Qualcomm Chip Bug Put Millions Of Android Devices At Security Risk: What We Know
Millions of Android smartphones across the world were affected by a severe vulnerability inside Qualcomm chipsets, which allowed hackers to break into the affected devices and gain access to users' text messages, call history as well as listen in to their conversations.
Researchers with the Israeli cybersecurity firm Check Point had notified the American semiconductor company about the bug last year, following which it sent security updates to all those affected devices a couple of months later in December.
ALSO READ: Apple Paid Hacker Rs 75 Lakh For Finding Security Hole In Safari Browser
The affected hardware--Qualcomm's Mobile Station Modem (MSM) Interface--is a series of 2G, 3G, 4G, and 5G-capable systems on chips (SoCs), which is used in roughly 30 per cent of phones in the world manufactured by multiple OEMs, including Samsung, Xiaomi, OnePlus and Google.
Qualcomm
Researchers explained that Qualcomm's MSM Interface allows the chipset to communicate with the smartphone’s operating system for capabilities such as voice, SMS, and high-definition recording.
ALSO READ: Indian Guy Awarded $50,000 By Microsoft For Spotting Hacker Vulnerability
But this security flaw within Qualcomm’s proprietary interface (QMI) “can be used to control the modem and dynamically patch it from the application processor,” the cyber security solutions provider highlighted in a new blog post.
“An attacker can use such a vulnerability to inject malicious code into the modem from Android. This gives the attacker access to the user’s call history and SMS, as well as the ability to listen to the user’s conversations.
“A hacker can exploit the vulnerability to unlock the SIM, thereby overcoming the limitations of the service providers imposed on the mobile device,” the post added.
Getty Images
Simply put, a malicious app installed on your phone could exploit the heap overflow weakness and plant malicious code inside the Qualcomm’s MSM Interface to hide their activity--effectively, rendering themselves invisible to Android’s security features that detect such malicious activity.
ALSO READ: UP Govt's COVID-19 Tracker Bug Exposed Over 80 Lakh People's Private Data
When the news broke last year, a Qualcomm spokesperson told Indiatimes that it “encourages end users to update their devices as patches become available and to only install applications from trusted locations such as the Google Play Store.”
And while Qualcomm released a patch to mobile vendors in December last year and disclosed the bug to all customers who use the chip, it’s still not clear which vulnerable Android devices are fixed and which ones aren’t.
Reuters
“The mobile vendors themselves must apply the fix,” a Check Point spokesperson told The Record, while another told ArsTechnica that “the implementation of these fixes takes time, so some of the phones may still be prone to the threat”.
Either way, Qualcomm recommends that users contact their phone manufacturers to understand the status of their fixes for their specific devices.
Comments