A now patched security flaw discovered in Qualcomm's MSM chips could have allowed attackers to gain access to the the SMS messages and phone conversations of around a third of the world's Android smartphones.
Qualcomm is one of the largest chipmakers around today and its chips are currently found in over 40 percent of smartphones including high-end devices from Google, Samsung, LG, Xiaomi and OnePlus.
The vulnerability, tracked as CVE-2020-11292, was discovered by security researchers at Check Point Research when using a process known as fuzzing to test Qualcomm's mobile station modem (MSM) for flaws in its firmware.
- We've built a list of the best endpoint protection software available
- These are the best antivirus software solutions on the market
- Also check out our roundup of the best malware removal software
The chipmaker has also created a proprietary protocol called Qualcomm MSM Interface (QMI) that enables its MSM chips to communicate with other peripheral subsystems on an Android device such as cameras and fingerprint scanners. According to the technology market research firm Counterpoint, QMI is found on approximately 30 percent of all mobile phones worldwide though little is known about its role as a possible attack vector.
MSM vulnerability
During its investigation, Check Point discovered a vulnerability in Qualcomm's MSM chips that can be used to control a smartphone's modem and dynamically patch it from the application processor.
As a result, an attacker could have leveraged the vulnerability in question to inject malicious code into a device's modem from Android which would give them full access to a user's call history and text messages as well as the ability to listen to a user's phone conversations. Additionally, a hacker could also exploit the vulnerability to unlock a device's SIM.
Check Point responsibly disclosed its discovery to Qualcomm and the chipmaker developed a patch for the issue while also notifying the relevant smartphone vendors. Users should apply the latest updates from their smartphone manufacturer to protect them from any possible exploits in the wild.
Qualcomm also reached out to TechRadar Pro and a company spokesperson urged Android users to install the latest patches when they become available, saying:
“Providing technologies that support robust security and privacy is a priority for Qualcomm. We commend the security researchers from Check Point for using industry-standard coordinated disclosure practices. Qualcomm Technologies has already made fixes available to OEMs in December 2020, and we encourage end users to update their devices as patches become available."
In order to protect against similar vulnerabilities, Check Point recommends that users update their operating system to the latest version, only install apps from official app stores like the Google Play Store and install a mobile antivirus for additional protection. Organizations meanwhile should enable 'remote wipe' capability for all of their employee's work devices to minimize the probability of loss of sensitive data.
- We've also highlighted the best firewall
Via Ars Technica
