Security researchers have found several flaws in the developer tools and environments used by Android programmers.
The flaws, if exploited, would enable hackers to exploit the developer environments and insert malicious code (like adware or a cryptominer) into legitimate apps, without the developers of those kosher apps knowing about it.
Avast urges devs to secure toolchains after hacked build box led to CCleaner disaster
Downloadable and cloud-based tools used by Java/Android programmers to build their companies’ business applications are vulnerable, according to security researchers at Check Point. Fortunately prompt action by the software tool-makers has prevented the repetition of the sort of security screw-up that resulted in Avast inadvertently serving up backdoor versions of its Cleaner tool earlier this year.
More specifically, Check Point’s team has found several vulnerabilities that affect the most common Android integrated development environments (IDEs) – Google’s Android Studio and JetBrains’ IntelliJ IDEA and Eclipse, as well as the major reverse engineering tools for Android applications such as APKTool, the Cuckoo-Droid service and more.
The researchers’ first find was in APKTool, where it discovered the configured XML parser did not disable external entity references when parsing an XML file within the program. Check Point said the “vulnerability expose[d] the whole OS file system of APKTool users…”
The team went on to find multiple vulnerable implementations of the XML parser within other projects, specifically the most popular IDEs that are used for building Android applications.
Check Point reported the discovery to APKTool developers and the other IDE companies back in May 2017. Google and JetBrains have verified and acknowledged the security issues and have since deployed a fix to shore up the security of their products.
The Check Point team also contacted APKTool developer and IDE companies who responded by fixing the security issues and released updated versions of their products. ®
进行员工的安全意识教育,告知其需将公司各种系统的密码和个人互联网其它应用的密码设置为不同,并且不在社交网 络中泄露与公司与工作相关的目标、战略、计划等等。


170731 小豆丁今日录制《SIMPILY KPO
网络安全法视频宣传片 第二集 国家网络安全的现状与重要性概述
史上最成功 iPhone X火了:推苹果销量创新高