CVE-2017-15999
📋 TL;DR
This vulnerability allows attackers to intercept login credentials and contact data transmitted by the NQ Contacts Backup & Restore Android app. The app transmits usernames in plaintext and password hashes without HTTPS encryption, enabling credential theft and unauthorized access. All users of version 1.1 are affected.
💻 Affected Systems
- NQ Contacts Backup & Restore
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of user contact data, credential theft enabling account takeover, and potential identity theft or phishing campaigns using stolen contact information.
Likely Case
Credential harvesting leading to unauthorized access to the backup service and exposure of sensitive contact information.
If Mitigated
Limited impact with proper network controls, though credentials remain vulnerable to local network attackers.
🎯 Exploit Status
Attack requires network position to intercept traffic (MITM). SHA-1 password hashes can be cracked offline or replayed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None known
Restart Required: No
Instructions:
No official patch available. Users should uninstall the vulnerable version and seek alternative contact backup solutions.
🔧 Temporary Workarounds
Force HTTPS via VPN
androidRoute all app traffic through a VPN that forces HTTPS connections and prevents HTTP traffic.
Network-level HTTPS enforcement
allConfigure network firewalls or proxies to block HTTP traffic from the app and force HTTPS connections.
🧯 If You Can't Patch
- Uninstall the application immediately and use alternative contact backup solutions
- Never use the app on untrusted networks (public Wi-Fi, cellular data)
🔍 How to Verify
Check if Vulnerable:
Check app version in Android settings > Apps > NQ Contacts Backup & Restore. Version 1.1 is vulnerable.Check Version:
Not applicable - check via Android UIVerify Fix Applied:
Verify app is uninstalled or updated to a version that uses HTTPS for all network communications.📡 Detection & Monitoring
Log Indicators:
- HTTP traffic to NQ backup servers containing login credentials or contact data
Network Indicators:
- Cleartext HTTP traffic containing 'login' parameters or contact data from the app
SIEM Query:
source_ip=* AND dest_port=80 AND (http_user_agent CONTAINS 'NQ' OR http_uri CONTAINS 'login')