Android apps can be used to automatically update latencies when reading books

Android audio reader software "" produced by www.yytingting.com does not have a digital signature or authentication when it is automatically updated. If it is cheated by arp or DNS hijacking, can be used to replace with other apk, which may eventually result in remote code execution. Step 1 deploy the android packet capture environment. It is known that the automatic update detection address of this software is: http://www.yytingting.com/android_app/version.txt step2. visit this page according to the returned content, you can generally determine 58 is the latest version, used to compare with the existing version. The new version is shown below. Therefore, we speculate that we can use DNS hijacking and other means to forge the returned page and replace the APK with the trojan we wrote. Step3. use the qq installation package for testing


As you can see, after the update is downloaded, the QQ installation package is displayed. Exploitation successful.Solution:1. It is best to use a signature for software updates. 2. It is best to encrypt the update process.