More than 100 Million Android users at risk due to the Baidu Moplus SDK

A vulnerability known as Wormhole affects the Baidu Moplus SDK and potentially exposes more than 100 Million users to cyber attacks.

The Moplus software development kit (SDK) distributed by the Chinese Search Engine Baidu includes a functionality that can be exploited to gain access to the user’s device. The backdoor-like feature potentially exposes more than 100 Million Android users to cyber attacks.

“A vulnerability known as Wormhole that reportedly affected the software development kit (SDK), Moplus by Baidu is making waves due to the severity of the impact once successfully exploited. The said vulnerability was discovered by WooYun.og, a vulnerability reporting platform in China.” states a blog post published by TrendMicro. “However, as our investigation on this security bug unfolded, we found out that the Moplus SDK has backdoor functionalities that are not necessarily due or related to a vulnerability. “

The Wormhole vulnerability in the Moplus SDK could be exploited by hackers to open an unsecured and unauthenticated HTTP server connection on the user’s device, and this connection is established in the background without the user’s knowledge.

The Moplus SDK automatically installs the Web server when a mobile app developed with the SDK is launched on the device. The server doesn’t implement authentication and can accept requests from any source. The server receives requests on both 6259 or 40310 ports, this means that an attacker can easily locate it by searching on a shared network the open ports.

“…  the notion that it is vulnerability-related when in actual this SDK has backdoor routines such as pushing phishing pages, inserting arbitrary contacts, sending fake SMS, uploading local files to remote servers, and installing any applications to the Android devices without user’s authorization. ” continues the post.

The Moplus SDK is already used by more than 14,000 Android apps, nearly 4,000 of them are developed by Baidu. These apps have been already downloaded by more than 100 Million Android users.

 

The Moplus SDK allows an attacker to perform many actions including:

  • Send SMS messages
  • ake phone calls
  • Get mobile phone details
  • Add new contacts
  • Get a list of local apps
  • Download files on the device
  • Upload files from the device
  • Silently install other apps (if the phone is rooted)
  • Push Web pages
  • Get phone’s geo-location, and many more


The experts highlighted that the Wormhole flaw in the  Moplus  SDK is very dangerous because it is potentially easier to exploit than the Stagefright flaw. In this case in fact the hacker just need to locate a vulnerable device exposing the open ports.
The researchers at Trend Micro have confirmed the existence in the wild of a specific malware, dubbed ANDROIDOS_WORMHOLE.HRXA, which exploit the Wormhole in Moplus SDK.
Researchers reported the issue to Baidu and Google, the Chinese Giant has already pushed a partial fix for the issue in a new release of the Moplus SDK.

Be aware, the new version of SDK doesn’t completely solve all problems, for example the HTTP server remains exposed online.

A few days ago, another Chinese company has caught distributing malicious SDK which included spying features. According to according to Palo Alto Networks, nearly 18,000 Android Applications built using the Taomike SDK  have been found to include SMS Stealing Library.

Stay Tuned!

Pierluigi Paganini

(Security Affairs – Android, Moplus SDK)

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.

Recent Posts

Cisco warns of password-spraying attacks targeting Secure Firewall devices

Cisco warns customers of password-spraying attacks that have been targeting Remote Access VPN (RAVPN) services…

56 mins ago

American fast-fashion firm Hot Topic hit by credential stuffing attacks

Hot Topic suffered credential stuffing attacks that exposed customers' personal information and partial payment data.…

5 hours ago

Cisco addressed high-severity flaws in IOS and IOS XE software

Cisco addressed multiple vulnerabilities in IOS and IOS XE software that can be exploited to…

19 hours ago

Google: China dominates government exploitation of zero-day vulnerabilities in 2023

Google's Threat Analysis Group (TAG) and Mandiant reported a surge in the number of actively…

1 day ago

Google addressed 2 Chrome zero-days demonstrated at Pwn2Own 2024

Google addressed two zero-day vulnerabilities in the Chrome web browser that have been demonstrated during…

2 days ago

INC Ransom stole 3TB of data from the National Health Service (NHS) of Scotland

The INC Ransom extortion group hacked the National Health Service (NHS) of Scotland and is threatening…

2 days ago

This website uses cookies.