The flaws, which are yet to be assigned CVSS scores, mean attackers can exploit the absence of authentication logic and the fact that information is sent in cleartext to “maximize or minimize the window of a running process by sending the process name in a crafted packet” ( CVE-2021-27569).Īccording to the researcher, an attacker would also be able to “close any running process by sending the process name in a specially crafted packet” ( CVE-2021-27570), and “retrieve recently used and running applications, their icons, and their file paths” ( CVE-2021-27571).
#Best remote mouse app update#
We will update this article should there be any further developments. The Daily Swig also sent queries to Emote Interactive on May 7 and we’ve yet to receive a reply. The researcher says he found the flaws in Remote Mouse version 3.015, and that they were still present in version 4.0.0.0, which has been released since he alerted the vendor.Īs of today (May 10), he told The Daily Swig that Emote Interactive, which appears to be based in Hong Kong, had still not replied to his email alerting them to the vulnerabilities on February 6. “There are a lot of oblivious users who could be completely owned without ever realizing,” said Persinger. And the exploit would run at the privilege level of the user”, the researcher told The Daily Swig. The app’s developer, Emote Interactive, claims it has been used by more than 20 million users worldwide.ĭuring his research, Persinger found that the absence of a nonce in User Datagram Protocol (UDP) packets sent from devices to desktop PCs means attackers can “freely inject keystrokes” with no user interaction.Įxploitation of the vulnerabilities in the application protocol can potentially “result in the complete takeover of someone’s machine, if they’re running the software.
#Best remote mouse app windows#
Remote Mouse simulates the functions of a mouse, keyboard, and touchpad on Windows, macOS, and Linux machines, and is compatible with iOS, Android, and Windows mobile devices.
#Best remote mouse app code#
Six zero-day vulnerabilities in Remote Mouse, a hugely popular app that turns tablets and smartphones into remote controllers for desktop PCs, could potentially lead to zero-click remote code execution (RCE).Ĭollectively dubbed ‘MouseTrap’, the security flaws arise from the use of authentication with a password hash that can be intercepted and looked up in a rainbow table, and the absence of encryption and cryptographic nonces in communications, according to a blog post published by security researcher Axel Persinger on May 5. Remote control app for desktop PCs has surpassed 20m users, says vendor
0 kommentar(er)
