[Update: Developer response] ES File Explorer vulnerability leaves your files exposed to anyone on the same network


In the early days of Android, ES File Explorer was one of the better ways to manage your storage. That hasn't been true for a long time, though. Not only is the app rather cluttered and buggy, security researcher Elliot Alderson (@fs0c131y on Twitter) points out this app makes your files vulnerable to theft. All you have to do is open it once.
According to Alderson, ES File Explorer launches an HTTP server on port 59777. This leaves your phone wide open to anyone on the local network with enough knowledge to exploit it. An attacker can use that port to inject a JSON payload. They can get information about the apps and files you have, and then it's a simple matter to download your data over the network. I have no way of knowing this, but it seems like this may be related to the app's file sharing feature. See below for a video demo.
Elliot Alderson@fs0c131y
With more than 100,000,000 downloads ES File Explorer is one of the most famous file manager.
The surprise is: if you opened the app at least once, anyone connected to the same local network can remotely get a file from your phone https://www.youtube.com/watch?v=z6hfgnPNBRE …
2,251
10:56 AM - Jan 16, 2019
1,958 people are talking about this
Twitter Ads info and privacy
ES File Explorer has north of 100 million downloads, so that could mean a lot of vulnerable devices out there. Thankfully, the attack only works over local networks. It's a good idea in general not to be on a network with untrusted people and devices, but this really drives the point home. Alderson says the vulnerability is in v4.1.9.7.4 and lower, and the Play Store page lists the same build. So, you aren't even safe on the latest version. There's no word from the developers yet, but ES File Explorer is still actively developed. Presumably, an update is forthcoming.

We reached out to the ES File Explorer devs to try and get their side of the story, or at least find out if steps were being taken to eliminate this vulnerability. Sure enough, the devs claim to be on top of this and have come up with a fix:
We have fixed the http vulnerability issue and released it. Waiting for the Google market to pass the review."
The most recent build in the Play Store is still the v4.1.9.7.4 one released this past Monday, so that review is apparently ongoing. Hopefully we'll see the fix land shortly.

Comments

Post a Comment

Popular posts from this blog

Linktree’s free workaround lets you add multiple links to your Instagram bio

Image
Instagram only gives you one opportunity to link to outside resources inside its photo sharing platform. This might not be a problem for a majority of the users, but for those wanting a little more customization and even more options, it leaves much to be desired. Enter  Linktree , a free tool for Instagram designed to improve traffic to your outside link, be it a blog, portfolio, or store. How it works is fairly straightforward. After connecting Linktree to your Instagram profile, you’ll receive a single link to place in your Instagram bio. Once that link in place, you can customize what it’s linked to within your browser, be it a single website, or a collection of sites you’re looking to direct followers to Say you’re a photographer who’s using Instagram as a marketing tool for your wedding photography. Using Linktree, you can direct Instagram followers to your blog, your portfolio site, and even your other social media accounts. Until now, you would’ve been stuck c...
Read more

EVERYTHING WE KNOW ABOUT THE PIXEL 4, THE MOST-LEAKED PHONE EVER

Image
Google’s  Pixel 3 might have been the  most-leaked phone in history . Long before its unveiling, we knew practically everything about it from unboxing videos, photo comparisons, even a full review of the device. Surely, for the Pixel 4, Google would clamp down on leaks to leave some surprises for its debut on  October 15th , right? Let’s just say, if that was the plan, it didn’t exactly work out. We’ve now seen the Pixel 4 XL from every angle and in three different colors. At least seven different sources have touched this phone, many of them confirming the same specs. We not only know which cameras it’ll have, but also what they may be capable of, including air gestures (go figure). That doesn’t even count information Google has already shared  on purpose. So if you want to know almost everything about the Pixel 4 nearly a month before it’s announced, buckle up. We’ve sifted through all of the rumors and information we can find to compile everything we know —...
Read more

Stable Android 10 starts hitting the Galaxy Note10 and Note10+ (Update: Canada)

Image
UPDATE  1 : 2019/12/16 4:35AM PST Previous rollouts UPDATE  2 : 2020/01/06 2:15AM PST Canada Two weeks after the  Galaxy S10 line received its stable One UI 2.0 build , it’s time for the Galaxy Note10 and Note10+ to get the latest Android flavor. According to a report by  SamMobile , the two late-2019 Samsung flagships are receiving the Android 10 update in Germany, although the rollout is limited to a small group of beta testers. This stable release follows a  five-round beta testing  that concluded just a couple of days ago. Samsung is rolling out the stable build only to its beta testers in Germany to possibly look out for any major bug. Besides SamMobile, the confirmation also comes from  some Redditors  who got the update in Germany just a few hours back. The same Reddit users also mention that Google Pay remains broken even after installing this final Android 10 firmware, although it wasn’t immediately clear how widespread t...
Read more