# Hackers can easily Hack into Android smartphones running Android 4.3 & earlier **URL:** \ **Category:** Tutorials & Methods\ **Tags:** hacking, android\ **Created:** [February 13, 2020, 4:36pm UTC](https://onehack.st/t/hackers-can-easily-hack-into-android-smartphones-running-android-4-3-earlier/69506 "2020-02-13T16:36:53Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![Ze380y](https://onehack.st/user_avatar/onehack.st/ze380y/32/48760_2.png) [@Ze380y](https://onehack.st/u/Ze380y)\ **Post date:** [February 13, 2020, 4:36pm UTC](https://onehack.st/t/hackers-can-easily-hack-into-android-smartphones-running-android-4-3-earlier/69506/1 "2020-02-13T16:36:53Z")
Around 900 million **Android** users are still using smartphones running Android 4.3 (Jellybean) and Older versions. That’s roughly 60 per cent of the total Android users worldwide and that’s a huge user base. Unfortunately, all these smartphones running older versions of Android are vulnerable and hackers can easily _ **hack** _ into these smartphones by installing [_malware_](http://www.hacker9.com/bitcoin-money-adder.html) or [_spyware_](http://www.hacker9.com/win-spy-pro-android-spy-software.html) remotely. By taking advantage of the available vulnerabilities, an attacker or hacker can exploit any smartphone running Android version 4.3 or older and install malicious applications remotely that can [monitor all the activities of the user](http://www.hacker9.com/cell-phone-tapping.html), steal sensitive information OR can give full control of the smartphone to the _hacker_ . The worst part is, these vulnerable Android users may never get any _security_ updates or patches for these vulnerabilities as [Google has openly refused to concede](https://community.rapid7.com/community/metasploit/blog/2015/01/11/google-no-longer-provides-patches-for-webview-jelly-bean-and-prior) its position by saying, It will not release any patch for the vulnerability found in older versions of android. However, if any 3rd party develops a patch, Google will incorporate those patches into the Android open source project code. ![image](https://onehack.st/uploads/default/original/3X/b/0/b09540cf69f771d19ae2317d627fd436a92d873b.jpeg) The two hot vulnerabilities that are making the rounds among Security researchers and Hackers are: **#1.**** Google Play Store X-Frame-Options (XFO) vulnerability** This _Vulnerability_ is found in the Google Play Store website ( _[play.google.com](http://play.google.com)_ ). The website lacks appropriate _X-Frame-Options_ (XFO) headers. XFO headers are optional HTTP response headers which are designed to protect against [clickjacking](http://www.hacker9.com/clickjacking-attack-things-you-must-know.html) and other types of attacks by preventing the web page from being displayed by other websites in a frame. Google Play Store fails to enforce this XFO header on some error pages. Since Google Play Store ( _[play.google.com](http://play.google.com)_ ) fails to enforce XFO headers on some error pages, The _hacker_ is able to embed any app page from [play.google.com](http://play.google.com) in another webpage lets say [hacker9.com/myexploit.html](http://hacker9.com/myexploit.html) which will give a certain fake error. When the user visits [hacker9.com/myexploit.html](http://hacker9.com/myexploit.html), he will see nothing but the blank page. Now if he clicks any portion of the webpage, the [**clickjacking attack**](http://www.hacker9.com/use-noscript-facebook-spam.html) will be launched forcing the user to click install button present on the [play.google.com](http://play.google.com) app page. Please note that the **hacker** is exploiting Google Play’s remote installation feature, which allows any Google user to _install_ any _app_ listed on [play.google.com](http://play.google.com) to his Android device by just clicking the install button. In short, if you’re logged into Google and have an Android phone linked to your account, the app will auto-install and auto-accept the permissions within seconds and you’ll never know it. **#2.**** Universal Cross-Site Scripting (UXSS) vulnerability** This vulnerability is found in the _WebView_ component of the stock Android web browser. **WebView** , a core component used to render web pages on an Android device uses a number of APIs which can interact with the web contents which allows the user to view a web app as a part of an ordinary Android application. Users can be infected when they click on a URL link using a vulnerable application that allows opening a Java enabled browser or web page. In _ **UXSS** _ attacks, client-side vulnerabilities are exploited in a web browser to generate an XSS condition, which allows the _malicious_ code to be executed, bypassing or disabling the security protection mechanisms in the web browser. According to _Tod Beardsley_ from [Rapid7](https://www.rapid7.com/), who is also a technical lead for the [Metasploit Framework](https://www.metasploit.com/), Combining these two **vulnerabilities** creates a way for hackers to install any arbitrary app from the Play store onto victims device even without the user’s consent. ## METASPLOIT Module for Hacking Android Smartphone **Rapid7** has created a **Metasploit** module that can be used to hack or test the affected **Android** devices for the two vulnerabilities. The module is publicly available on Github and according to the concerned researchers, This module combines the above two vulnerabilities to achieve remote _code_ execution on the target Android device. First, It will try to exploit a **‘Universal Cross-Site Scripting’** (UXSS) _vulnerability_ present in a stock web browser (the AOSP Browser). After that, the Google Play store’s web interface can be targeted for ‘script injection’ as Play store’s web interface fails to enforce an _ **X-Frame-Options** _ : DENY header (XFO) on some error pages. This leads to remote _code_ execution through Google Play’s remote installation feature, as any app available on the [Google Play store](http://www.hacker9.com/icon-packs-for-android.html) can be installed and launched on the user’s device without his/her consent. ## How not to get hacked? If you happen to be using the affected **Android** version, here are some mitigations for you: 1. Update your Android smartphone to the latest version. If the vender doesn’t have the latest version or discontinued the firmware support, consider installing Custom ROMS or _Cyanogenmod_ . 2. Use ‘Google Chrome’ or ‘Mozilla Firefox’ web browser. This could help mitigate the lack of universal X-Frame-Options (XFO) for the _[play.google.com](http://play.google.com)_ domain. 3. Another way is to simply stay logged out of the Google Play store account in order to avoid vulnerability. `Sources: hacker9, Rapid7, Tripwire` ---
**Author:** ![Az\_28az11](https://onehack.st/user_avatar/onehack.st/az_28az11/32/19790_2.png) [@Az\_28az11](https://onehack.st/u/Az_28az11)\ **Post date:** [February 14, 2020, 5:39am UTC](https://onehack.st/t/hackers-can-easily-hack-into-android-smartphones-running-android-4-3-earlier/69506/2 "2020-02-14T05:39:21Z")
@Ze380y my smart tv runs on android 4.2. what is your opinion on running such android custom roms on the smart tv?