security screw-up that resulted in Avast inadvertently serving up backdoor versions of its Cleaner tool earlier this year.
More specifically, Check Point’s team has found several vulnerabilities that affect the most common Android integrated development environments (IDEs) – Google’s Android Studio and JetBrains’ IntelliJ IDEA and Eclipse, as well as the major reverse engineering tools for Android applications such as APKTool, the Cuckoo-Droid service and more.
The researchers’ first find was in APKTool, where it discovered the configured XML parser did not disable external entity references when parsing an XML file within the program. Check Point said the “vulnerability expose[d] the whole OS file system of APKTool users…”
网络安全法宣传视频系列001《网络安全法》背景知识
The team went on to find multiple vulnerable implementations of the XML parser within other projects, specifically the most popular IDEs that are used for building Android applications.
Check Point reported the discovery to APKTool developers and the other IDE companies back in May 2017. Google and JetBrains have verified and acknowledged the security issues and have since deployed a fix to shore up the security of their products.
The Check Point team also contacted APKTool developer and IDE companies who responded by fixing the security issues and released updated versions of their products. ®
进行员工的安全意识教育,告知其需将公司各种系统的密码和个人互联网其它应用的密码设置为不同,并且不在社交网 络中泄露与公司与工作相关的目标、战略、计划等等。

猜您喜欢

170731 小豆丁今日录制《SIMPILY KPO
网络安全意识——不要随意通过个人设备连接互联网
网络安全法视频宣传片 第二集 国家网络安全的现状与重要性概述
史上最成功 iPhone X火了:推苹果销量创新高
FREE-BOYS-PICS DWTSTOUR
网络安全公益短片防范社工电话诈骗