CVE-2018-9489

Related Files

Android OS WiFi Broadcast Sensitive Data Exposure

Posted Aug 30, 2018

Authored by Yakov Shafranovich, Vilius Kraujutis | Site wwws.nightwatchcybersecurity.com

System broadcasts by Android OS expose information about the user's device to all applications running on the device. This includes the WiFi network name, BSSID, local IP addresses, DNS server information and the MAC address. Some of this information (MAC address) is no longer available via APIs on Android 6 and higher, and extra permissions are normally required to access the rest of this information. However, by listening to these broadcasts, any application on the device can capture this information thus bypassing any permission checks and existing mitigations.

tags | exploit, local, info disclosure

advisories | CVE-2018-9489

SHA-256 | 523ebc0e6847c2ff3858fa671185f0aded4e77fd712ecd694c1d059ae8df9760

Download | Favorite | View