What you need to know
- Security researchers have found another exploit similar to the original Strandhogg discovered back in December.
- This version is more sophisticated, allowing it to pose as a legitimate app that users are putting their passwords into permission hijacking.
- This exploit does not work with Android 10 and has been patched in the latest Android security fixes.
Looks like Strandhogg is back with an even more evil twin — and this is coming from someone who is an evil twin herself. Strandhogg 2.0, announced today by security researchers, once again tricks users into thinking that they're putting their passwords into a legitimate app when they're actually putting it into malware. The exploit is a more sophisticated version of the original Strandhogg exploit found back in December that made users think they were interacting with a legitimate website instead of a malware layer.
This new version only impacted Android 9.0 and below — Android 10 wasn't susceptible to it — and Google has said that this has been fixed the latest Android security patches for previous Android versions. When I asked out in-house security guru Jerry Hildenbrand about how worried the average user would need to be about it, he summed it up pretty easily:
It seems sophisticated, so its not very likely to have ever been found or used "in the wild". It was also patched in last security update, so even Google sees how important it was to close the hole even considering the above.
So, what happened here is the system seeming to work: some security researchers found an exploit, told Google and collected their bug bounty for it, Google patched the bug, and then the security researchers published what they found after most phones were protected by the new patch so that they could show off their work and remind us why security researchers matter.
Thanks, Promon, and nice logo.
We may earn a commission for purchases using our links. Learn more.
These are the free shows we're enjoying right now on Amazon Fire TV
Now is a great time to binge tons of free tv shows and movies on Amazon Fire TV. Here are some of our favorites that are currently running on the various free services like Prime Video, IMDbTV, Crackle, and others.
Amazon says employees are not being forced to delete TikTok
Amazon is the latest entity to lash out at TikTok, with the retail giant now requiring all of its employees to delete the app from their phones.
Everything we know (so far) about the Google Pixel 5
We're still months out from Google unveiling the Pixel 5, but that doesn't mean it's too early to speculate what it might offer. Here's everything we know so far!
Time to dump Chrome: 8 alternative desktop web browsers
If you getting frustrated with the lack of privacy, slower speeds or difficulty using extensions in Chrome, it's time to switch to one of these web browsers.