Exploiting Android Users
There was a single mention of Paint.NET in the article with no other comment. Is that the company involved in this? It was not clear to me nor do I recognize the name of the author.<p>There are two technical holes in how this was achieved, disregarding the initial drive-by update install:<p>* Unprotected browser cookie storage<p>* Android web-based App Install requires no user interaction past a request to a web endpoint<p>Are these holes still open?