LG Smartphones - Actually, not so smart. Man-in-the-Middle attack possible

Apparently the apps (or their programmers) are too lazy to perform integrity checks

If this does not surprise you, check how the vendor plans to resolve this issue.

From the article:

“When fetching new applications, the client looks for the ‘appUrl’ field, which holds a base64 encoded, encrypted URL. The encryption key is symmetric, it is based on the certKey field, which is part of the same message. Since there is no integrity protection applied to the messages, an attacker can intercept the update response and replace the value of appUrl with any arbitrary URL pointing to a potentially malicious APK,” the researchers said. 

The vendor plans to fix the bug only in new handsets and won’t push a fix to existing phones. As a workaround, they recommend turning off the “Auto app update” function on affected LG handsets. 

For more information:

https://threatpost.com/researcher-says-lg-app-update-mechanism-doesnt-verify-ssl-cert/113522