BlueStacks is unquestionable, one of the most appreciated Android emulators out there, a fact is proven by its 400+ million user community. Although BlueStacks was designed for gaming, it’s also being used to test new Android apps before they’re published on Google’s Play Store – easier to test an app inside an IDE than downloading it on your smartphone. BlueStacks came out in the odd 2009 and, at that time, it had, more or less the same ‘legal status’ as Citra, Snes9x, or other Super Nintendo emulators – borderline legitimate.

Later on, that status became less cloudy, particularly because Android is (semi) open-source (i.e., some costs may apply to manufacturers who want to install Google Mobile services). For a while now, people have been wondering about the security aspects of this Android virtualization environment.

Bluestacks settings for low end pc windows 7. Bluestacks settings for cod mobile.
Using BlueStacks with a Proxy Server. Open BlueStacks. (It has to be open before running the utiity) Open a Windows command prompt. Hit +R → type cmd → hit Enter); Change to the BlueStacks program folder.

Download BlueStacks 5 Offline Installer free is the latest version EXE FreeWare version offline setup file of your Windows & Mac. Also, BlueStacks 5 for Windows With this bad experience, run. It will open 'BlueStacks Support Tool', and where you can provide us with your email address and a clear description of the issue you want to report along with the screenshot of your MAC build year (by clicking on mac icon from the top left corner- About This Mac). After filling all the necessary information, click on 'Send Feedback' button'. The all-new BlueStacks 5 app player for PC is a powerhouse of speed and performance with 500M+ gamers worldwide and a library of 2M+ Android apps.

Is BlueStacks Safe? Well, since this is an Android emulator, BlueStacks may have had inherited the same security flaws as its mobile counterpart. In this article, I will be challenging the latter statement for the purpose of ‘round-tabling’ the cybersecurity concerns associated with using BlueStacks for anything from QAing to developing full-fledged, mobile-friendly applications. Enjoy and stay safe!

What is BlueStacks and how do you install it?

As I was saying in the intro, BlueStacks is a free Android emulator best suited for those who prefer mobile gaming without actually gaming on a mobile device. BlueStacks can be deployed on any Windows or Mac-compatible machine and has the same looks (and feel) as the real McCoy.

The emulator has many game-ready features such as mouse + keyboard tailor controls (e.g., MOBA mode, shooting mode, macros, etc.), multi-instance (i.e., allows you to run multiple apps at once), and eco mode, which helps you harmonize system resources while running multiple BlueStacks instances at the same time.

The latest version of BlueStacks (v4) comes with various pre-installed applications such as Google Play Store, Gmail, a file explorer that allows you to load custom (and often unsigned) .apk files, and much more. In other words, BlueStacks is the proverbial one-stop-shop for developers and users alike who want to enjoy the wholesomeness of Android without necessarily owning an Android device.

BlueStacks does not require special permissions in order to be deployed on a machine, provided that you’re running in admin mode. Just download the .msi package from BlueStacks’ official website and execute it on your machine. Additional configuration is not necessary with version 4 – every utility’s preloaded so, at this point, the only thing you’ll need to figure out is how you’re going to use it.

Personally, BlueStacks is a great addition to any virtualization software and, by far, the most stable. Sure, you can virtualize Android with just about any emulator you can get your hands on, but don’t expect performance.

I still have a hard time believing that Oracle’s VirtualBox, although capable of running dozens of emulated operating systems, still glitches when you try to run Android – and yes, I did ramp up the cores and RAM dials, but to no avail. Anyway, BlueStacks has been sufficiently well optimized as to allow both gamers and developers to reap its benefits. Yes, this Android emulator can be used for things like debugging, testing, patching, and everything in between. Developers tend to use BlueStacks in conjunction with some form of specialized IDE such as Eclipse.

No doubt, a very interesting piece of software and to think that this project was started simply because game players wanted to add that keyboard + mouse soft-touch to their Android experience.

Summing up: BlueStacks is open-source gaming and debugging Android emulator. It sports all kinds of cool features, from customizable gaming modes to DevOps tools. Now that we have this out of the way, let’s discuss about the cybersecurity concerns looming around this Android emulator. So, is BlueStacks safe?

Addressing Cybersecurity Concerns of Android Emulation Software

A quick Google search BlueStacks’ security concerns render some pretty interesting, if not confusing, results. Most of the websites I’ve consulted in order to piece this article together have the same ‘lighthearted’ conclusion – sure, your AV might flag the .msi package as malicious, but BlueStacks is 100% safe. And, my favorite – BlueStacks wants to mess around with your UAC policy. Sure, allow it; what’s the worse that could happen? The team behind the evergreen Android emulator put a lot of ‘elbow grease’ in order to plug all the security holes. Naturally, v4 of BlueStacks is far more secure compared to its predecessors.

CVE-2019-12936: IPC Misconfig

Now, in 2019, Nick Cano, a cybersecurity researcher, and ethical hacker, came knocking on BlueStacks’ door saying that the app has some major issues. One of these issues, which was nicknamed CVE-2019-12936, popped up in or around April 2019. With a severity score of 7.1 on the CVSS scale, this vulnerability, which was thoroughly documented by NIST, proved that BlueStacks was prone to cross-scripting via a defective IPC mechanism & interface which had no auth functions enabled.

More specifically, using DNS Rebinding, the victim’s machine would start attacking targets on the same network. This vulnerability would have also allowed for REC (i.e., remote execution of code), lading to data leaks, backup theft, and other mishaps. No incidents were reported prior to Cano blowing the whistle on BlueStacks. One thing I forgot to mention: this vulnerability was discovered in versions lower than 4.0. BlueStacks’ latest build (4.90.0.1046) removed this vulnerability. So, if you’re still running older versions of BlueStacks, I strongly recommend updating your app ASAP.

CVE-2016-4288: Random code execution with system privileges

Thought that CVE-2019-1936 was the only vulnerability found in BlueStacks? Think again. In 2017, CVE-2016-4288 was published. The entry documented BlueStacks’ App Player local privilege vulnerability due to the creation of a Windows registry key with suboptimal protection. More specifically, the emulator’s App player would create a registry key that required very little permissions. This vulnerability would, in turn, allow a threat actor to execute random code with system privileges. CVE-2016-4288 would have affected version 2.1.3.5650 of the product or earlier versions.

CVE-2018-0701: Gain unauthorized access on the same network segment

Discovered in November 2018, this vulnerability would have allowed a threat actor to bypass normal restriction in order to gain access to resources hosted on a machine or network. As the CVE entry shows, the vulnerability was associated with the BlueStacks App player and affected Windows versions 3.0. through 4.31.55, as well as the second version Mac version of the emulator. The issue, which was flagged as “resolved” in the latest version of BlueStacks, would have allowed an attacker operating on the same network segment as the victim’s endpoint to gain unauthorized access.

CVE-2019-14220: Read unauthorized file by setting file name as a parameter in system service call

Earmarked in 2019, CVE-2019-14220 refers to a vulnerability that could be used to gain read-type access to an authorized file. This vulnerability’s been tied to a “local arbitrary file read through a system service call” and when executed with System admin privileges could have granted the threat actor access to an authorized file if the said file name was used as a parameter. CVE-2019-14220 affected versions 4.110 and 4.120 of BlueSt

Bluestacks Mac Security Settings