Look, I’m sure that many Malaysians especially us tech reviewers are happy that the latest Google products were made officially available for the local market with the Pixel 9 series smartphone.
Yet the canary in the coal mine has surfaced from an innate app rather than a design flaw so it technically could happen to almost all Pixel devices directly out of the box.
According to TechBang, iVerify’s team of security researchers has discovered an Android security vulnerability revolving around the “Showcase.apk” app.
What does the app do? Well, pretty straightforward. Ever been to a roadshow in malls and centers where brands showcase their smartphones and the devices just keep on looping some videos and once you touch them they’ll show you some KSP?
Yes, the “Showcase.apk” is in charge of that in the context of Google Pixel devices.
The report also detailed the existence of the app as a “firmware embedded” application beginning in September 2017 alongside several major issues like the use of unsecured HTTP connections for config file download which a simple Man-in-the-Middle (MiTM) attack could intercept and deliver malicious code and backdoors into the system.
Yet one might think “Oh, Android has pretty layers of security and protection so it shouldn’t be too bad as long as the user is diligent about not clicking Yes in every permission request window right?”.
Oh no no, that’s not the case here. For some reason, the “Showcase.apk” is run with system-level privileges. And what can hackers do with that? Well, most likely, everything from modifying system settings, executing unsanitized commands, and loading maliciously crafted modules – the full RCA package if you may.
At the time of writing, it is unsure how Google will tackle this issue since the “Showcase.apk” has been implemented in a way that uninstallation was not allowed at the surface level. However, they do have a 90-day window to plan for this according to industry disclosure practices.
As a user, it is advised that you temporarily stop using the device if you’re a high-profile individual with major security clearance in your industry as leaking confidential data/trade secrets/insider info would have cost your entire career.
On the other hand, since there are several methods created by the Android community to uninstall any app from a device via some convoluted and “techie” way, perhaps you can give that a try and kick the bucket for the Showcase function. You certainly don’t need it anyway.
Like our Facebook Page here at NasiLemakTech.com for more news and in-depth reviews! Also, join our Facebook Group for insightful information and memes!
Subscribe to our YouTube channel too!
