Experts have discovered vulnerabilities in cloud keyboard applications

The Citizen Lab team analyzed the security of nine vendors' cloud keyboard apps and tested their keystroke transmission for vulnerabilities. Only 1 solution provider had no exploits detected.

Tech Apr 28, 2024 0 40499 Add to Reading List

Experts have discovered vulnerabilities in cloud keyboard applications

Citizen Lab experts have discovered vulnerabilities in cloud-based keyboard applications.

Analysis methodology

The Citizen Lab research group, based at the Munk School of Global Affairs and Public Policy at the University of Toronto, analyzed the security of cloud-based keyboard apps from 9 manufacturers, including Baidu, Honor, Huawei, iFlytek, OPPO, Samsung, Tencent, Vivo and Xiaomi. The main goal of the specialists was to check the transmission of keystroke data for possible vulnerabilities.

These vendors were chosen because they have integrated cloud recommendation functionality into their products and their solutions are widely used.

During the study, specialists used both static and dynamic analysis methods. Jadx was used to decompile and statically analyze Dalvik bytecode, and IDA Pro was used to decompile and statically analyze native machine code. A Citizen Lab tool called Frida was used for dynamic analysis of the Android and iOS versions, and IDA Pro was used for dynamic analysis of the Windows version. Wireshark and Mitmproxy were used to collect and analyze network traffic.

Analysis results

The study identified critical vulnerabilities in keyboard applications from 8 out of 9 manufacturers. These vulnerabilities allow attackers to fully disclose the contents of user keystrokes as they are transmitted. The only exception is Huawei - no vulnerability was found in this manufacturer.

Brief description of vulnerabilities found in popular keyboards and in keyboards pre-installed on popular phones: ✔—no known issues, ✘✘—working exploit designed to decipher transmitted keystrokes for both active and passive listening devices, ✘—working exploit , designed to decipher transmitted keystrokes for an active listening device, N/A - the product is not offered or does not exist on the analyzed device.

In an analysis, researchers from Citizen Lab estimated that up to 1 billion users could be affected by these vulnerabilities. Given the wide reach of exploits, the sensitivity of the information users enter on their devices, and the ease of detection of these vulnerabilities, they can be used by attackers to monitor user activity.

Experts notified all 9 manufacturers about the vulnerabilities found. Most of them took this information seriously and took measures to eliminate the discovered vulnerabilities. However, some keyboard apps are still vulnerable.