Google patches Nexus bug that lets hackers steal data from locked devices
IBM’s security team found the Nexus 5X glitch after discovering a bypass hole
Google has patched a security bug in its Nexus 5X smartphones that could have exposed sensitive user data stored on handsets, even if they were locked.
IBM's security team found the Nexus 5X glitch after discovering a bypass hole that could allow hackers to dump memory from locked phones via a bootloader problem that could also facilitate wholesale memory dumps via USB, such as a charger.
IBM X-Force research lead Roee Hay said exploiting the flaw was simple and only required a device to be put into fastboot mode.
"A vulnerability in Nexus 5X's bootloader allows an attacker to obtain a full memory dump of the device," said Hay. "The vulnerability can be exploited by physical attackers or by non-physical ones having Android Debug Bridge [ADB] access to the device."
One possible scenario where a non-physical attacker can get ADB access is by first targeting an ADB-authorised developer's PC and infecting it with malware, the IBM researchers said.
Another way is by using malicious chargers targeting ADB-enabled devices. "Using such chargers requires the victim to authorise the charger once connected," the IBM team said.
In this instance, the victim is a Nexus 5X user with Android 6.0 MDA39E through 6.0.1. In order to achieve a successful attack, the attacker needs to reboot the phone into the well-known fastboot' mode, which can be done without any authentication.
"A physical attacker can do this by pressing the Volume Down' button during device boot," said IBM Security Intelligence. "An attacker with ADB access can do this by issuing the adb reboot bootloader' command. The fastboot mode exposes a USB interface, which on locked devices must not allow any security sensitive operation to be commanded."
However, what IBM discovered was that if the attacker issued the fastboot oem panic' command via the fastboot USB interface, the bootloader would be forced to crash.
The research team explained that such a crash caused the bootloader to expose a serial-over-USB connection, which allowed them to fetch a full memory dump of the device, using tools such as QPST Configuration. They were then able to expose the users' personal data.
Luckily, Google has patched the security bug since IBM's discovery. To make sure your device is safe from the attack, visit the Google website and download the most up to date Nexus software option.
2022 State of the multi-cloud report
What are the biggest multi-cloud motivations for decision-makers, and what are the leading challengesFree Download
The Total Economic Impact™ of IBM robotic process automation
Cost savings and business benefits enabled by robotic process automationFree Download
Multi-cloud data integration for data leaders
A holistic data-fabric approach to multi-cloud integrationFree Download
MLOps and trustworthy AI for data leaders
A data fabric approach to MLOps and trustworthy AIFree Download