{"id":126288,"date":"2023-03-06T09:00:00","date_gmt":"2023-03-06T17:00:00","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?p=126288"},"modified":"2024-07-03T07:59:07","modified_gmt":"2024-07-03T14:59:07","slug":"protecting-android-clipboard-content-from-unintended-exposure","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/","title":{"rendered":"Protecting Android clipboard content from unintended exposure"},"content":{"rendered":"\n<p>Considering mobile users often use the clipboard to copy and paste sensitive information, like passwords or payment information, <a href=\"http:\/\/attack.mitre.org\/techniques\/T1414\/\">clipboard contents can be an attractive target for cyberattacks<\/a>. Leveraging clipboards can enable attackers to collect target information and exfiltrate useful data. Examples even exist of attackers <a href=\"http:\/\/attack.mitre.org\/techniques\/T1641\/001\/\">hijacking and replacing the clipboard contents<\/a> for malicious purposes, such as <a href=\"https:\/\/www.threatfabric.com\/blogs\/sova-new-trojan-with-fowl-intentions.html\">modifying a copied cryptocurrency wallet address<\/a> before the user pastes it into a crypto wallet app or chat message. Moreover, these types of attacks misuse a legitimate system feature rather than exploit a vulnerability, making the issue more challenging to mitigate.<\/p>\n\n\n\n<p>Microsoft discovered that an old version of the SHEIN Android application periodically read the contents of the Android device clipboard and, if a particular pattern was present, sent the contents of the clipboard to a remote server. While we are not specifically aware of any malicious intent behind the behavior, we assessed that this behavior was not necessary for users to perform their tasks on the app.<\/p>\n\n\n\n<p>SHEIN\u2019s Android application is published on the Google Play Store with over 100 million downloads. Even if SHEIN\u2019s clipboard behavior involved no malicious intent, this example case highlights the risks that installed applications can pose, including those that are highly popular and obtained from the platform\u2019s official app store. We reported our findings to Google, the Play Store operator, leading to an investigation by their Android Security Team. In May 2022, Google informed us and we confirmed that SHEIN removed the behavior from the application. We would like to thank Google\u2019s Android Security Team as well as the SHEIN team for their efforts and collaboration in addressing this issue. We would also like to thank the Google team for the improvements implemented to the Android platform to protect users from the risks associated with anomalous clipboard access.<\/p>\n\n\n\n<p>In this blog, we detail how we identified the SHEIN app\u2019s clipboard behavior and how Android users can protect themselves against clipboard-based attacks. We also share this research with the larger security community to emphasize the importance of collaboration in the effort to improve security for all.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"static-and-dynamic-analysis\">Static and dynamic analysis<\/h2>\n\n\n\n<p>The following analysis details how we identified and verified the presence of the SHEIN app\u2019s clipboard behavior, analyzing SHEIN app version 7.9.2 (SHA-256: <em>ff07dc6e237acd19cb33e35c60cb2ae52c460aac76bc27116d8de76abec66c51<\/em>). We first performed a static analysis of the app to identify the relevant code responsible for the behavior. We then performed a dynamic analysis by running the app in an instrumented environment to observe the code, including how it read the clipboard and sent its contents to a remote server.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"875\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-1.-An-example-of-a-call-chain-through-the-SHEIN-app-resulting-in-clipboard-access-1024x875.png\" alt=\"Call chain diagram displaying how a user starting or resuming the SHEIN app progresses through various calls until it checks the clipboard text for the character sequences $ and &quot;:\/\/&quot;, which, if found, will be sent as a parameter to a SHEIN server.\" class=\"wp-image-126290\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-1.-An-example-of-a-call-chain-through-the-SHEIN-app-resulting-in-clipboard-access-1024x875.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-1.-An-example-of-a-call-chain-through-the-SHEIN-app-resulting-in-clipboard-access-300x256.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-1.-An-example-of-a-call-chain-through-the-SHEIN-app-resulting-in-clipboard-access-768x656.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-1.-An-example-of-a-call-chain-through-the-SHEIN-app-resulting-in-clipboard-access-1536x1313.png 1536w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-1.-An-example-of-a-call-chain-through-the-SHEIN-app-resulting-in-clipboard-access-2048x1750.png 2048w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Figure 1. An example of a call chain through the SHEIN app resulting in clipboard access<\/figcaption><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"identifying-the-code\">Identifying the code<\/h3>\n\n\n\n<p>Upon opening the application, the launcher activity <em>com.shein.user_service.welcome.WelcomeActivity<\/em> extends the <em>com.zzkko.base.ui.BaseActivity<\/em> class, which performs a call to the <em>iBaseActivityCallBack.h <\/em>method in the <em>onResume<\/em> callback, depicted below on Line 11:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full is-resized\"><img loading=\"lazy\" decoding=\"async\" width=\"983\" height=\"494\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-2.-The-com.zzkko_.base_.ui_.BaseActivity-class-performing-a-call-to-the-iBaseActivityCallBack.h-method-in-the-onResume-callback-1.png\" alt=\"graphical user interface, text, application, email\" class=\"wp-image-126306\" style=\"width:737px;height:371px\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-2.-The-com.zzkko_.base_.ui_.BaseActivity-class-performing-a-call-to-the-iBaseActivityCallBack.h-method-in-the-onResume-callback-1.png 983w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-2.-The-com.zzkko_.base_.ui_.BaseActivity-class-performing-a-call-to-the-iBaseActivityCallBack.h-method-in-the-onResume-callback-1-300x151.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-2.-The-com.zzkko_.base_.ui_.BaseActivity-class-performing-a-call-to-the-iBaseActivityCallBack.h-method-in-the-onResume-callback-1-768x386.png 768w\" sizes=\"(max-width: 983px) 100vw, 983px\" \/><figcaption class=\"wp-element-caption\">Figure 2. The <em>com.zzkko.base.ui.BaseActivity<\/em> class performing a call to the <em>iBaseActivityCallBack.h<\/em> method in the <em>onResume <\/em>callback &nbsp;<\/figcaption><\/figure>\n\n\n\n<p>The <em>com.zzkko.app.iBaseActivityCallBack<\/em>is aninterfaceimplemented by the <em>com.zzkko.app.BaseActivityCallBack.<\/em> The method <em>h<\/em>, partially depicted below, from the previous call performs a call to the method <em>o<\/em> in the same class, as shown on Line 16:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"804\" height=\"273\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-3.-Method-h-performing-a-call-to-the-method-o-in-the-same-class-3.png\" alt=\"graphical user interface, text, application, email\" class=\"wp-image-126311\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-3.-Method-h-performing-a-call-to-the-method-o-in-the-same-class-3.png 804w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-3.-Method-h-performing-a-call-to-the-method-o-in-the-same-class-3-300x102.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-3.-Method-h-performing-a-call-to-the-method-o-in-the-same-class-3-768x261.png 768w\" sizes=\"(max-width: 804px) 100vw, 804px\" \/><figcaption class=\"wp-element-caption\">Figure 3. Method <em>h<\/em> performing a call to the method <em>o<\/em> in the same class<\/figcaption><\/figure>\n\n\n\n<p>Finally, in the<em>com.zzkko.app.BaseActivityCallBack.o<\/em> method there is a call to the <em>com.zzkko.util.MarketClipboardPhaseLinker.f<\/em> method, shown on Line 2:&nbsp;&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"810\" height=\"410\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-4.-The-com.zzkko_.app_.BaseActivityCallBack.o-method-calls-the-com.zzkko_.util_.MarketClipboardPhaseLinker.f-method-3.png\" alt=\"graphical user interface, text, application, email\" class=\"wp-image-126312\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-4.-The-com.zzkko_.app_.BaseActivityCallBack.o-method-calls-the-com.zzkko_.util_.MarketClipboardPhaseLinker.f-method-3.png 810w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-4.-The-com.zzkko_.app_.BaseActivityCallBack.o-method-calls-the-com.zzkko_.util_.MarketClipboardPhaseLinker.f-method-3-300x152.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-4.-The-com.zzkko_.app_.BaseActivityCallBack.o-method-calls-the-com.zzkko_.util_.MarketClipboardPhaseLinker.f-method-3-768x389.png 768w\" sizes=\"(max-width: 810px) 100vw, 810px\" \/><figcaption class=\"wp-element-caption\">Figure 4. The <em>com.zzkko.app.BaseActivityCallBack.o<\/em> method calls the <em>com.zzkko.util.MarketClipboardPhaseLinker.f<\/em> method<\/figcaption><\/figure>\n\n\n\n<p>Method <em>com.zzkko.app.BaseActivityCallBack.f,<\/em> depicted below, checks whether the character sequences \u201c$\u201d and \u201c:\/\/\u201d are present in the clipboard text, depicted on Line 6. If both are present, method <em>k <\/em>in the same class is called with the clipboard text provided as a parameter, as shown on Line 8:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"289\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-5.-The-com.zzkko_.app_.BaseActivityCallBack.f-method-checks-the-clipboard-for-and-providing-the-clipboard-text-as-a-parameter-to-method-k-2-1024x289.png\" alt=\"graphical user interface, text, application, email\" class=\"wp-image-126314\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-5.-The-com.zzkko_.app_.BaseActivityCallBack.f-method-checks-the-clipboard-for-and-providing-the-clipboard-text-as-a-parameter-to-method-k-2-1024x289.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-5.-The-com.zzkko_.app_.BaseActivityCallBack.f-method-checks-the-clipboard-for-and-providing-the-clipboard-text-as-a-parameter-to-method-k-2-300x85.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-5.-The-com.zzkko_.app_.BaseActivityCallBack.f-method-checks-the-clipboard-for-and-providing-the-clipboard-text-as-a-parameter-to-method-k-2-768x217.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-5.-The-com.zzkko_.app_.BaseActivityCallBack.f-method-checks-the-clipboard-for-and-providing-the-clipboard-text-as-a-parameter-to-method-k-2.png 1230w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Figure 5. The <em>com.zzkko.app.BaseActivityCallBack.f<\/em> method checks the clipboard for \u201c$\u201d and \u201c:\/\/\u201d, providing the clipboard text as a parameter to method <em>k<\/em><\/figcaption><\/figure>\n\n\n\n<p>Method <em>com.zzkko.app.BaseActivityCallBack.k<\/em>initiates a flow that performs a POST request to the server at <em>BaseUrlConstant.APP_URL<\/em> + \u201c<em>\/marketing\/tinyurl\/phrase<\/em>\u201d, which resolves to <em>https:\/\/api-service[.]shein[.]com\/marketing\/tinyurl\/phrase<\/em>:<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"199\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-6.-Method-com.zzkko_.app_.BaseActivityCallBack.k-initiating-a-flow-which-performs-a-POST-request-to-the-server-at-BaseUrlConstant.APP_URL-marketingtinyurlphrase-2-1024x199.png\" alt=\"graphical user interface, text, application\" class=\"wp-image-126310\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-6.-Method-com.zzkko_.app_.BaseActivityCallBack.k-initiating-a-flow-which-performs-a-POST-request-to-the-server-at-BaseUrlConstant.APP_URL-marketingtinyurlphrase-2-1024x199.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-6.-Method-com.zzkko_.app_.BaseActivityCallBack.k-initiating-a-flow-which-performs-a-POST-request-to-the-server-at-BaseUrlConstant.APP_URL-marketingtinyurlphrase-2-300x58.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-6.-Method-com.zzkko_.app_.BaseActivityCallBack.k-initiating-a-flow-which-performs-a-POST-request-to-the-server-at-BaseUrlConstant.APP_URL-marketingtinyurlphrase-2-768x149.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-6.-Method-com.zzkko_.app_.BaseActivityCallBack.k-initiating-a-flow-which-performs-a-POST-request-to-the-server-at-BaseUrlConstant.APP_URL-marketingtinyurlphrase-2.png 1062w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Figure 6. Method <em>com.zzkko.app.BaseActivityCallBack.k<\/em> initiating a flow, whichperforms a POST request to the server at <em>BaseUrlConstant.APP_URL<\/em> + \u201c<em>\/marketing\/tinyurl\/phrase<\/em>\u201d<\/figcaption><\/figure>\n\n\n\n<p>Since all of the application\u2019s activities (user interfaces) extend <em>com.zzkko.base.ui.BaseActivity<\/em>, the call chain described above was triggered any time the user launched a new activity, such as by starting or resuming the application or performing certain actions within the app.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"verifying-the-code-s-clipboard-behavior\">Verifying the code\u2019s clipboard behavior<\/h3>\n\n\n\n<p>To verify our static analysis findings, we performed a dynamic analysis of the application, which we installed from the Google Play Store onto a Samsung device running Android 9.<\/p>\n\n\n\n<p>We used <a href=\"https:\/\/frida.re\/\">Frida<\/a> to intercept calls to the <em>android.content.ClipboardManager.getText<\/em> and <em>com.zzkko.util.MarketClipboardPhaseLinker.f<\/em> methods to analyze the application\u2019s clipboard behavior. &nbsp;We also used Frida to bypass the application\u2019s certificate pinning to enable us to analyze network traffic using <a href=\"https:\/\/portswigger.net\/burp\/documentation\/desktop\/tools\/proxy\">Burp Proxy<\/a>.<\/p>\n\n\n\n<p>We set the contents of the device clipboard to <em>https:\/\/mybank[.]com\/token=secretToken&amp;transaction=100$<\/em> and opened the application.<\/p>\n\n\n\n<p>Upon opening the application, the following calls were logged:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"662\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-7.-Call-log-displaying-the-apps-clipboard-filtering-1024x662.png\" alt=\"Graphical user interface, text, application\" class=\"wp-image-126296\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-7.-Call-log-displaying-the-apps-clipboard-filtering-1024x662.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-7.-Call-log-displaying-the-apps-clipboard-filtering-300x194.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-7.-Call-log-displaying-the-apps-clipboard-filtering-768x497.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-7.-Call-log-displaying-the-apps-clipboard-filtering-200x130.png 200w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-7.-Call-log-displaying-the-apps-clipboard-filtering.png 1430w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Figure 7. Call log displaying the app\u2019s clipboard filtering<\/figcaption><\/figure>\n\n\n\n<p>In Figure 7 above, we observe the following:&nbsp;<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Lines 28<\/strong>: Call to the function <em>com.zzkko.util.MarketClipboardPhaseLinker.f<\/em>&nbsp;<\/li>\n\n\n\n<li><strong>Lines 29-49<\/strong>: Stack trace to the function <em>com.zzkko.util.MarketClipboardPhaseLinker.<\/em><em>f<\/em>&nbsp;<\/li>\n\n\n\n<li><strong>Lines 53, 55<\/strong>: Calls to the <em>hasPrimaryClip<\/em> and <em>getPrimaryClip<\/em> methods of the <em>ClipboardManager<\/em>&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>Finally, a POST request to <em>api-service[.]shein[.]co<\/em>m is performed. Subsequently, we captured the following request in Burp Proxy, showing the transmission of the clipboard contents to the remote server:&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"222\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-8.-Transmission-of-the-clipboard-contents-to-the-remote-server-1024x222.png\" alt=\"Graphical user interface, text, application depicting the transmission of the clipboard contents to the remote server.\" class=\"wp-image-126297\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-8.-Transmission-of-the-clipboard-contents-to-the-remote-server-1024x222.png 1024w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-8.-Transmission-of-the-clipboard-contents-to-the-remote-server-300x65.png 300w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-8.-Transmission-of-the-clipboard-contents-to-the-remote-server-768x166.png 768w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-8.-Transmission-of-the-clipboard-contents-to-the-remote-server.png 1430w\" sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><figcaption class=\"wp-element-caption\">Figure 8. Transmission of the clipboard contents to the remote server<\/figcaption><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"android-clipboard-protections\">Android clipboard protections<\/h2>\n\n\n\n<p>As displayed in this case involving SHEIN, Android applications can call the <em>android.text.ClipboardManager<\/em> API to read from or write to the device clipboard without requesting the user\u2019s approval or requiring any specific Android permission. While calling the <em>ClipboardManager<\/em> API can allow apps to make processes easier for users, such as quickly selecting text to copy, applications often should not need to do this since copying and pasting is typically performed by the device input method editor (keyboard), which is a separate application.<\/p>\n\n\n\n<p>To address our research findings and the broader issue at hand, Google has recognized the risks associated with clipboard access and has made the following improvements to the Android platform to protect users:<\/p>\n\n\n\n<p>On Android 10 and above, an application <a href=\"https:\/\/developer.android.com\/about\/versions\/10\/privacy\/changes#clipboard-data\">cannot access the clipboard unless it currently has focus (is actively running on the device display) or is set as the default input method editor<\/a> (keyboard). This restriction guards against background applications accessing the clipboard, but it would not have prevented the behavior described here because the SHEIN application was running in the foreground.<\/p>\n\n\n\n<p>On Android 12 and above, <a href=\"https:\/\/developer.android.com\/about\/versions\/12\/behavior-changes-all#clipboard-access-notifications\">a toast message notifies the user when an application calls the ClipboardManager to access clipboard data from another application for the first time<\/a>.<strong><\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"589\" height=\"136\" src=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-9.-Example-toast-message-shown-at-bottom-of-screen-when-the-device-clipboard-is-accessed..png\" alt=\"Android message stating &quot;Office pasted from your clipboard.&quot;\" class=\"wp-image-126298\" srcset=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-9.-Example-toast-message-shown-at-bottom-of-screen-when-the-device-clipboard-is-accessed..png 589w, https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Figure-9.-Example-toast-message-shown-at-bottom-of-screen-when-the-device-clipboard-is-accessed.-300x69.png 300w\" sizes=\"(max-width: 589px) 100vw, 589px\" \/><figcaption class=\"wp-element-caption\">Figure 9. Example toast message shown at bottom of screen when the device clipboard is accessed.<\/figcaption><\/figure>\n\n\n\n<p>Android 13 <a href=\"https:\/\/www.android.com\/android-13\/#a13-proactive-protection\">clears the contents of the clipboard after a period of time<\/a> to provide an additional degree of protection.<\/p>\n\n\n\n<p>Users can protect themselves by watching out for the clipboard access message. If the message unexpectedly shows, they should assume that any data on the clipboard has been potentially compromised, and they should consider removing any applications that make suspicious clipboard accesses.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"responsible-disclosure-and-industry-collaboration-improves-security-for-all\">Responsible disclosure and industry collaboration improves security for all<\/h2>\n\n\n\n<p>Although we\u2019re not aware of any malicious intent by SHEIN, even seemingly benign behaviors in applications can be exploited with malicious intent. Threats targeting clipboards can put any copied and pasted information at risk of being stolen or modified by attackers, such as passwords, financial details, personal data, cryptocurrency wallet addresses, and other sensitive information.<\/p>\n\n\n\n<p>We recommend users further follow the security guidelines below to defend against this and similar risks:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Always keep the device and the installed applications updated<\/li>\n\n\n\n<li>Never install applications from untrusted sources<\/li>\n\n\n\n<li>Consider removing applications with unexpected behaviors, such as clipboard access toast notifications, and report the behavior to the vendor or app store operator<\/li>\n<\/ul>\n\n\n\n<p>After discovering the SHEIN Android application clipboard behavior, we worked with Google\u2019s Android Security Team to ensure the removal of this behavior from the app. We thank both the Google and SHEIN teams for their efforts and collaboration in addressing the issue.<\/p>\n\n\n\n<p>At Microsoft, we value, protect, and defend privacy\u2014and this case demonstrates our efforts to investigate and protect customers\u2019 privacy beyond security threats. As the threat landscape continues to evolve, Microsoft strives to continuously improve security for all through research-driven protection and collaboration with customers, partners, and industry experts, regardless of the device or platform in use.<\/p>\n\n\n\n<p>We will continue to work with the security community to share research and intelligence about risks and threats in the effort to build better protection for all.<\/p>\n\n\n\n<p><strong><em>Dimitrios Valsamaras<\/em><\/strong><em>, <strong>Michael Peck<\/strong> Microsoft 365 Defender Research Team<\/em><em><\/em><\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"references\">References<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/web.ecs.syr.edu\/~wedu\/Research\/paper\/clipboard_attack_dimva2014.pdf\">Xiao Zhang and Wenliang Du, Attacks on Android Clipboard, International Conference on Detection of Intrusions and Malware and Vulnerability Assessment, July 2014.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.welivesecurity.com\/2019\/02\/08\/first-clipper-malware-google-play\/\">Lukas Stefanko, First clipper malware discovered on Google Play, ESET, February 2019.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.threatfabric.com\/blogs\/sova-new-trojan-with-fowl-intentions.html\">ThreatFabric, S.O.V.A. &#8211; A new Android Banking trojan with fowl intentions, September 2021.<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/blog.esper.io\/android-13-deep-dive\/\">Mishaal Rahman, Android 13 changelog, September 2022.<\/a><\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>Microsoft discovered that the SHEIN Android application periodically read the contents of the Android device clipboard and, if a particular pattern was present, sent the contents of the clipboard to a remote server.<\/p>\n","protected":false},"author":153,"featured_media":126315,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3663],"topic":[3687],"products":[],"threat-intelligence":[3739],"tags":[3741],"coauthors":[3380],"class_list":["post-126288","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","content-type-research","topic-threat-intelligence","threat-intelligence-vulnerabilities-and-exploits","tag-android","review-flag-1694638265-576","review-flag-1694638265-310","review-flag-1694638265-83","review-flag-1694638271-781","review-flag-1-1694638265-354","review-flag-2-1694638266-864","review-flag-3-1694638266-241","review-flag-4-1694638266-512","review-flag-5-1694638266-171","review-flag-6-1694638266-691","review-flag-7-1694638266-851","review-flag-8-1694638266-352","review-flag-9-1694638266-118","review-flag-alway-1694638263-571","review-flag-never-1694638263-791","review-flag-new-1694638263-340"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v23.9 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Protecting Android clipboard content from unintended exposure | Microsoft Security Blog<\/title>\n<meta name=\"description\" content=\"An old version of the SHEIN Android app periodically read the contents of the Android device clipboard &amp; sent the contents to a remote server.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Protecting Android clipboard content from unintended exposure | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"An old version of the SHEIN Android app periodically read the contents of the Android device clipboard &amp; sent the contents to a remote server.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2023-03-06T17:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-07-03T14:59:07+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t<meta property=\"og:image:height\" content=\"801\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Microsoft Threat Intelligence\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Threat Intelligence\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-security-threat-intelligence\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Threat Intelligence\"}],\"headline\":\"Protecting Android clipboard content from unintended exposure\",\"datePublished\":\"2023-03-06T17:00:00+00:00\",\"dateModified\":\"2024-07-03T14:59:07+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/\"},\"wordCount\":1592,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg\",\"keywords\":[\"Android\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/\",\"name\":\"Protecting Android clipboard content from unintended exposure | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg\",\"datePublished\":\"2023-03-06T17:00:00+00:00\",\"dateModified\":\"2024-07-03T14:59:07+00:00\",\"description\":\"An old version of the SHEIN Android app periodically read the contents of the Android device clipboard & sent the contents to a remote server.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#primaryimage\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg\",\"width\":1200,\"height\":801,\"caption\":\"a person standing in front of a building\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Protecting Android clipboard content from unintended exposure\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Protecting Android clipboard content from unintended exposure | Microsoft Security Blog","description":"An old version of the SHEIN Android app periodically read the contents of the Android device clipboard & sent the contents to a remote server.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/","og_locale":"en_US","og_type":"article","og_title":"Protecting Android clipboard content from unintended exposure | Microsoft Security Blog","og_description":"An old version of the SHEIN Android app periodically read the contents of the Android device clipboard & sent the contents to a remote server.","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/","og_site_name":"Microsoft Security Blog","article_published_time":"2023-03-06T17:00:00+00:00","article_modified_time":"2024-07-03T14:59:07+00:00","og_image":[{"width":1200,"height":801,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg","type":"image\/jpeg"}],"author":"Microsoft Threat Intelligence","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Microsoft Threat Intelligence","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/microsoft-security-threat-intelligence\/","@type":"Person","@name":"Microsoft Threat Intelligence"}],"headline":"Protecting Android clipboard content from unintended exposure","datePublished":"2023-03-06T17:00:00+00:00","dateModified":"2024-07-03T14:59:07+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/"},"wordCount":1592,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg","keywords":["Android"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/","name":"Protecting Android clipboard content from unintended exposure | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#primaryimage"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#primaryimage"},"thumbnailUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg","datePublished":"2023-03-06T17:00:00+00:00","dateModified":"2024-07-03T14:59:07+00:00","description":"An old version of the SHEIN Android app periodically read the contents of the Android device clipboard & sent the contents to a remote server.","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#primaryimage","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2023\/03\/Featured-image.jpg","width":1200,"height":801,"caption":"a person standing in front of a building"},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2023\/03\/06\/protecting-android-clipboard-content-from-unintended-exposure\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Protecting Android clipboard content from unintended exposure"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/126288"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/153"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=126288"}],"version-history":[{"count":1,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/126288\/revisions"}],"predecessor-version":[{"id":134923,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/126288\/revisions\/134923"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media\/126315"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=126288"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=126288"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=126288"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=126288"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=126288"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=126288"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=126288"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}