Epic Games finally launched Fortnite on Android in early August. People had been waiting for the game to reach Google's platform since it debuted on iOS devices in September 2017, and with the release of Samsung's latest Galaxy devices, that patience was rewarded. But nobody should have brought out the champagne yet, as Google quickly discovered and, over the weekend, publicly disclosed a vulnerability in the tool used to install the game.
The problem starts with the fact that Fortniteisn't available through Google's official Play Store. Epic didn't want to split 30 percent of the revenues earned from the Android version of its almost-bafflingly popular game, and because Android doesn't have the same restrictions as iOS, Epic was able to cut Google out.
But the Play Store and App Store don't exist only because their parent companies want to make some extra money. They're also supposed to make sure people are only installing software from a trusted source that (ostensibly) verifies that an app is secure and non-malicious. When people install apps from alternative sources, they run a greater risk of being compromised.
Enter the vulnerability Google discovered on August 15 and publicly disclosed on August 25. An engineer at Google named Edward discovered that Epic's installer enabled "man-in-the-disk attacks" that could let hackers quietly install malware alongside Fortnite (you can learn more about man-in-the-disk attacks via an August 12 blog post from security software vendor Check Point). The malware could also be given permission to access data without requiring any user input.
Epic released a fix on August 16. The company requested that Google maintain its standard of waiting 90 days before publicly disclosing the vulnerability, however, so people would have a chance to update their devices.
Google decided not to wait. "As mentioned via email," Edward said, "now the patched version of Fortnite Installer has been available for seven days we will proceed to unrestrict this issue in line with Google's standard disclosure practices."
This led Epic founder Tim Sweeney to criticize Google in a tweet saying the company was "creating an unnecessary risk for Android users in order to score cheap PR points."
Publicly disclosing this vulnerability could make it seem like Epic should have simply distributed Fortnite via the Play Store. Several comments on the initial disclosure made since it was public confirm this; some people have criticized Epic for using its own installer. Even if that wasn't Google's intention, that's how a number of people are taking the news, and people who haven't updated remaining vulnerable just makes things worse.
