Vulnerability (?) And shadowing in a Bluestacks emulator?
Two days have passed this week, but there are no major scandals yet. The bog began to become dull. Let's talk about Bluestacks, the Android emulator. The developers claim that it was installed by 90,000,000 people. Well, let me try to throw mud at the Bluestacks.
Once I was looking for my password file on disk. Entered the password, which remembered, and asked to search in fresh files. 2 files were found: the password file and the file in the “\ BlueStacks \ Android \ Data.sparsefs \” folder.
After praying to Athena to give me wisdom and patience, I proceeded with the preparation. Result: BlueStacks intercepts and records keyboard operations that are not addressed to it.
')
I made a few Ctrl + C in Windows Notepad. Then you need to close the main window of the emulator with a regular cross (otherwise the emulator will not record the results of the interception in the file). Then you need to kill ALL of its processes by the taskkiller. What did I find in “\ BlueStacks \ Android \ Data.sparsefs \”? Right. There were also 20-character passwords with which I sign the APK and other “Ctrl + C” from the past. Maybe there is not only a clipboard, but also just a stream from the keyboard, only encrypted? I do not know how to check.
But everything indicates that Blustek members will not be discarded, saying that the recording of your data goes for debugging in the case of crashes. I repeat: the interception is written to the file only with the normal completion of the program.
Made a video on the topic:
yadi.sk/i/G4mLHmMniptzD
If you dig deeper, you will see in BlueStacks interception of pages and data from Internet Explorer and Firefox. Probably there are time stamps and you can match the clipboard and URL.
Praise to Mercury, the god of communications and thieves! I found another pleasant surprise: if you plug a USB flash drive into your computer, its structure is recorded in BlueStacks files (at least the names of files and folders, and maybe dates in binary form).
BlueStacks components require Internet access. And Bluestacks starts the process “svhost / HTTP protocol SSL / HTTPFilter”. To whom and what leaks? I do not understand the network protocols, who are familiar with Fiddler / Wireshark, please indicate what is being transmitted there. On the surface, a freshly installed emulsion communicates with a dozen IP ranges.
Emul can work with a microphone and a video camera of a computer, who knows, maybe Bluestacks surpass Windows 10 and this week will go down in the annals of history.
Educational program for the victims of the exam: "I finished" - the formula for the end of the speech of the ancient Roman senators. Not what you thought. How has the Russian language been used for these 15 years!
Once I was looking for my password file on disk. Entered the password, which remembered, and asked to search in fresh files. 2 files were found: the password file and the file in the “\ BlueStacks \ Android \ Data.sparsefs \” folder.
After praying to Athena to give me wisdom and patience, I proceeded with the preparation. Result: BlueStacks intercepts and records keyboard operations that are not addressed to it.
')
I made a few Ctrl + C in Windows Notepad. Then you need to close the main window of the emulator with a regular cross (otherwise the emulator will not record the results of the interception in the file). Then you need to kill ALL of its processes by the taskkiller. What did I find in “\ BlueStacks \ Android \ Data.sparsefs \”? Right. There were also 20-character passwords with which I sign the APK and other “Ctrl + C” from the past. Maybe there is not only a clipboard, but also just a stream from the keyboard, only encrypted? I do not know how to check.
But everything indicates that Blustek members will not be discarded, saying that the recording of your data goes for debugging in the case of crashes. I repeat: the interception is written to the file only with the normal completion of the program.
Made a video on the topic:
yadi.sk/i/G4mLHmMniptzD
If you dig deeper, you will see in BlueStacks interception of pages and data from Internet Explorer and Firefox. Probably there are time stamps and you can match the clipboard and URL.
Praise to Mercury, the god of communications and thieves! I found another pleasant surprise: if you plug a USB flash drive into your computer, its structure is recorded in BlueStacks files (at least the names of files and folders, and maybe dates in binary form).
BlueStacks components require Internet access. And Bluestacks starts the process “svhost / HTTP protocol SSL / HTTPFilter”. To whom and what leaks? I do not understand the network protocols, who are familiar with Fiddler / Wireshark, please indicate what is being transmitted there. On the surface, a freshly installed emulsion communicates with a dozen IP ranges.
Emul can work with a microphone and a video camera of a computer, who knows, maybe Bluestacks surpass Windows 10 and this week will go down in the annals of history.
Educational program for the victims of the exam: "I finished" - the formula for the end of the speech of the ancient Roman senators. Not what you thought. How has the Russian language been used for these 15 years!
Source: https://habr.com/ru/post/265943/
All Articles