• Menu
  • Skip to main content
  • Skip to primary sidebar

The Cyber Security News

Latest Cyber Security News

Header Right

  • Latest News
  • Vulnerabilities
  • Cloud Services
major security flaws expose keystrokes of over 1 billion chinese

Major Security Flaws Expose Keystrokes of Over 1 Billion Chinese Keyboard App Users

You are here: Home / General Cyber Security News / Major Security Flaws Expose Keystrokes of Over 1 Billion Chinese Keyboard App Users
April 24, 2024

Security vulnerabilities uncovered in cloud-centered pinyin keyboard applications could be exploited to reveal users’ keystrokes to nefarious actors.

The findings occur from the Citizen Lab, which identified weaknesses in 8 of 9 apps from distributors like Baidu, Honor, iFlytek, OPPO, Samsung, Tencent, Vivo, and Xiaomi. The only vendor whose keyboard application did not have any security shortcomings is that of Huawei’s.

The vulnerabilities could be exploited to “absolutely reveal the contents of users’ keystrokes in transit,” scientists Jeffrey Knockel, Mona Wang, and Zoë Reichert claimed.

✔ Approved From Our Partners
AOMEI Backupper Lifetime

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code


The disclosure builds on prior investigate from the interdisciplinary laboratory dependent at the College of Toronto, which recognized cryptographic flaws in Tencent’s Sogou Enter System previous August.

Collectively, it can be estimated that near to 1 billion consumers are affected by this course of vulnerabilities, with Input Strategy Editors (IMEs) from Sogou, Baidu, and iFlytek accounting for a enormous chunk of the marketplace share.

Cybersecurity

A summary of the determined issues is as follows –

  • Tencent QQ Pinyin, which is susceptible to a CBC padding oracle attack that could make it possible to get well plaintext
  • Baidu IME, which allows network eavesdroppers to decrypt network transmissions and extract the typed textual content on Windows owing to a bug in the BAIDUv3.1 encryption protocol
  • iFlytek IME, whose Android app permits network eavesdroppers to recover the plaintext of insufficiently encrypted network transmissions
  • Samsung Keyboard on Android, which transmits keystroke information by means of plain, unencrypted HTTP
  • Xiaomi, which comes preinstalled with keyboard apps from Baidu, iFlytek, and Sogou (and thus inclined to the same aforementioned flaws)
  • OPPO, which will come preinstalled with keyboard applications from Baidu and Sogou (and therefore susceptible to the similar aforementioned flaws)
  • Vivo, which will come preinstalled with Sogou IME (and consequently prone to the identical aforementioned flaw)
  • Honor, which comes preinstalled with Baidu IME (and consequently prone to the exact aforementioned flaw)

Successful exploitation of these vulnerabilities could allow adversaries to decrypt Chinese cellular users’ keystrokes fully passively with out sending any supplemental network targeted visitors. Adhering to accountable disclosure, each individual keyboard app developer with the exception of Honor and Tencent (QQ Pinyin) have resolved the issues as of April 1, 2024.

Cybersecurity

Buyers are encouraged to continue to keep their apps and operating techniques up-to-date and change to a keyboard app that totally operates on-system to mitigate these privacy issues.

Other recommendations phone on application developers to use nicely-examined and normal encryption protocols in its place of establishing homegrown variations that could have security complications. Application store operators have also been urged not to geoblock security updates and permit developers to attest to all data remaining transmitted with encryption.

The Citizen Lab theorized it really is doable that Chinese app developers are significantly less inclined to use “Western” cryptographic criteria owing to fears that they may include backdoors of their very own, prompting them to produce in-house ciphers.

“Supplied the scope of these vulnerabilities, the sensitivity of what users type on their products, the simplicity with which these vulnerabilities may possibly have been uncovered, and that the 5 Eyes have formerly exploited very similar vulnerabilities in Chinese applications for surveillance, it is possible that this sort of users’ keystrokes may well have also been below mass surveillance,” the researchers claimed.

Found this short article interesting? Abide by us on Twitter  and LinkedIn to read through more unique content we submit.


Some sections of this post are sourced from:
thehackernews.com

Previous Post: «escan antivirus update mechanism exploited to spread backdoors and miners eScan Antivirus Update Mechanism Exploited to Spread Backdoors and Miners
Next Post: Researchers Detail Multistage Attack Hijacking Systems with SSLoad, Cobalt Strike researchers detail multistage attack hijacking systems with ssload, cobalt strike»

Reader Interactions

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Primary Sidebar

Report This Article

Recent Posts

  • Qilin Ransomware Adds “Call Lawyer” Feature to Pressure Victims for Larger Ransoms
  • Iran’s State TV Hijacked Mid-Broadcast Amid Geopolitical Tensions; $90M Stolen in Crypto Heist
  • 6 Steps to 24/7 In-House SOC Success
  • Massive 7.3 Tbps DDoS Attack Delivers 37.4 TB in 45 Seconds, Targeting Hosting Provider
  • 67 Trojanized GitHub Repositories Found in Campaign Targeting Gamers and Developers
  • New Android Malware Surge Hits Devices via Overlays, Virtualization Fraud and NFC Theft
  • BlueNoroff Deepfake Zoom Scam Hits Crypto Employee with MacOS Backdoor Malware
  • Secure Vibe Coding: The Complete New Guide
  • Uncover LOTS Attacks Hiding in Trusted Tools — Learn How in This Free Expert Session
  • Russian APT29 Exploits Gmail App Passwords to Bypass 2FA in Targeted Phishing Campaign

Copyright © TheCyberSecurity.News, All Rights Reserved.