What is Man-in-the-Disk Attack?

So, what exactly is Man-in-the-Disk? How does it work? And how can you protect your device from it?

What is Man-in-the-Disk Attack?

Man-in-the-Disk is a type of cyberattack on Android devices in which malware installed on a smartphone or tablet targets a smart app. through files located in external memory.

The malicious code then executes when the user tries to access those files, allowing the attacker to take control of the device more broadly. This attack is possible because Android allows apps to read and write data to external storage by default.

External storage is used for different purposes, such as storing music, videos, and pictures. However, it also provides a way for malware to persist on the device, even after a factory reset of Android.

Once attackers gain access to external storage, they can modify or delete files, insert malicious code into legitimate apps, or install new apps without the user's knowledge.

The Man-in-the-Disk attack is closely related to the concept of a Man-in-the-Middle (MitM) attack.

What is Sandbox in Android?

To understand the Man-in-the-Disk attack, you first need to know how apps and their data are stored on Android devices.

One of the main security features of the Android operating system is the sandbox. The idea of ​​the sandbox is to separate each installed application and its files from other installed applications.

So, whenever you install an app on your Android device, that app is stored in an isolated area called the sandbox. Each application resides in a separate sandbox that cannot be accessed by other installed applications.

The advantage of sandboxing is that even if a malicious app finds its way into your Android device, it won't be able to change and steal data from other legitimate apps like banking, social networking apps. , etc.

This way, your essential data, such as financial details, login information, etc., remains protected despite the presence of malware. However, cyber attackers have succeeded in exploiting the sandbox method using the Man-in-the-Disk attack.

How does the Man-in-the-Disk attack work?

As discussed above, Android uses a sandbox to store applications and their files. However, in addition to the sandbox, Android also has shared storage called external storage.

When you install some apps, they may ask you for permission to use external storage. Permissions look like this - "Allow [App Name] to access photos, media, and files on your device?" .

What is Man-in-the-Disk Attack? Picture 1

By granting this permission, you are actually allowing the application to read and write on your external storage. In general, this is considered safe and almost every application requires it. In fact, many applications require it to temporarily store their downloaded data on external storage before transferring it to the sandbox.

For example, when you update an application, new modules are first downloaded on external storage and then added to a separate sandbox. This is where the Man-in-the-Disk attack comes into play.

The Man-in-the-Disk attack works by exploiting a vulnerability in the way Android handles external storage. Unlike sandboxes, any application that has read/write permissions to external storage can modify any files contained therein. So even if the files of some apps are only temporarily stored in external storage, illegal apps installed by intruders can modify them and insert malicious code.

This means that while updating a legitimate app, you may not even know that you have accidentally introduced malware onto your device. When you try to launch the application, the malicious code will execute and the attacker will gain control of the device.

How to Protect Devices from Man-in-the-Disk Attacks

Now that you know how the Man-in-the-Disk attack works, you need to know how you can protect your device from it. There are several things you can do to protect yourself from a Man-in-the-Disk attack:

1. The best way to stay protected from this attack is to never grant read/write permissions to any applications that don't actually need it. When an app asks for this permission, think twice before granting it.
2. Second, you should always install apps from trusted sources like the Google Play Store. Avoid downloading and installing apps from third-party websites and app stores as they can host malicious apps.
3. Revoke permissions you gave to apps that you rarely use.
4. On your Android device, disable the permission to install apps from unknown sources.
5. Keep your Android device up to date with the latest security patches released by the manufacturer. These security patches address vulnerabilities in the operating system and prevent attackers from exploiting them.
6. You must use can comprehensive protection against all types of malware and cyber threats.
7. Uninstall apps that you no longer need. Also, don't install apps you don't really need. The fewer apps on your device, the less chance of being exploited for vulnerabilities.

As an Android app user, here are essential tips you must keep in mind to reduce the possibility of Man-in-the-Disk attack on your device.

How can developers protect apps from Man-in-the-Disk attack?

What is Man-in-the-Disk Attack? Picture 2

External storage is an essential part of the Android operating system, and so are its security holes. So if you're an Android developer, make sure you design your apps in such a way that they safely use external storage.

There are several things you can do to protect your apps from Man-in-the-Disk attacks:

1. Please carefully follow Google's "Best Practices" section of the app development guide. It contains a set of guidelines that developers must follow to design secure Android apps.

https://developer.android.com/guide

1. If you are storing sensitive data on external storage, encrypt it with a strong encryption algorithm. This will make it difficult for attackers to decrypt and use the data.
2. Request "WRITE_EXTERNAL_STORAGE" permission only when absolutely necessary. If your app doesn't require this, don't allow it.
3. Use Android's built-in security features, such as app permissions and sandboxing, to further secure your apps.
4. If your app doesn't require read/write permissions on external storage, don't declare it in your Manifest.

As an Android developer, it's your responsibility to design secure apps and protect your users' data from misuse. The Man-in-the-Disk attack is just one of many attacks that can pose a threat to your application and its users. So make sure you follow best practices for Android app development and secure your apps against all kinds of threats.

Should you worry about people-in-disk attacks?

Although the Man-in-the-Disk attack is a serious threat, you don't need to worry about it as long as you take the appropriate measures to protect your device.

Just remember to install apps from trusted sources, keep your device up to date, and use a trusted mobile security solution to stay safe from all types of malware and cyber threats .

If you're an Android developer, make sure you follow best practices for developing and protecting your apps against this attack. These simple measures will help you keep your device and data safe from Man-in-the-Disk attacks.

Lesley Montoya

Update 17 February 2023