Mobile apps used by the Trump and Biden campaigns could be manipulated using a known Android vulnerability, cyber researchers warn.
According to a video demonstration published today by experts from Norwegian mobile security company Promon, the software is open to attack via a bug called StrandHogg, which can be abused by malicious hackers to put fake overlay screens over apps and steal sensitive information, including usernames and passwords.
In a test showing how such an attack could appear in the real world, the team was able to exploit the bug and insert a picture overlay on the Biden campaign app.
After the hack had taken place, it showed an image of the Democrat candidate wearing a red "Make America Great Again" hat alongside a caption that read "vote for Trump." The results of the research were not encountered by real users of either app.
The investigation was sparked by a viral statement made by Trump during a campaign rally in Arizona on Monday. He was referencing the suspension of C-SPAN political editor Steve Scully, who was placed on administrative leave by the network last week after admitting to lying about his personal Twitter account being hacked.
"Nobody gets hacked. To get hacked you need somebody with 197 IQ and he needs about 15 percent of your password," the president told a crowd of supporters, instantly raising the eyebrows of experts working in the fields of tech and cybersecurity.
In a video demonstration posted to YouTube today, Promon researchers used the hack to put a screen overlay over the Trump app that read "chip in to help elect Joe" with an embedded hyperlink re-directing to the legitimate Biden-Harris donation website.
"Absolutely nothing is 'unhackable' and even the most secure, high profile accounts are vulnerable should the user fall victim to a phishing attack which seeks usernames and passwords," said Tom Lysemose Hansen, chief technology officer at Promon.
"'Nobody gets hacked' is simply untrue and, given the influence of the president, can have dangerous impacts on the behavior of hundreds of thousands of people."
If exploited in the wild, StrandHogg lets hackers pose as real apps with users unaware they are being targeted, the company explained in an advisory. The company suggested that at least 36 malicious apps were previously found to be exploiting the vulnerability.
The team previously said the bug can allow attackers to listen to users via their device microphone, take photos through its camera and read text messages. In May this year, Promon said the mobile malware had evolved to become ever harder to detect.
"We would advise that users always keep their devices up-to-date and running the latest firmware and that they only download apps [made] by trusted developers," Lysemose Hansen said. "One way to check this is to see if the developer has created any other apps and check the reviews for any and all apps they have developed.
"While neither of these apps contain sensitive data or personally identifiable information, for other security-sensitive apps—such as banking or medical apps—implementing protocols that prevent spyware from spoofing or recording what happens on the app's screen is crucial if developers are to prevent hackers from targeting users."
The Biden and Trump campaigns have been contacted for comment by Newsweek.
Uncommon Knowledge
Newsweek is committed to challenging conventional wisdom and finding connections in the search for common ground.
Newsweek is committed to challenging conventional wisdom and finding connections in the search for common ground.
About the writer
Jason Murdock is a staff reporter for Newsweek.
Based in London, Murdock previously covered cybersecurity for the International Business Times UK ... Read more
