Mobile developers have discovered an easy way to replace a genuine Windows Phone with a non-genuine one that inherits data access permissions.
The method is simple and only requires transferring the malicious application's installation data to the target program's directory.
In version 8.1 of Microsoft 's mobile operating system , users have the ability to sideload apps from an SD card, which is necessary for this particular hack and was discovered by a member of the XDA-Developers forum with the nickname "djamol."
The member states that the first step is to create the same manifest for the malicious app as for the genuine one. The user then needs to install both apps on the device.
Then the user should follow the simple process of replacing the files in the program directory (Install, NI, TempInstall, TempNI, XBP, etc.) of the valid software with the content from the custom application.
After that, the custom app will run with the same permissions as the original one. The developer tested the hack on a Nokia Lumia.
The forum post reveals that a registry tool signed by Djamol has also been developed, and it allows the writing of registry values with the transferred permissions.
The discovery of this security flaw could pave the way for malicious activities targeting Windows Phone users.
