# Man-in-the-disk: New vulnerability has put millions of Android phones at risk (HT Tech) > Thanks to ‘careless’ usage of external storage by certain apps, millions of Android users are left vulnerable to cyber threats, said Checkpoint researchers. Here’s everything you need to know about Man-in-the-disk flaw. # Man-in-the-disk: New vulnerability has put millions of Android phones at risk ## Thanks to ‘careless’ usage of external storage by certain apps, millions of Android users are left vulnerable to cyber threats, said Checkpoint researchers. Here’s everything you need to know about Man-in-the-disk flaw. Aug 13 2018, 13:46 IST ![Follow on Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/follow-us-facebook.png) ![Follow on Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/follow-us-facebook-hover.png) ![Share](https://images.hindustantimes.com/tech/static/revamp/images/png/Share.png) ![Share](https://images.hindustantimes.com/tech/static/revamp/images/png/Shareclicked.png) ![Share on WhatsApp](https://images.hindustantimes.com/tech/static/revamp/images/png/whatsapp.png) ![Share on WhatsApp](https://images.hindustantimes.com/tech/static/revamp/images/png/whatsapp-hover.png) ![Share on Twitter](https://images.hindustantimes.com/tech/static/revamp/images/png/twitter.png) ![Share on Twitter](https://images.hindustantimes.com/tech/static/revamp/images/png/twitter-hover.png) ![Share on Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/facebook.png) ![Share on Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/facebook-hover.png) ![Bookmark](https://images.hindustantimes.com/tech/static/revamp/images/png/Bookmark.png) ![Bookmarked](https://images.hindustantimes.com/tech/static/revamp/images/png/Bookmarked.png) ![Everything you need to know about the Man-in-the-Disk attack](https://images.hindustantimes.com/tech/rf/image_size_960x540/HT/p2/2018/08/13/Pictures/cyber_1fb9c932-9ecf-11e8-851c-9c4102be3c4e.jpg) Everything you need to know about the Man-in-the-Disk attack (Reuters) ![Author Photo](https://images.hindustantimes.com/tech/static/revamp/images/png/HTTech-new-circle-logo.png) ### By KUL BHUSHAN Mobile handsets, especially the Android platform, have long been targeted by the cyber criminals. But most of the vulnerabilities or exploits have revolved around the software. Of late, the trend is changing with critical security flaws being found at the chipset levels. Now, security researchers have discovered a new flaw in the external storage that houses microSD cards. The vulnerability, aptly dubbed as Man-in-the-disk, has put millions of Android phones at risk, reported security firm Checkpoint. Unfortunately, there's very little that users can do to protect themselves from this exploit. According to the researchers, the loophole is mainly because the Android applications have been "careless" about how they handle their data on these external storages. "Through our research analysis we have witnessed cases where an app was downloaded, updated or received data from the app provider's server, which passed through the External Storage before being sent on to the app itself - as seen in the diagram on the left. Such practice offers an opportunity for an adversary to manipulate the data held in the External Storage before the app reads it again," wrote the researchers in their blog post. Also read click here. Interesting enough, a lot of apps that were tested for this vulnerability are from Google itself. The list of Google apps includes Google Voice Typing and Google Translate among others. The researchers also discovered that Xiaomi's native browser was using external storage and that they were able to "carry out an attack by which the application's update code was replaced, resulting in the installation of an alternative, undesired application instead of the legitimate update." Google Translate crashes after compromising of certain files required by the app. (Check point) ![image caption](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-245-140.png) Google Translate crashes after compromising of certain files required by the app. (Check point) Researchers also stressed that they could not identify who is really at fault for the critical security flaw. "On the one hand, although Android's developers have created guidelines to app developers on how to ensure their apps are safe, they must also be aware that it is well known for developers to not build their applications with security front of mind. On the other hand, and being aware of this foresaid knowledge, is there more Android could be doing to protect their operating system and the devices that use it?," they added. Note that most of the applications use internal storage for their data. The external storage is mainly used for sharing and store files. But some Android developers may use external storage to for their apps as they may not want the app to take too much space on the phone or just not paying enough attention. Catch all the Latest Tech News, Mobile News, Laptop News, Gaming news, Wearables News , How To News, also keep up with us on Whatsapp channel,Twitter, Facebook, Google News, and Instagram. For our latest videos, subscribe to our YouTube channel. 13 Aug, 13:37 IST million android phone risk mobile handset microsd card android platform cyber criminal google google translate external storage android application google app android phone at risk new vulnerability million of android phone man-in-the-disk ![HT Tech Awards](https://tech.hindustantimes.com/ht-tech-power-list-awards-2026/httech-awards-banner-new.webp) 71,589,383,947,701 NEXT ARTICLE BEGINS ![View all](https://images.hindustantimes.com/tech/static/revamp/images/png/view-all-icon.png) ## Tips & Tricks ![Ghibli-style art](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### How to turn your photos into Ghibli-style art with ChatGPT for free: Step-by-step guide ![How to create an invitation using iPhone’s new Apple Invites app- Step-by-step guide](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### How to create an invitation using iPhone’s new Apple Invites app- Step-by-step guide ![Apple TV app arrives on Android phones and tablets: What you get and how to install it](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Apple TV app arrives on Android phones and tablets: What you get and how to install it ![Vodafone Idea OTT plans](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Vodafone Idea users can now stream 17 OTT apps with one subscription: Here's how ![Android data transfer methods](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### How to transfer data from one Android to another using Google backup, USB-C cable, and more ## Editor’s Pick ![iPhone 16e launched with A18 chip, Apple AI—bringing flagship power on a budget: Check specs, price](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### iPhone 16e launched in India: All details about the new budget mobile from Apple ![DeepSeek was founded in China with only a fraction of the budget of the top AI companies in the US.](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### DeepSeek AI: How it works, who’s behind it, how it’s different from ChatGPT, and its big US market impact explained ![iPhone 17 Air likely to get this feature that iPhone 17 Pro models may miss out on](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### iPhone 17 Air likely to get this feature that iPhone 17 Pro models may miss out on ![Google Whisk AI explained: How remixing works, availability, and how it differs from Gemini](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Google Whisk AI explained: How remixing works, availability, and how it differs from Gemini ![iOS 18.4 beta arriving soon: Know why it is the biggest iPhone update](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### iOS 18.4 beta arriving soon: Know why it is the biggest iPhone update ## Trending Stories ![Airtel 5G SIM card will now be delivered in 10 minutes with Blinkit- How to order](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Airtel 5G SIM card will now be delivered in 10 minutes with Blinkit- How to order ![Infinix Note 50s 5G+](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Infinix Note 50s 5G+ set to launch in India with 64MP camera and MediaTek Dimensity 7300 SoC ![Xiaomi X Pro QLED Series sale starts in India: Check price, availability, and more](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Xiaomi X Pro QLED Series sale starts in India: Check price, availability, and more ![Apple Intelligence AI training](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Apple plans to train AI using your on-device data without accessing personal content or emails: Report ![CMF Buds 2](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### CMF Buds 2 key features and price revealed ahead of April 28 launch: Details inside keep up with tech ![Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/tech-facebook.png) ![Twitter](https://images.hindustantimes.com/tech/static/revamp/images/png/tech-twitter.png) ![WhatsApp](https://images.hindustantimes.com/tech/static/revamp/images/png/tech-whatsApp.png) ![Facebook](https://images.hindustantimes.com/tech/static/revamp/images/png/tech-facebook.png) ## Gaming ![Check out these five gaming monitors under ₹20,000,](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Top 5 gaming monitors under ₹20000 you should consider ![gaming consoles](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Grab gaming consoles at discounted rates during Amazon Great Indian Festival: Up to 72% off ![Pokémon GO Wild Area 2025](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Pokémon GO Wild Area 2025 to bring Grimmsnarl family, Shiny Hatenna, and global challenges ![Shade Silver](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Shade Silver free on Steam for a limited time: Here’s how to get it ![Call of duty](https://images.hindustantimes.com/tech/static/revamp/images/png/ht-tech-bg-img-90-66.png) ### Call of Duty: Black Ops 7 skips Switch 2 at launch, release date and price leak ![View all](https://images.hindustantimes.com/tech/static/revamp/images/png/view-all-icon.png) ## Trending News ### Airtel 5G SIM card will now be delivered in 10 minutes with Blinkit- How to order ![Airtel 5G SIM card will now be delivered in 10 minutes with Blinkit- How to order](https://images.livemint.com/static/static/1x1_img.gif) ### Infinix Note 50s 5G+ set to launch in India with 64MP camera and MediaTek Dimensity 7300 SoC ![Infinix Note 50s 5G+](https://images.livemint.com/static/static/1x1_img.gif) ### Xiaomi X Pro QLED Series sale starts in India: Check price, availability, and more ![Xiaomi X Pro QLED Series sale starts in India: Check price, availability, and more](https://images.livemint.com/static/static/1x1_img.gif) ### Apple plans to train AI using your on-device data without accessing personal content or emails: Report ![Apple Intelligence AI training](https://images.livemint.com/static/static/1x1_img.gif) ### CMF Buds 2 key features and price revealed ahead of April 28 launch: Details inside ![CMF Buds 2](https://images.livemint.com/static/static/1x1_img.gif) ## Trending Gadgets Mobiles Laptops Tablets ![HT Tech](https://images.hindustantimes.com/tech/static/revamp/images/png/HT_tech-new.gif) - https://tech.hindustantimes.com/tech/news/man-in-the-disk-new-vulnerability-has-put-millions-of-android-phones-at-risk-story-Algv5ywSJNoZAVmWkTVBSM.html