On millions of Android phones, a modem weakness might enable hackers to listen in on your calls.
An approximate 40% of Android phones are affected by the Qualcomm problem.
At various levels of pressure, Google and other Android manufacturers aim to stay on top of hardware and app protection. Check Point Research today revealed a flaw in commonly used Qualcomm SoCs, which was especially concerning. It might potentially enable a malicious app to patch Qualcomm's MSM modem chips' firmware, allowing it access to call and text history and even recording conversations.
The problem is broken down in a highly technical manner by Check Point. To put it another way, bugs were discovered in the connections between the modem's Qualcomm Modem Interface (QMI) software layer and the debugger service, enabling it to dynamically repair the software and circumvent the normal protection measures. Standard third-party applications may not have protection rights to reach QMI, however this assault might be used if further important features of Android were violated.
The researchers discovered that a malicious app might listen in on and monitor an ongoing phone call, obtain call and SMS data, and even activate a SIM card using the vulnerabilities they discovered. Check Point reports that the insecure QMI malware is present in roughly 40% of smartphones, including those from Samsung, Google, LG, OnePlus, Xiaomi, and other manufacturers.
Although the attack's tactics were outlined in general terms, detailed detail needed to replicate the attack was left out of the study to avoid easy duplication. There is currently no evidence that this mode of assault is being used "in the wild."
Since CPR informed Qualcomm of the problem in October of last year, Qualcomm has acknowledged it as a high-rated weakness and has passed it on to Android manufacturers that use Qualcomm modems. The flaw has not been patched as of this writing, although both Qualcomm and Google are likely working on adding a workaround into a potential security patch.
Google and other Android manufacturers make different degrees of effort to maintain hardware and software security. However, a vulnerability in widely used Qualcomm SoCs revealed today by Check Point Research was especially concerning. It may potentially enable a malicious program to patch the software for Qualcomm's MSM modem chips, allowing it access to call and text history or even recording conversations.
Check Point's analysis of the problem is highly technical. To put it another way, flaws were discovered in the links between the modem's Qualcomm Modem Interface (QMI) software layer and the debugger service, enabling it to dynamically patch the program and circumvent the normal security measures. Although standard third-party applications do not have security credentials to access QMI, this exploit might be utilized if more important parts of Android were hacked.
The researchers concluded that a malicious software could listen in on and record a live phone conversation, get call and SMS data, and even unlock a SIM card using the vulnerabilities they discovered. Check Point believes that the susceptible QMI software is included in roughly 40% of smartphones from manufacturers like as Samsung, Google, LG, OnePlus, Xiaomi, and others.
While the techniques for this assault were outlined in broad strokes, particular details were left out of the paper to prevent anybody from simply replicating the procedure. As of yet, there is no evidence that this type of assault is being utilized "in the wild."
Qualcomm has been aware of this problem since CPR informed it of it in October of last year, and it has verified it as a high-rated vulnerability, passing it on to Android makers that utilize Qualcomm modems. At the time of writing, the vulnerability has not been patched, although both Qualcomm and Google are likely working on integrating a remedy into a future security patch.
Qualcomm's official statement
"After we published this article, a Qualcomm representative contacted us with the following statement:
Qualcomm is focused on developing solutions that promote strong protection and privacy. We applaud Check Point's protection researchers for adhering to industry-standard coordinated transparency procedures. In December 2020, Qualcomm Technologies made updates accessible to OEMs, and we urge end users to upgrade their devices when patches become available."
The representative went on to state that "many" Android OEMs had already pushed out the required security patches to end users, and that there is no indication that Check Point's weakness is being exploited. In June, the flaw will be published in the public Android bulletin.
Comments
Post a Comment