 |
| The flaws affect devices containing Qualcomm chips |
Serious security flaws that could give attackers
complete access to a phone's data have been found in software used on tens of
millions of Android devices.
The bugs were uncovered by Checkpoint researchers looking
at software running on chipsets made by US firm Qualcomm.
Qualcomm processors are found in about 900
million Android phones, the company said.
However, there is no evidence of the
vulnerabilities currently being used in attacks by cyberthieves.
"I'm pretty sure you will see these
vulnerabilities being used in the next three to four months," said Michael
Shaulov, head of mobility product management at Checkpoint.
"It's always a race as to who finds the bug
first, whether it's the good guys or the bad."
Affected devices included:
o
BlackBerry Priv and Dtek50
o
Blackphone 1 and Blackphone 2
o
Google Nexus 5X, Nexus 6 and Nexus 6P
o
HTC One, HTC M9 and HTC 10
o
LG G4, LG G5, and LG V10
o
New Moto X by Motorola
o
OnePlus One, OnePlus 2 and OnePlus 3
o
US versions of the Samsung Galaxy S7 and Samsung
S7 Edge
o
Sony Xperia Z Ultra
Mr Shaulov said six months of work to reverse
engineer Qualcomm's code revealed the problems.
The flaws were found in software that handles
graphics and in code that controls communication between different processes
running inside a phone.
Exploiting the bugs would allow an attacker to
gradually be able to take more control over a device and gain access to its
data.
 |
| The flaws could be used to make booby-trapped apps that steadily gain access to a phone's data Photo: AP |
Checkpoint handed information about the bugs and
proof of concept code to Qualcomm earlier this year.
In response, Qualcomm is believed to have created
patches for the bugs and started to use the fixed versions in its factories.
It has also distributed the patches to phone
makers and operators. However, it is not clear how many of those companies have
issued updates to customers' phones.
Checkpoint has created a free app called QuadRooter Scanner that can be used to check if a phone is vulnerable to any of
the bugs, by looking to see if the patches for them have been downloaded and
installed.
In addition, Mr Shaulov said Android owners
should only download apps from the official Google Play store to avoid falling
victim to malicious programs.
"People should call whoever sold them their
phone, their operator or the manufacturer, and beg them for the patches,"
said Mr Shaulov.
Qualcomm has yet to respond to a request for
comment.
Originally published by BBC
No comments :
Post a Comment