Exploiting Android Users
There was a single mention of Paint.NET in the article with no other comment. Is that the company involved in this? It was not clear to me nor do I recognize the name of the author.There are two technical holes in how this was achieved, disregarding the initial drive-by update install:* Unprotected browser cookie storage* Android web-based App Install requires no user interaction past a request to a web endpointAre these holes still open?