Critical Flaws in Intel’s Remote Keyboard App for Android Lead to its Discontinuation.
As is the norm with security researchers, when bugs are discovered in any software especially the critical ones, software vendor issues an apology and releases a security update after fixing the flaw. People update the software and carry on with using it.
But, one of the apps from Intel has such severe flaws that the company decided to discontinue the app for good instead of developing patches. Intel’s Remote Keyboard app for Android came under the hammer after security researchers identified three different exploits of critical nature.
In a security alert from Intel, it is stated that the app contains three critical flaws that let hackers hijack the connection (if on the same network) and plague affected Android devices with malicious code and keystrokes.
The app was used in combination with Intel NUC (next unit of computing) mini-PCs and the small-sized Intel Compute Stick devices. Through the app, users were able to wirelessly control the small-form devices via Wi-Fi Direct protocol using their smartphones.
When researchers notified Intel about the flaws, the company issued a statement announcing the discontinuation of the app:
“Intel has issued a Product Discontinuation notice for Intel Remote Keyboard and recommends that users of the Intel Remote Keyboard uninstall it at their earliest convenience.”
Hence, there is no doubt about the fact that Intel won’t be fixing the issues so, users are left with no other choice but to delete the app immediately.
The app has been removed from Apple App Store and Google Play Store as well. On Google Play Store it had over 500,000 downloads. But in comparison to other apps, this figure is quite average. Is this the reason why Intel decided to give up on this app totally.. we may never know! But, according to an Intel representative, the app was already scheduled for discontinuation and the decision was taken before the discovery of flaws.
The identified flaws are as follows:
1. CVE-2018-3641: This flaw lets a network attacker inject the machine with keystrokes by appearing as a local user.
2. CVE-2018-3645: It lets a local attacker hijack another remote keyboard session by injecting keystrokes.
3. CVE-2018-3638: The flaw allows an authorized local attacker become a privileged user and execute arbitrary code.
The flaws would lead to providing escalation of privilege to an attacker at both local and remote level. On the CVE risk scale, out of ten, the flaws have been rated as 9.0, 8.0 and 7.2 respectively. All versions of Remote Keyboard app are affected by the flaws, which mean the bug is deeply embedded in the app’s code.
It is although true that Compute Stick and NUC users were more than happy with the app and would be facing some issues now that it has been discontinued. However, alternative apps are available for Android and iOS systems. As far as the infected devices are concerned, it is possible to connect to them using wireless keyboard and mouse.
