The Fortnite Installer that brought the fix is version 2.1.0, which you can check for by launching the Fortnite Installer and going to its settings. According to Epic, the exploit was fixed less than 48 hours after being notified and was deployed to every Fortnite Installer that had been installed previously - users simply need to update the Installer, which is a one-tap affair. Thankfully, Epic acted quickly to fix the exploit. Google's Issue Tracker page for the exploit has a quick screen recording that shows just how easily a user can download and install the Fortnite Installer, in this case from the Galaxy Apps Store, and think they're downloading Fortnite while instead downloading and installing a malicious app, with full permissions - camera, location, microphone, SMS, storage and phone - called "Fortnite." It takes a few seconds and no user interaction. It doesn't matter whether you have a phone with Android Lollipop or Android Pie, or whether you turned off "unknown sources" after installing the Fortnite Installer - as soon as you installed it, you could potentially be attacked.
Going further, that app that was just installed silently can declare and be granted every permission possible without your further consent. On Samsung phones that get the app from Galaxy Apps, in particular, things are slightly worse: there isn't even a first prompt to allow from "unknown sources" because Galaxy Apps is a known source.
This all happens within the expected flow of installing the app from the Fortnite Installer - you accept the installation, because you think you're installing the game.
Because of the way this exploit works, there is no indication during the installation process that you're downloading anything other than Fortnite (and Fortnite Installer has no knowledge, either), while in the background an entirely different app is being installed. Because of the way Android's permissions model works, you won't have to accept installation of an app from "unknown sources" beyond the time you accepted that installation for Fortnite. With one tap, you could download a malicious app that had full permissions and access to all data on your phone.
0 kommentar(er)
