Skip to main content

Security vulnerabilities in AirDroid allow access to private data and sending of malicious files [Video]


AirDroid has been a popular service on Android for years, allowing users to easily and wirelessly access the files on their smartphone from a PC, mirror notifications, and send/receive text messages. However, security company Zimperium has been tracking some major security vulnerabilities in the app for a few months now, and they’re still not fixed…

In May of this year, Zimperium discovered several security issues in AirDroid. While the app’s developers acknowledge them, updated versions since then — including a major 4.0 release and the current 4.0.1 — still suffer from the same vulnerabilities.

The details are a bit complex, but the basic summary is that these vulnerabilities allow anyone on the same network as an AirDroid user to send a possibly malicious APK to the Android device. A prompt to install would show up on-screen, but users would ultimately still have the ability to cancel.

Furthermore, the hacker could execute an attack which would be used to obtain private account credentials, including, but not limited to, the username and password for the connected AirDroid account. Zimperium’s summary follows:

AirDroid relies on insecure communication channels in order to send the same data used to authenticate the device to their statistics server. Such requests are encrypted with DES ( ECB mode ) however the encryption key is hardcoded inside the application itself (thus known to an attacker). Any malicious party on the same network of the target device could execute a man in the middle attack in order to obtain authentication credentials and impersonate the user for further requests.

The video below shows the process in detail, but the biggest thing you should take away from this is that you may want to uninstall AirDroid from your device, or at the very least stop using it on a network that others can access.

FTC: We use income earning auto affiliate links. More.

You’re reading 9to5Google — experts who break news about Google and its surrounding ecosystem, day after day. Be sure to check out our homepage for all the latest news, and follow 9to5Google on Twitter, Facebook, and LinkedIn to stay in the loop. Don’t know where to start? Check out our exclusive stories, reviews, how-tos, and subscribe to our YouTube channel



Avatar for Ben Schoon Ben Schoon

Ben is a writer and video producer for 9to5Google.

Find him on Twitter @NexusBen. Send tips to or encrypted to

Ben Schoon's favorite gear