DEF CON Ten now-fixed bugs in Google's Quick Share for Windows could have been exploited to wirelessly write new files to victims' computers without their consent, ultimately executing code remotely on those victims' machines by chaining together a handful of other vulnerabilities.
| Channel | Publish Date | Thumbnail & View Count | Actions |
|---|---|---|---|
 MONEY TALKS WIRELESS | 2023-02-22 13:00:31 |  1,826,943 Views |
He got virus on his phone 😱Fix it with a simple trick ✨#shorts #android #samsung #apple #iphone #fy
SafeBreach security research team leader Or Yair and senior security researcher Shmuel Cohen demonstrated the remote code execution (RCE) attack, called QuickShell, and at DEF CON today discussed the work that went into this project: Namely, examining Quick Share's communication protocol, fuzzing, and then manually searching for vulnerabilities and eventually create a complete RCE chain.
After sharing its findings with Google, the web giant issued two CVEs in June that cover the 10 Quick Share holes that SafeBeach discovered. These are CVE-2024-38271, an overload bug that received a 5.9 out of 10 CVSS severity rating, and CVE-2024-38272, an authorization bypass bug with a 7.1 CVSS score.
Google has fixed all the flaws and SafeBreach confirmed that the RCE chain is no longer possible to remove. Google declined to comment.
