Qualcomm chip flaws put 'millions' of Android devices at risk

Vulnerabilities leave device owners open to data theft and malware that can become unremovable

Qualcomm logo displayed on a smartphone screen

More than 400 vulnerabilities in code found in Snapdragon mobile CPUs manufactured by Qualcomm are putting Android device users at risk of malware and data exfiltration. 

Following a deep dive on Qualcomm’s Snapdragon chips fitted into the majority of Android handsets, in a process dubbed ‘Achilles’, security researchers identified hundreds of flaws that can be readily exploited.

These flaws have been assigned with seven separate CVE tags and have been disclosed to Qualcomm, which has acknowledged them and notified the relevant device manufacturers, according to Check Point Research

The bugs have been assigned CVE-2020-11201, CVE-2020-11202, CVE-2020-11206, CVE-2020-11207, CVE-2020-11208 and CVE-2020-11209.

“Using our research methodologies and state-of-the-art fuzz testing technologies, we were able to overcome these issues – gaining us with a rare insight into the internals of the tested DSP chip,” Check Point Research said in a blog post. “This allowed us to effectively review the chip’s security controls and identify its weak points.

“We hope this research will help build a better and more secure environment for the DSP chip ecosystem, as well as provide the necessary knowledge and tools for the security community to preform regular security reviews for these chips in order to strengthen the security of mobile devices.”

Hackers can turn the phone into a spying tool without any user interaction, for example, exfiltrating information from the phone, including photos, videos, call-recording, real-time microphone data, GPS, location data, and other data points.

Attackers may also render the phone unresponsive, making all information stored on the device permanently unavailable. This includes all media such as photos and videos, as well as contact details. This, in effect, is equivalent to a targeted denial-of-service attack.

Related Resource

Introducing VMDR: Vulnerability Management, Detection and Response

The all-in-one vulnerability management service

Download now

Cyber criminals can also exploit the vulnerable code to install malware or other malicious code in order to hide their activities. This malicious code can then become unremovable.

These chips are more vulnerable to risks, meanwhile, because they are managed as ‘black boxes’, according to the researchers, and it can be very complex for anybody other than the manufacturer to review their design or functionality. 

Due to the ‘black box’ nature of the CPUs, it is also challenging for the mobile phone vendors themselves to fix these issues, as they will need to be addressed by the chip manufacturer, Qualcomm.

They decided not to publish the full technical details until vendors had comprehensive mitigations and fixes to these issues. 

IT Pro approached Qualcomm for details on a plan to fix these vulnerabilities.

Featured Resources

Unlocking collaboration: Making software work better together

How to improve collaboration and agility with the right tech

Download now

Four steps to field service excellence

How to thrive in the experience economy

Download now

Six things a developer should know about Postgres

Why enterprises are choosing PostgreSQL

Download now

The path to CX excellence for B2B services

The four stages to thrive in the experience economy

Download now

Most Popular

Microsoft is submerging servers in boiling liquid to prevent Teams outages
data centres

Microsoft is submerging servers in boiling liquid to prevent Teams outages

7 Apr 2021
Hackers are using fake messages to break into WhatsApp accounts
instant messaging (IM)

Hackers are using fake messages to break into WhatsApp accounts

8 Apr 2021
How to find RAM speed, size and type
Laptops

How to find RAM speed, size and type

8 Apr 2021