11 ms·

Fortnite Android Installer allowed hackers to download and install anything

116 points by ilarum 8y ago

dmitrygr 8y ago
This is precisely why this was a bad idea. Happened exactly as predicted.
- umvi 8y ago
  What was a bad idea? Not using the app store? We got along for decades without centralized app stores taking a 30% cut.
  - quantummkv 8y ago
    Coincidentally, it was also the era with 37 ie toolbars and constantly having to clean out the infected family pc every week only to find it infected the next day. Definitely the fun times.
    - helthanatos 8y ago
      I would have totally taken away admin and maxed UAC. "Why can't I install this Ralphy?" "Because it's a virus!" Personally, I like the choice of app stores and installing anything or installing a third party app store.
      - gsich 8y ago
        This was the era before UAC...
    - pentae 8y ago
      Mac users never had that problem and MacOS didn't have a central app store for decades
      - berti 8y ago
        There are three main reasons for this, don't underestimate any of them: generally more technically literate to make the choice to use macOS, unix and DE design, and small target for malware makers.
      - pjmlp 8y ago
        Another one that only uses Macs since OS X.
  - Jyaif 8y ago
    We got along for centuries without centralized app stores. Maybe the time are changing?
  - dragonwriter 8y ago
    > We got along for decades without centralized app stores taking a 30% cut. Those decades were largely spent with a physical retail distribution chain taking an even bigger share of most consumer purchases, and being just as essential to reaching most consumers. There wasn't much gap between online distribution becoming significant and app stores emerging.
- toast0 8y ago
  It wasn't clear before that instead of having users download and install an apk, users were downloading and installing an apk that downloads and install an apk. That seems a little bit insane, combined with Androids kind of terrible inability to do useful things like have a place for large storage (SD card), that isn't readible and mutable by all apps.
- gameswithgo 8y ago
  It is a bug that is only exploited if you got malware from the app store already (or somewhere else) to begin with. Seems like a non issue to me, and one easily prevented if side loading wasn't an after thought.
  - MBCook 8y ago
    Telling people to just Google “download Fortnite apk“ is a fantastic way for people to get malware. What’s surprising about this story is tha what’s surprising about this story isnt that people are ending up with security issues, it’s that they’re ending up with security issues from the OFFICIAL download.
    - dylz 8y ago
      There is not a SINGLE legitimate link on bing - https://i.imgur.com/blcO4Xu.png https://i.imgur.com/blcO4Xu.png (The quora one is spam that leads to adware apk site on .in domain)
mchahn 8y ago
This will probably cause users to avoid side-loading which is a shame. It will be harder for developers to avoid the store-tax.
- Operyl 8y ago
  Frankly, I don't think it will. The typical user will never hear about this, and those that do will forget about it in a week. They just want to play Fortnite, and they'll do whatever to get there.
cma 8y ago
Google should allow users to install trusted keys and then this wouldn't have happened. Users could install apps signed only by the Epic store. Instead, through Google Play Services deals with manufacturers, they prevent this from happening at the system level, don't they, other than for phone vendor stores? You can only blanket allow third party apps, which you have to toggle on and off every time you do a third party update, and not just add a specific store's key. At least that's how Amazon Instant Video seems to be.
- dmitrygr 8y ago
  That isn't how Android works. An app with permission to install things can do so. Play store by default has this permission. It is VERY careful to avoid substitution of downloaded data. For a good reason. Users granted same permission to the Epic installer. Clearly prematurely. Why the downvotes? It is true.
  - wtallis 8y ago
    Why should something like the Fortnite installer have to make any effort to ensure that other apps aren't tampering with what it downloads? This definitely sounds like poor platform design more than a flaw in the installer.
    - throwaway5752 8y ago
      "Using a private internal storage directory rather than external storage would help avoid this vulnerability: https://developer.android.com/guide/topics/data/data-storage#filesInternal" https://developer.android.com/guide/topics/data/data-storage... The system offers it and they didn't use it. "Why should something like the Fortnite installer have to make any effort to ensure that other apps aren't tampering with what it downloads?" Because it's running with exceptionally dangerous permissions that Google does its level best to prevent users from granting to 3rd party apps in the first place.
      - wtallis 8y ago
rahimnathwani 8y ago
The explanation in the bug tracker is clearer than the explanation in the article: "Any app with the WRITE_EXTERNAL_STORAGE permission can substitute the APK immediately after the download is completed and the fingerprint is verified. This is easily done using a FileObserver. The Fortnite Installer will proceed to install the substituted (fake) APK. If the fake APK has a targetSdkVersion of 22 or lower, it will be granted all permissions it requests at install-time. This vulnerability allows an app on the device to hijack the Fortnite Installer to instead install a fake APK with any permissions that would normally require user disclosure. "
- deleted 8y ago
  [deleted]
- HillaryBriss 8y ago
  I thought so, too. CheckPoint's diagram of a Man in the Disk attack is also helpful: https://blog.checkpoint.com/wp-content/uploads/2018/08/Man-in-the-Disk-Update-Flow.png https://blog.checkpoint.com/wp-content/uploads/2018/08/Man-i...
tokyodude 8y ago
Why is this not considered a bug in Android? Hasn't this just shown how any app can add a feature to download other apps? Why wouldn't Facebook add that feature to the Facebook app so they can forcefully install any other app they want?
- javagram 8y ago
  Facebook wouldn’t do that because they don’t need to use illegal/shady means to install their apps, users happily download and install them. This isn’t a bug “in android” since it can only happen when the user enables permissions to install third party app stores - the Fortnite installer is essentially an App Store that could be tricked to installing any APK rather than the one it means to.
  - stale2002 8y ago
    It is absolutely a bug in Android. The "bug" is that it is extremely difficult for users to install 3rd party apps securely. If it was easier for developers to securely offer 3rd party downloads, then stuff like this wouldn't happen.
    - tehlike 8y ago
      Suggest a way.
      - tokyodude 8y ago
        A browser does this with every page you visit so there's clearly a path between what we have and what could be.
      - ForHackernews 8y ago
        In apt, you can specify trusted keys for repositories and the packages downloaded are verified. Most Debian-based systems ship with standard repositories, but it's easy to add others.
scottydelta 8y ago
From the article: > Google's security analysis efforts are appreciated and benefit the Android platform, however a company as powerful as Google should practice more responsible disclosure timing than this, and not endanger users in the course of its counter-PR efforts against Epic's distribution of Fortnite outside of Google Play. And Google expects researchers to disclose bugs on their platform to them before disclosing to public.
- MBCook 8y ago
  It wouldn’t surprise me if google did this as a sort of backhanded way of saying “see what happens when you don’t use our App Store?“
  - ChuckMcM 8y ago
    Hardly back handed, more of a "this is what we do to you when ..." kind of thing.
  - Rotdhizon 8y ago
    Epic is reckless for bypassing the play store, I'd be on the side of Google if this was their stance.
    - scottydelta 8y ago
      Not if they are creating such a big hole in the company's revenue(30%, source : https://arstechnica.com/gaming/2018/08/fortnite-on-android-may-drive-its-battle-bus-past-googles-30-cut/ https://arstechnica.com/gaming/2018/08/fortnite-on-android-m...) without bringing in something substantial. Epic already has a user base who would go to extra length by downloading the game's installer by visiting their website. So, it totally makes sense for Epic to bypass the playstore. From the article linked above: > Avoiding the 30 percent "store tax" is a part of Epic's motivation. It's a high cost in a world where game developers' 70 percent must cover all the cost of developing, operating, and supporting their games. And it's disproportionate to the cost of the services these stores perform, such as payment processing, download bandwidth, and customer service. We're intimately familiar with these costs from our experience operating Fortnite as a direct-to-customer service on PC and Mac.
jchw 8y ago
Epic Games is making a disappointing choice. The app store taxes are definitely steep, and maybe it is time to talk about how fair this is. But, Epic Games develops probably the most popular video game in the world, and they are telling users to install their app in a way that could only be described as unhygienic, and will condition users to think that it is OK. Meanwhile, they have accused Google's disclosure, which is completely in line with their existing disclosure behavior that they stubbornly enforce for everybody, as being a PR move, intended to harm Epic Games for their decision to launch outside Play Store. It's clear that Android has a bad reputation for security issues and insane to think that Google would not want to make sure that the launch of a super popular video game on their platform doesn't turn into a security disaster. I generally respect Epic Games, but I don't understand what seems to be pretty greedy on their part. If they wanted to start a discussion about the fairness of app store taxes, I don't think this will accomplish that personally. Meanwhile, Apple's definitely looking pretty smart. They're probably making good money off of Fortnite and won't suffer any of the bad UX or security issues Android users will be exposed to.
- pentae 8y ago
  As a Developer I have massive respect for Epic Games here. And anyone thats developed apps for more than 5 minutes for the App store knows that the rules are completely arbitrary based on how big you are. The review team are much less harsh on the large name brand apps with legal teams and massive audiences while smaller devs are given an entirely different more hardcore set of rules. This is bad for innovation, bad for smaller businesses and bad for users.
  - jchw 8y ago
    App store rules is a whole different can of worms from the app store tax. I don't claim to agree with the state of either, but all the same the partially overlapping needs of the three parties (user, developer, platform) are difficult to balance and align and I don't believe in any extreme here.
    - pentae 8y ago
vajramatti8 8y ago
Fornite game makers (and a handful) of others have been figting against 'Googles Play Store Tax' and suddenly Google announces this. It’s subtly saying, downloading anything outside of Play Store is dangerous for you. As indicated in the article this vulnerability has as much to do about ... the way Android's permissions model works...
xigma 8y ago
So, a "feature" in the installer allows an already installed malicious app to install even more malicious apps. That new malicious app then gets to somehow have more permissions than the original malicious app or the installer. Guys, that's an Android bug. This is exactly the kind of thing that needs to be fixed at an OS level, you can't be relying on the competence of arbitrary developers to maintain the security of the system. Of course it's an opportunity for Google to use their own broken security model as an argument on why apps should only come from their own "curated" channels (which presumably also host the malware exploiting this). It just so happens to be their source of revenue...
- UncleMeat 8y ago
  Poppycock. There are two ways to fix this. One is to not permit dynamic code loading or app installs off the Play Store. This is Apple territory and pisses people the hell off. The other is to not have any world writable filesystem at all. I guess you could do this, but this messes with features surrounding music and pictures that you do want to share between apps. Epic literally could have used the private filesystem that is right there just for the purpose of having files that are protected from other apps.
  - HillaryBriss 8y ago
    Yep. If I might add a footnote for HN reader convenience: Epic actually fixed it by following the second approach you mentioned. According to Google issue tracker: "This patch changes the default APK storage directory from external to internal storage, which should prevent MITD attacks during the install flow." https://issuetracker.google.com/issues/112630336#comment5 https://issuetracker.google.com/issues/112630336#comment5
  - xigma 8y ago
    No, this is a permissions problem. Reading and writing to an application directory does not cause any issues until some code in that directory starts running with privileges it shouldn't have. It should not be possible for an application that happens to install other applications to bypass the user for specific permissions. The user must be asked explicitly. This has nothing to do with being able to "sideload" apps or not. Sideloading apps is actually possible on iOS, it's just such an effort (getting a developer account) that it's rarely done in practice.
throw2016 8y ago
This narrative does not make sense. Any installer has privileges on a system, including verifying hashes or keys so you shouldn't just run an unknown software. Installing apps only from an app store is a walled garden and not having the ability to install apps is not a consumer want. The only people who would advocate this are Google since they gain financially from the model and those who use 'security' to promote walled gardens and moats. Most technical people don't approve of lockdowns and loss of freedom. There is a balance here. If installing apps from the web is a problem then 90 percent of current software is 'insecure'.
wetpaws 8y ago
Google really really really don't want Epics to bypass their Play Store, eh? :)

116 points by ilarum 8y ago

dmitrygr 8y ago

This is precisely why this was a bad idea. Happened exactly as predicted.

umvi 8y ago
What was a bad idea? Not using the app store? We got along for decades without centralized app stores taking a 30% cut.
- quantummkv 8y ago
  Coincidentally, it was also the era with 37 ie toolbars and constantly having to clean out the infected family pc every week only to find it infected the next day. Definitely the fun times.
  - helthanatos 8y ago
    I would have totally taken away admin and maxed UAC. "Why can't I install this Ralphy?" "Because it's a virus!" Personally, I like the choice of app stores and installing anything or installing a third party app store.
    - gsich 8y ago
      This was the era before UAC...
  - pentae 8y ago
    Mac users never had that problem and MacOS didn't have a central app store for decades
    - berti 8y ago
      There are three main reasons for this, don't underestimate any of them: generally more technically literate to make the choice to use macOS, unix and DE design, and small target for malware makers.
    - pjmlp 8y ago
      Another one that only uses Macs since OS X.
- Jyaif 8y ago
  We got along for centuries without centralized app stores. Maybe the time are changing?
- dragonwriter 8y ago
  > We got along for decades without centralized app stores taking a 30% cut. Those decades were largely spent with a physical retail distribution chain taking an even bigger share of most consumer purchases, and being just as essential to reaching most consumers. There wasn't much gap between online distribution becoming significant and app stores emerging.
toast0 8y ago
It wasn't clear before that instead of having users download and install an apk, users were downloading and installing an apk that downloads and install an apk. That seems a little bit insane, combined with Androids kind of terrible inability to do useful things like have a place for large storage (SD card), that isn't readible and mutable by all apps.
gameswithgo 8y ago
It is a bug that is only exploited if you got malware from the app store already (or somewhere else) to begin with. Seems like a non issue to me, and one easily prevented if side loading wasn't an after thought.
- MBCook 8y ago
  Telling people to just Google “download Fortnite apk“ is a fantastic way for people to get malware. What’s surprising about this story is tha what’s surprising about this story isnt that people are ending up with security issues, it’s that they’re ending up with security issues from the OFFICIAL download.
  - dylz 8y ago
    There is not a SINGLE legitimate link on bing - https://i.imgur.com/blcO4Xu.png https://i.imgur.com/blcO4Xu.png (The quora one is spam that leads to adware apk site on .in domain)

mchahn 8y ago

This will probably cause users to avoid side-loading which is a shame. It will be harder for developers to avoid the store-tax.

Operyl 8y ago
Frankly, I don't think it will. The typical user will never hear about this, and those that do will forget about it in a week. They just want to play Fortnite, and they'll do whatever to get there.

cma 8y ago

Google should allow users to install trusted keys and then this wouldn't have happened. Users could install apps signed only by the Epic store. Instead, through Google Play Services deals with manufacturers, they prevent this from happening at the system level, don't they, other than for phone vendor stores? You can only blanket allow third party apps, which you have to toggle on and off every time you do a third party update, and not just add a specific store's key. At least that's how Amazon Instant Video seems to be.

dmitrygr 8y ago
That isn't how Android works. An app with permission to install things can do so. Play store by default has this permission. It is VERY careful to avoid substitution of downloaded data. For a good reason. Users granted same permission to the Epic installer. Clearly prematurely. Why the downvotes? It is true.
- wtallis 8y ago
  Why should something like the Fortnite installer have to make any effort to ensure that other apps aren't tampering with what it downloads? This definitely sounds like poor platform design more than a flaw in the installer.
  - throwaway5752 8y ago
    "Using a private internal storage directory rather than external storage would help avoid this vulnerability: https://developer.android.com/guide/topics/data/data-storage#filesInternal" https://developer.android.com/guide/topics/data/data-storage... The system offers it and they didn't use it. "Why should something like the Fortnite installer have to make any effort to ensure that other apps aren't tampering with what it downloads?" Because it's running with exceptionally dangerous permissions that Google does its level best to prevent users from granting to 3rd party apps in the first place.
    - wtallis 8y ago

rahimnathwani 8y ago

The explanation in the bug tracker is clearer than the explanation in the article: "Any app with the WRITE_EXTERNAL_STORAGE permission can substitute the APK immediately after the download is completed and the fingerprint is verified. This is easily done using a FileObserver. The Fortnite Installer will proceed to install the substituted (fake) APK. If the fake APK has a targetSdkVersion of 22 or lower, it will be granted all permissions it requests at install-time. This vulnerability allows an app on the device to hijack the Fortnite Installer to instead install a fake APK with any permissions that would normally require user disclosure. "

deleted 8y ago
[deleted]
HillaryBriss 8y ago
I thought so, too. CheckPoint's diagram of a Man in the Disk attack is also helpful: https://blog.checkpoint.com/wp-content/uploads/2018/08/Man-in-the-Disk-Update-Flow.png https://blog.checkpoint.com/wp-content/uploads/2018/08/Man-i...

tokyodude 8y ago

Why is this not considered a bug in Android? Hasn't this just shown how any app can add a feature to download other apps? Why wouldn't Facebook add that feature to the Facebook app so they can forcefully install any other app they want?

javagram 8y ago
Facebook wouldn’t do that because they don’t need to use illegal/shady means to install their apps, users happily download and install them. This isn’t a bug “in android” since it can only happen when the user enables permissions to install third party app stores - the Fortnite installer is essentially an App Store that could be tricked to installing any APK rather than the one it means to.
- stale2002 8y ago
  It is absolutely a bug in Android. The "bug" is that it is extremely difficult for users to install 3rd party apps securely. If it was easier for developers to securely offer 3rd party downloads, then stuff like this wouldn't happen.
  - tehlike 8y ago
    Suggest a way.
    - tokyodude 8y ago
      A browser does this with every page you visit so there's clearly a path between what we have and what could be.
    - ForHackernews 8y ago
      In apt, you can specify trusted keys for repositories and the packages downloaded are verified. Most Debian-based systems ship with standard repositories, but it's easy to add others.

scottydelta 8y ago

From the article: > Google's security analysis efforts are appreciated and benefit the Android platform, however a company as powerful as Google should practice more responsible disclosure timing than this, and not endanger users in the course of its counter-PR efforts against Epic's distribution of Fortnite outside of Google Play. And Google expects researchers to disclose bugs on their platform to them before disclosing to public.

MBCook 8y ago
It wouldn’t surprise me if google did this as a sort of backhanded way of saying “see what happens when you don’t use our App Store?“
- ChuckMcM 8y ago
  Hardly back handed, more of a "this is what we do to you when ..." kind of thing.
- Rotdhizon 8y ago
  Epic is reckless for bypassing the play store, I'd be on the side of Google if this was their stance.
  - scottydelta 8y ago
    Not if they are creating such a big hole in the company's revenue(30%, source : https://arstechnica.com/gaming/2018/08/fortnite-on-android-may-drive-its-battle-bus-past-googles-30-cut/ https://arstechnica.com/gaming/2018/08/fortnite-on-android-m...) without bringing in something substantial. Epic already has a user base who would go to extra length by downloading the game's installer by visiting their website. So, it totally makes sense for Epic to bypass the playstore. From the article linked above: > Avoiding the 30 percent "store tax" is a part of Epic's motivation. It's a high cost in a world where game developers' 70 percent must cover all the cost of developing, operating, and supporting their games. And it's disproportionate to the cost of the services these stores perform, such as payment processing, download bandwidth, and customer service. We're intimately familiar with these costs from our experience operating Fortnite as a direct-to-customer service on PC and Mac.

jchw 8y ago

Epic Games is making a disappointing choice. The app store taxes are definitely steep, and maybe it is time to talk about how fair this is. But, Epic Games develops probably the most popular video game in the world, and they are telling users to install their app in a way that could only be described as unhygienic, and will condition users to think that it is OK. Meanwhile, they have accused Google's disclosure, which is completely in line with their existing disclosure behavior that they stubbornly enforce for everybody, as being a PR move, intended to harm Epic Games for their decision to launch outside Play Store. It's clear that Android has a bad reputation for security issues and insane to think that Google would not want to make sure that the launch of a super popular video game on their platform doesn't turn into a security disaster. I generally respect Epic Games, but I don't understand what seems to be pretty greedy on their part. If they wanted to start a discussion about the fairness of app store taxes, I don't think this will accomplish that personally. Meanwhile, Apple's definitely looking pretty smart. They're probably making good money off of Fortnite and won't suffer any of the bad UX or security issues Android users will be exposed to.

pentae 8y ago
As a Developer I have massive respect for Epic Games here. And anyone thats developed apps for more than 5 minutes for the App store knows that the rules are completely arbitrary based on how big you are. The review team are much less harsh on the large name brand apps with legal teams and massive audiences while smaller devs are given an entirely different more hardcore set of rules. This is bad for innovation, bad for smaller businesses and bad for users.
- jchw 8y ago
  App store rules is a whole different can of worms from the app store tax. I don't claim to agree with the state of either, but all the same the partially overlapping needs of the three parties (user, developer, platform) are difficult to balance and align and I don't believe in any extreme here.
  - pentae 8y ago

vajramatti8 8y ago

Fornite game makers (and a handful) of others have been figting against 'Googles Play Store Tax' and suddenly Google announces this. It’s subtly saying, downloading anything outside of Play Store is dangerous for you. As indicated in the article this vulnerability has as much to do about ... the way Android's permissions model works...

xigma 8y ago

So, a "feature" in the installer allows an already installed malicious app to install even more malicious apps. That new malicious app then gets to somehow have more permissions than the original malicious app or the installer. Guys, that's an Android bug. This is exactly the kind of thing that needs to be fixed at an OS level, you can't be relying on the competence of arbitrary developers to maintain the security of the system. Of course it's an opportunity for Google to use their own broken security model as an argument on why apps should only come from their own "curated" channels (which presumably also host the malware exploiting this). It just so happens to be their source of revenue...

UncleMeat 8y ago
Poppycock. There are two ways to fix this. One is to not permit dynamic code loading or app installs off the Play Store. This is Apple territory and pisses people the hell off. The other is to not have any world writable filesystem at all. I guess you could do this, but this messes with features surrounding music and pictures that you do want to share between apps. Epic literally could have used the private filesystem that is right there just for the purpose of having files that are protected from other apps.
- HillaryBriss 8y ago
  Yep. If I might add a footnote for HN reader convenience: Epic actually fixed it by following the second approach you mentioned. According to Google issue tracker: "This patch changes the default APK storage directory from external to internal storage, which should prevent MITD attacks during the install flow." https://issuetracker.google.com/issues/112630336#comment5 https://issuetracker.google.com/issues/112630336#comment5
- xigma 8y ago
  No, this is a permissions problem. Reading and writing to an application directory does not cause any issues until some code in that directory starts running with privileges it shouldn't have. It should not be possible for an application that happens to install other applications to bypass the user for specific permissions. The user must be asked explicitly. This has nothing to do with being able to "sideload" apps or not. Sideloading apps is actually possible on iOS, it's just such an effort (getting a developer account) that it's rarely done in practice.

throw2016 8y ago

This narrative does not make sense. Any installer has privileges on a system, including verifying hashes or keys so you shouldn't just run an unknown software. Installing apps only from an app store is a walled garden and not having the ability to install apps is not a consumer want. The only people who would advocate this are Google since they gain financially from the model and those who use 'security' to promote walled gardens and moats. Most technical people don't approve of lockdowns and loss of freedom. There is a balance here. If installing apps from the web is a problem then 90 percent of current software is 'insecure'.

wetpaws 8y ago

Google really really really don't want Epics to bypass their Play Store, eh? :)