There are many good reasons why it’s often best for organizations looking to deploy or consume Android applications, to use the Google Play mobile apps store.
One such reason has been recently highlighted with the discovery of a high profile flaw in one of the world’s most popular games. Epic Games’ Fortnite, is played by millions of players around the world on different platforms, including Android. Fortnite however isn’t available on the Google Play store for Android, rather Epic Games decided to bypass Google and use a third party store to deliver its game. That fact however didn’t stop Google from discovering a serious vulnerability that was publicly disclosed on Aug. 25.
“Any app with the WRITE_EXTERNAL_STORAGE permission can substitute the APK immediately after the download is completed and the fingerprint is verified,” Google warned Epic Games in a discussion that began on Aug. 15. “This is easily done using a FileObserver. The Fortnite Installer will proceed to install the substituted (fake) APK.”
APK is the default Android package format and is being used by Epic Games to deliver Fortnite. Rather than provide a full installation of its software, Epic Games instead first uses an installer application which pulls the required APK. Google’s research found that the process used by Epic Games didn’t properly secure the APK installation process, potentially enabling an attacker to deliver malicious code.
The attack vector that Google reported is referred to as a ‘Man-in-the-Disk’ (MITD) attack, which is an attack vector that was first publicly disclosed by cyber-security firm CheckPoint on Aug. 12. The attack vector abuses the way that Android applications use storage resources.
“Careless use of External Storage by applications may open the door to an attack resulting in any number of undesired outcomes, such as silent installation of unrequested, potentially malicious, apps to the user’s phone, denial of service for legitimate apps, and even cause applications to crash, opening the door to possible code injection that would then run in the privileged context of the attacked application,” CheckPoint wrote.
Epic Responce
Epic Games responded to Google’s claims and had a fix in place on Aug. 16.
“This patch changes the default APK storage directory from external to internal storage, which should prevent MITD attacks during the install flow,” Epic’s InfoSec team wrote.
Epic requested that Google not disclose the issue for 90…
Popular Fortnite Merch
- DART BLASTING FORTNITE BLASTER REPLICA: This AR L blaster is inspired by the blaster used in Fortnite, capturing the look and colors of the one in the popular video game
- MOTORIZED 10 DART BLASTING: Blast 10 darts from this motorized blaster that has an acceleration button to power up the motor (batteries required, not included)
- 20 DARTS AND 10 DART CLIP: Includes a 10 dart clip and 20 Official Nerf Elite darts.To ensure proper use of AR L blaster ensure access door is fully closed before use. Make sure clip is inserted fully...
- Jenga game with a Fortnite twist: It's an exciting Jenga game with artwork, themes, and characters inspired by the popular Fortnite online video game
- Spin, stack, climb: Players spin the spinner and follow the commands: the number and type of Blocks to stack, and how many layers their Fortnite character must climb
- Don't fall short: Players move their own pegs up and their opponents' Pegs down as they remove and stack blocks. But if the tower falls As they climb or stack -- it's game over for them
- Practice your aim with this targeting set: this set includes an spmrnum-r blaster, 6 darts and 3 llama targets so you can practice your aim or play competitive games with family and friends
- Includes 3 llama targets: comes with 3 llama targets in different sizes to set up exciting games that challenge skills and test aim and accuracy
- Dart-blasting Fortnite blaster replica: this spmrnum-r blaster is inspired by the blaster used in Fortnite, capturing the look and colors of the one in the popular video game
- Dart-blasting replica of the Fortnite blaster: this its blaster is inspired by the blaster used in the popular Fortnite video game
- Pump-action 4-dart blasting: blast 4 darts in a row from this 4-dart, pump-action blaster that's hand-powered by you (no batteries required)
- 8 darts and storage stock: includes 8 official Nerf Mega darts and has storage on the stock for 4 darts, so you can keep backup darts nearby for fast reloading
- Super-Soft, Huggable Plush for All Ages
- High-Quality Materials
- Collectible Rare Loot Llama
- Unique Rocket Battle Royale gameplay.
- Everything is destructible! Real Sandbox mode.
- Craft Defenses, Forts, Towers, Sky Bridges, everything possible!
- Epic Games
- Little, Brown Books for Young Readers
- Paperback: 112 pages
- Measures 14 inches tall and includes 23 pieces-9 weapons, 4 Back Bling, 8 exclusive building materials and a llama float that fits many 4" Fortnite action figures! Plus, it's pre-filled with a 4-inch...
- Giddy-Up features 25+ points of articulation and highly detailed decoration inspired by one of the most popular outfits from Epic Games' Fortnite.
- Bursting with colorful confetti, reveal your loot by tearing open your Llama to see a War Paint figure and a bunch of cool accessories.
- Ragnarok, Rex, Cuddle Team Leader and Brite Bomber 4" action figures - inspired by four of the most popular outfits from Epic Games' Fortnite.
- 19 points of articulation
- Highly detailed decoration
