9 ms·

UC Browser for Android, Desktop Exposes 500M Users to MiTM Attacks

120 points by cpeterso 8y ago

saagarjha 8y ago
> Android apps "distributed via Google Play may not modify, replace, or update itself using any method other than Google Play's update mechanism. Likewise, an app may not download executable code (e.g. dex, JAR, .so files) from a source other than Google Play." Obvious question: why did this get approved, and will Google amend their process to close this loophole?
- deleted 8y ago
  [deleted]
- ignoramous 8y ago
  Fwiw, Firefox Mobile lets you download add-ons and plugins, as well, that modify behaviour of the app. Not sure what justification UCWeb might have given here to Google, though, it is more likely that with certain apps, external install, command, and control is a valid and exceptional use-case.
  - Kipters 8y ago
    In Firefox's case, the user willingly searchs for and installs add-ons, UC Browser did it on its own without informing the user
  - PudgePacket 8y ago
    Firefox extensions are just JS executed in a sandboxed runtime though.. By that logic you could argue webpage's JS are downloadable plugins that modify the behavior of the browser while it displays HTML content :)
- UncleMeat 8y ago
  Presumably detection of all dynamic code loading is hard, especially since people also get pissed at google whenever there is a false positive and an app is removed for seemingly no reason.
max_wen 8y ago
People really use this browser?
- outime 8y ago
  According to Google Play [1] it has >500M installs and about 20M reviews. [1] https://play.google.com/store/apps/details?id=com.UCMobile.intl&hl=en https://play.google.com/store/apps/details?id=com.UCMobile.i...
  - outloudvi 8y ago
    That only represents the data of Google Play. Considering China is one of the largest markets of UC, yet doesn't have access to Google Play, the actual number would be a lot more than that. According to iResearch[1], it has 311m "monthly unique devices" in China in Feb 2019. [1]. https://index.iresearch.com.cn/app/detail?id=12&Tid=73 https://index.iresearch.com.cn/app/detail?id=12&Tid=73 (Chinese)
- PikachuEXE 8y ago
  I see strange JS error reports from this browser sometimes
- O_H_E 8y ago
  I think that I have read that it is really famous in India.
  - plibither8 8y ago
    Yes. The userbase has grown bigger more recently due to the browser's free in-built VPN being used to circumvent the government's ban on ~800 porn sites[1]. [1] https://timesofindia.indiatimes.com/india/govt-plays-net-nanny-bans-800-porn-sites-subscribers-see-red/articleshow/66453163.cms https://timesofindia.indiatimes.com/india/govt-plays-net-nan...
    - tintintin 8y ago
      Well that's one way to grow...
austincheney 8y ago
> using unprotected channels It's not man in the middle. I have seen this mistake a lot lately. Man in the middle only involves encryption. Otherwise it is just injection or redirection. It is not a man in the middle attack merely because something happened in the middle of a transmission. There is always stuff that happens in the middle of transmission if you want to get technical about packet switching ARP resolution. Specifically man in the middle deals with intercepting a certificate or key request in the middle of a transmission so that the encrypted tunnel is between one end point and the attacker. The attacker then establishes a second encrypted tunnel between themselves and the other end point. Wikipedia page - https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack I am certain about this because I had to study it in order to pass the CISSP exam (first time go back when it was a 250 question paper test).
- ggggtez 8y ago
  What are you talking about... It is man in the middle. This attack is a lot older than encryption, so if you think encryption is required then you've made a big mistake. It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience.
  - austincheney 8y ago
    Older than encryption? Encryption has existed since before the Roman empire. > It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience. Every time somebody has pointed that out they have extracted that definition from the term opposed to referencing the term from a definition. It is similar to answering a question with only a restatement of the question.
    - deadmetheny 8y ago
      MitM attacks have been around far longer than transport/network layer encryption has been commonly deployed, is what parent means. These days it's more commonly used to defeat encryption but there's plenty of attacks that don't really need it (e.g. ARP spoofing, etc etc)
plibither8 8y ago
I really hope this substantially reduces the number of users, or Google takes the app down completely. The browser is ridiculously terrible: both from the user and the developer point of view. The browser constantly spams the phone with irrelevant, clickbait news articles/ads (and yet it's so popular). The developers (especially in India) cannot ignore the browser because of its large userbase, and then that's one more browser you have to look after.
- rushikesh98 8y ago
  > The browser constantly spams the phone with irrelevant, clickbait news articles/ads (and yet it's so popular). Regular people don't stop using an app because it shows irrelevant articles, click baits. Facebook, YouTube trending are more "mainstream" examples of this.
Matsta 8y ago
Just had a quick Google and this company is owned by Alibaba: https://en.wikipedia.org/wiki/UC_Browser https://en.wikipedia.org/wiki/UC_Browser Seems like they've already been in hot water for vulnerabilities in their browser: https://www.cbc.ca/news/canada/spy-agencies-target-mobile-phones-app-stores-to-implant-spyware-1.3076546 https://www.cbc.ca/news/canada/spy-agencies-target-mobile-ph...
- 40dslf 8y ago
  What conclusion do you draw from that company being owned by Alibaba? I don't see the relevance of this.
  - outloudvi 8y ago
    https://www.uc.cn/ https://www.uc.cn/ If you are meaning of the evidence of UC connected to Alibaba, I think this site is convincing enough. [EDIT: Fix link]
    - 40dslf 8y ago
      You misunderstood me. I firmly believe UC is owned by Alibaba, but I insist that I don't understand why is that important.
      - wastedhours 8y ago
        Useful context for me as I haven't heard of the browser so no knowledge as to how they can have such a large userbase. I don't think the intention was draw a correlation between Alibaba and security lapses.
        fencepost 8y ago
        Some of it may be inertia from early days of Android - for a long time I still had the Dolphin browser installed because for a time back in the Android 2.x days it was the best option around and IIRC included its own build of Chromium's rendering engine ("Dolphin Jetpack"). UC Browser is likely also available on devices not using Google Play where Chrome may not be an option.
userbinator 8y ago
"It’s impossible to be sure that cybercriminals will never get ahold of the browser developer’s servers or use the update feature to infect hundreds of millions of Android devices." Apparently they didn't consider the same sentence would be just as valid if they replaced "browser developer" with Google... This is an example of the authoritarian security sensationalism that's far too common today, and it only leads to the big companies like Google getting even more power over users. One of the most secure places is in an isolated prison cell.
- zamadatix 8y ago
  If you continue reading you find the key difference to the comparison you just made: > This unofficial update feature present in UC Browser can also be used by would-be attackers to perform man-in-the-middle attacks (MitM) attacks, potentially leading to remote code execution on compromised devices, because the app communicates with its servers using an unencrypted channel over HTTP. It's a lot easier to use the update feature to infect millions of people when it's just using plain HTTP.
  - userbinator 8y ago
    Then why didn't they just leave the first part of the sentence out completely? It would then be more factual and less scaremongering --- unless that's what they wanted, to push a "Google can do no wrong" agenda. I have no problem with factual reporting of the risks; it's the scaremongering promotion of Google's walled-garden that irritates me the most.
zoom6628 8y ago
FWIW UC Browser is prob the most popular web browser used on Android phones in China. Every device ive seen, or owned, has it pre-loaded or is top choice for getting loaded. I have also tried it out myself, but as other posters has written already, its awful. Wondering out loud i would ask if the vulnerability to MiTM is actually required. From reports here in HN 2-3 years ago MiTM is basically what the GFW achieves, and it inserts its own headers to route away from intended(and blocked) servers and to benign local China servers(such as baidu). Perhaps this vulnerability exists in their need to be compliant to local Chinese law which basically prevents one bypassing/nullifying the GFW without permission? This is an open and honest question, not an opinion. Hope someone can answer with facts. I lived in China past 12 years and have had enough hearsay, rumour, and opinion to last me multiple lifetimes :-)
- bgee 8y ago
  > and it inserts its own headers to route away from intended(and blocked) servers and to benign local China servers(such as baidu) I was never aware that GFW would route traffic to local China servers such as Baidu's, can you kindly provide some links?
  - zoom6628 8y ago
    Here you go - happy reading. https://www.tuicool.com/articles/6vqyqan https://www.tuicool.com/articles/6vqyqan https://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub https://www.netresec.com/?page=Blog&month=2015-03&post=China...
    - bgee 8y ago
      If I'm reading them correctly, those two posts are the opposite of what the parent post tried to say. Those DDoS were carried by directing traffic to GitHub while that traffic should go to Baidu. Did I miss something?
diogenescynic 8y ago
If you care about security or privacy, it seems like you’d avoid Android.
- m-p-3 8y ago
  But unless you can get Apple to make cheap devices for the masses (like Android One and Android Go) in developing countries, their high price point will push you towards giving up your privacy to have a smartphone and be reachable online.
- lern_too_spel 8y ago
  Sure you can live without a smartphone, but if you are going to use a smartphone, it is the most secure and private option.
pier25 8y ago
Why would anyone use anything else than Chrome or Firefox on Android? I wouldn't even trust Samsung.
- altenotiz 8y ago
  I believe things might work pretty differently when it comes to China, which is the main demographic of this browser
  - pier25 8y ago
    You mean you can't download Chrome?
  - rishav_sharan 8y ago
    And India, where it is heavily used. UC browser is the Yahoo of browsers. It bundles many app like features in the browsers and for a lot of people who aren't tech savvy, its they one node gateway to everything internet.

120 points by cpeterso 8y ago

> Android apps "distributed via Google Play may not modify, replace, or update itself using any method other than Google Play's update mechanism. Likewise, an app may not download executable code (e.g. dex, JAR, .so files) from a source other than Google Play." Obvious question: why did this get approved, and will Google amend their process to close this loophole?

deleted 8y ago
[deleted]
ignoramous 8y ago
Fwiw, Firefox Mobile lets you download add-ons and plugins, as well, that modify behaviour of the app. Not sure what justification UCWeb might have given here to Google, though, it is more likely that with certain apps, external install, command, and control is a valid and exceptional use-case.
- Kipters 8y ago
  In Firefox's case, the user willingly searchs for and installs add-ons, UC Browser did it on its own without informing the user
- PudgePacket 8y ago
  Firefox extensions are just JS executed in a sandboxed runtime though.. By that logic you could argue webpage's JS are downloadable plugins that modify the behavior of the browser while it displays HTML content :)
UncleMeat 8y ago
Presumably detection of all dynamic code loading is hard, especially since people also get pissed at google whenever there is a false positive and an app is removed for seemingly no reason.

max_wen 8y ago

People really use this browser?

outime 8y ago
According to Google Play [1] it has >500M installs and about 20M reviews. [1] https://play.google.com/store/apps/details?id=com.UCMobile.intl&hl=en https://play.google.com/store/apps/details?id=com.UCMobile.i...
- outloudvi 8y ago
  That only represents the data of Google Play. Considering China is one of the largest markets of UC, yet doesn't have access to Google Play, the actual number would be a lot more than that. According to iResearch[1], it has 311m "monthly unique devices" in China in Feb 2019. [1]. https://index.iresearch.com.cn/app/detail?id=12&Tid=73 https://index.iresearch.com.cn/app/detail?id=12&Tid=73 (Chinese)
PikachuEXE 8y ago
I see strange JS error reports from this browser sometimes
O_H_E 8y ago
I think that I have read that it is really famous in India.
- plibither8 8y ago
  Yes. The userbase has grown bigger more recently due to the browser's free in-built VPN being used to circumvent the government's ban on ~800 porn sites[1]. [1] https://timesofindia.indiatimes.com/india/govt-plays-net-nanny-bans-800-porn-sites-subscribers-see-red/articleshow/66453163.cms https://timesofindia.indiatimes.com/india/govt-plays-net-nan...
  - tintintin 8y ago
    Well that's one way to grow...

austincheney 8y ago

> using unprotected channels It's not man in the middle. I have seen this mistake a lot lately. Man in the middle only involves encryption. Otherwise it is just injection or redirection. It is not a man in the middle attack merely because something happened in the middle of a transmission. There is always stuff that happens in the middle of transmission if you want to get technical about packet switching ARP resolution. Specifically man in the middle deals with intercepting a certificate or key request in the middle of a transmission so that the encrypted tunnel is between one end point and the attacker. The attacker then establishes a second encrypted tunnel between themselves and the other end point. Wikipedia page - https://en.wikipedia.org/wiki/Man-in-the-middle_attack https://en.wikipedia.org/wiki/Man-in-the-middle_attack I am certain about this because I had to study it in order to pass the CISSP exam (first time go back when it was a 250 question paper test).

ggggtez 8y ago
What are you talking about... It is man in the middle. This attack is a lot older than encryption, so if you think encryption is required then you've made a big mistake. It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience.
- austincheney 8y ago
  Older than encryption? Encryption has existed since before the Roman empire. > It refers to literally a person intercepting your message before (or instead of) it reaching the intended audience. Every time somebody has pointed that out they have extracted that definition from the term opposed to referencing the term from a definition. It is similar to answering a question with only a restatement of the question.
  - deadmetheny 8y ago
    MitM attacks have been around far longer than transport/network layer encryption has been commonly deployed, is what parent means. These days it's more commonly used to defeat encryption but there's plenty of attacks that don't really need it (e.g. ARP spoofing, etc etc)

plibither8 8y ago

I really hope this substantially reduces the number of users, or Google takes the app down completely. The browser is ridiculously terrible: both from the user and the developer point of view. The browser constantly spams the phone with irrelevant, clickbait news articles/ads (and yet it's so popular). The developers (especially in India) cannot ignore the browser because of its large userbase, and then that's one more browser you have to look after.

rushikesh98 8y ago
> The browser constantly spams the phone with irrelevant, clickbait news articles/ads (and yet it's so popular). Regular people don't stop using an app because it shows irrelevant articles, click baits. Facebook, YouTube trending are more "mainstream" examples of this.

Matsta 8y ago

Just had a quick Google and this company is owned by Alibaba: https://en.wikipedia.org/wiki/UC_Browser https://en.wikipedia.org/wiki/UC_Browser Seems like they've already been in hot water for vulnerabilities in their browser: https://www.cbc.ca/news/canada/spy-agencies-target-mobile-phones-app-stores-to-implant-spyware-1.3076546 https://www.cbc.ca/news/canada/spy-agencies-target-mobile-ph...

40dslf 8y ago
What conclusion do you draw from that company being owned by Alibaba? I don't see the relevance of this.
- outloudvi 8y ago
  https://www.uc.cn/ https://www.uc.cn/ If you are meaning of the evidence of UC connected to Alibaba, I think this site is convincing enough. [EDIT: Fix link]
  - 40dslf 8y ago
    You misunderstood me. I firmly believe UC is owned by Alibaba, but I insist that I don't understand why is that important.
    - wastedhours 8y ago
      Useful context for me as I haven't heard of the browser so no knowledge as to how they can have such a large userbase. I don't think the intention was draw a correlation between Alibaba and security lapses.
      - fencepost 8y ago
        Some of it may be inertia from early days of Android - for a long time I still had the Dolphin browser installed because for a time back in the Android 2.x days it was the best option around and IIRC included its own build of Chromium's rendering engine ("Dolphin Jetpack"). UC Browser is likely also available on devices not using Google Play where Chrome may not be an option.

userbinator 8y ago

"It’s impossible to be sure that cybercriminals will never get ahold of the browser developer’s servers or use the update feature to infect hundreds of millions of Android devices." Apparently they didn't consider the same sentence would be just as valid if they replaced "browser developer" with Google... This is an example of the authoritarian security sensationalism that's far too common today, and it only leads to the big companies like Google getting even more power over users. One of the most secure places is in an isolated prison cell.

zamadatix 8y ago
If you continue reading you find the key difference to the comparison you just made: > This unofficial update feature present in UC Browser can also be used by would-be attackers to perform man-in-the-middle attacks (MitM) attacks, potentially leading to remote code execution on compromised devices, because the app communicates with its servers using an unencrypted channel over HTTP. It's a lot easier to use the update feature to infect millions of people when it's just using plain HTTP.
- userbinator 8y ago
  Then why didn't they just leave the first part of the sentence out completely? It would then be more factual and less scaremongering --- unless that's what they wanted, to push a "Google can do no wrong" agenda. I have no problem with factual reporting of the risks; it's the scaremongering promotion of Google's walled-garden that irritates me the most.

zoom6628 8y ago

FWIW UC Browser is prob the most popular web browser used on Android phones in China. Every device ive seen, or owned, has it pre-loaded or is top choice for getting loaded. I have also tried it out myself, but as other posters has written already, its awful. Wondering out loud i would ask if the vulnerability to MiTM is actually required. From reports here in HN 2-3 years ago MiTM is basically what the GFW achieves, and it inserts its own headers to route away from intended(and blocked) servers and to benign local China servers(such as baidu). Perhaps this vulnerability exists in their need to be compliant to local Chinese law which basically prevents one bypassing/nullifying the GFW without permission? This is an open and honest question, not an opinion. Hope someone can answer with facts. I lived in China past 12 years and have had enough hearsay, rumour, and opinion to last me multiple lifetimes :-)

bgee 8y ago
> and it inserts its own headers to route away from intended(and blocked) servers and to benign local China servers(such as baidu) I was never aware that GFW would route traffic to local China servers such as Baidu's, can you kindly provide some links?
- zoom6628 8y ago
  Here you go - happy reading. https://www.tuicool.com/articles/6vqyqan https://www.tuicool.com/articles/6vqyqan https://www.netresec.com/?page=Blog&month=2015-03&post=China%27s-Man-on-the-Side-Attack-on-GitHub https://www.netresec.com/?page=Blog&month=2015-03&post=China...
  - bgee 8y ago
    If I'm reading them correctly, those two posts are the opposite of what the parent post tried to say. Those DDoS were carried by directing traffic to GitHub while that traffic should go to Baidu. Did I miss something?

diogenescynic 8y ago

If you care about security or privacy, it seems like you’d avoid Android.

m-p-3 8y ago
But unless you can get Apple to make cheap devices for the masses (like Android One and Android Go) in developing countries, their high price point will push you towards giving up your privacy to have a smartphone and be reachable online.
lern_too_spel 8y ago
Sure you can live without a smartphone, but if you are going to use a smartphone, it is the most secure and private option.

pier25 8y ago

Why would anyone use anything else than Chrome or Firefox on Android? I wouldn't even trust Samsung.

altenotiz 8y ago
I believe things might work pretty differently when it comes to China, which is the main demographic of this browser
- pier25 8y ago
  You mean you can't download Chrome?
- rishav_sharan 8y ago
  And India, where it is heavily used. UC browser is the Yahoo of browsers. It bundles many app like features in the browsers and for a lot of people who aren't tech savvy, its they one node gateway to everything internet.