CVE-2020-35455
📋 TL;DR
The Taidii Diibear Android application versions 2.4.0 and derivatives store user credentials insecurely in Shared Preferences and SQLite databases, allowing attackers with physical or malware access to the device to extract login information. This affects all users of the vulnerable application versions on Android devices.
💻 Affected Systems
- Taidii Diibear Android application
📦 What is this software?
Diibear by Taidii
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain full access to user accounts, potentially compromising sensitive personal data, financial information, or enabling identity theft and unauthorized transactions.
Likely Case
Local attackers or malware on the device extracts stored credentials, leading to account takeover and potential data exposure.
If Mitigated
With proper credential encryption and secure storage practices, credentials remain protected even if local storage is accessed.
🎯 Exploit Status
Exploitation requires local access to the device or malware installation. Public GitHub repository demonstrates credential extraction techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None found
Restart Required: No
Instructions:
1. Check Google Play Store for application updates. 2. If no update is available, uninstall the application until a secure version is released.
🔧 Temporary Workarounds
Uninstall vulnerable application
androidRemove the Taidii Diibear application from affected devices
adb uninstall com.taidii.diibear
Disable application permissions
androidRevoke all permissions from the application in Android settings
🧯 If You Can't Patch
- Isolate affected devices from sensitive networks and data
- Monitor for suspicious account activity and implement multi-factor authentication where possible
🔍 How to Verify
Check if Vulnerable:
Check application version in Android settings or Google Play Store. If version is 2.4.0 or unknown derivative, assume vulnerable.Check Version:
adb shell dumpsys package com.taidii.diibear | grep versionNameVerify Fix Applied:
Verify application has been updated to a version later than 2.4.0 or has been removed from the device.📡 Detection & Monitoring
Log Indicators:
- Unusual access to application data directories
- Suspicious file reads from /data/data/com.taidii.diibear/
Network Indicators:
- Unexpected authentication attempts from new devices
- Account login from unusual locations
SIEM Query:
process:adb AND (command:shell OR command:pull) AND path:*com.taidii.diibear*