Do you use the app "ShareIt?"
It's one of the most popular apps in the ecosystem, boasting more than a billion downloads from Google's Play Store and nearly 2 billion downloads overall (including the Windows, iOS and MacOS ecosystems). On top of that, its original creator, Lenovo, preinstalled it on all Lenovo phones, which may have been the means by which you first encountered the app.
All that to say, ShareIt a hugely popular app and was in the top ten most frequently downloaded titles in 2019, so it has an enormous footprint. As one can see on their website.
Recent security audit found issues
Recently, Trend Micro conducted a security audit of the app, and their findings may make you rethink your use of it. According to the report the company published not long after their research was complete, they found several major security flaws that would allow for arbitrary code execution, which could result in the complete compromise of the target system.
Unfortunately, the security issues stem from a number of unfortunate design decisions that left the software incredibly vulnerable. One example of this is the fact that the app demands extensive permissions that gives it complete control over the entire storage system, access to all media files on the device, the ability to install or delete apps, create accounts, and more.
Adding to the problems with the app is the fact that its 'private storage' mechanism is anything but. An analysis of the code reveals that the 'android:exported' variable is set to False, but the AndroidGrantUriPermissions variable is set to True, which means that literally any third party entity can gain temporary read/write access to the user's data.
My perspective
Trend Micro shared their findings with SHAREit's development team more than three months ago, and to date, the developers have not patched any of them. So it's as vulnerable today as it was when Trend Micro first published their report. And the issues that caused them to be banned in India may still be an issue. If you are a current user, you may want to consider uninstalling it until the company tightens up their security.
~ Captain might have said: "What we've got here is a failure to communicate" ~
By Denis Wilson
Thanks for reading this short post. For more tips on thriving with small business technology, check out the other blog posts at DWPIA Blogs. You can also find me on LinkedIn, Facebook, and Twitter.
I am also a published author and speaker on cloud computing, work@home, and cybersecurity. I work extensively with business and professional associations to provide small business technology education programs.
Contact me if you would like me to speak to your association
