Qualcomm chip flaws put 'millions' of Android devices at risk

Vulnerabilities leave device owners open to data theft and malware that can become unremovable

More than 400 vulnerabilities in code found in Snapdragon mobile CPUs manufactured by Qualcomm are putting Android device users at risk of malware and data exfiltration. 

Following a deep dive on Qualcomm’s Snapdragon chips fitted into the majority of Android handsets, in a process dubbed ‘Achilles’, security researchers identified hundreds of flaws that can be readily exploited.

These flaws have been assigned with seven separate CVE tags and have been disclosed to Qualcomm, which has acknowledged them and notified the relevant device manufacturers, according to Check Point Research

The bugs have been assigned CVE-2020-11201, CVE-2020-11202, CVE-2020-11206, CVE-2020-11207, CVE-2020-11208 and CVE-2020-11209.

“Using our research methodologies and state-of-the-art fuzz testing technologies, we were able to overcome these issues – gaining us with a rare insight into the internals of the tested DSP chip,” Check Point Research said in a blog post. “This allowed us to effectively review the chip’s security controls and identify its weak points.

“We hope this research will help build a better and more secure environment for the DSP chip ecosystem, as well as provide the necessary knowledge and tools for the security community to preform regular security reviews for these chips in order to strengthen the security of mobile devices.”

Hackers can turn the phone into a spying tool without any user interaction, for example, exfiltrating information from the phone, including photos, videos, call-recording, real-time microphone data, GPS, location data, and other data points.

Attackers may also render the phone unresponsive, making all information stored on the device permanently unavailable. This includes all media such as photos and videos, as well as contact details. This, in effect, is equivalent to a targeted denial-of-service attack.

Related Resource

Introducing VMDR: Vulnerability Management, Detection and Response

The all-in-one vulnerability management service

Download now

Cyber criminals can also exploit the vulnerable code to install malware or other malicious code in order to hide their activities. This malicious code can then become unremovable.

These chips are more vulnerable to risks, meanwhile, because they are managed as ‘black boxes’, according to the researchers, and it can be very complex for anybody other than the manufacturer to review their design or functionality. 

Due to the ‘black box’ nature of the CPUs, it is also challenging for the mobile phone vendors themselves to fix these issues, as they will need to be addressed by the chip manufacturer, Qualcomm.

They decided not to publish the full technical details until vendors had comprehensive mitigations and fixes to these issues. 

IT Pro approached Qualcomm for details on a plan to fix these vulnerabilities.

Featured Resources

B2B under quarantine

Key B2C e-commerce features B2B need to adopt to survive

Download now

The top three IT pains of the new reality and how to solve them

Driving more resiliency with unified operations and service management

Download now

The five essentials from your endpoint security partner

Empower your MSP business to operate efficiently

Download now

How fashion retailers are redesigning their digital future

Fashion retail guide

Download now

Most Popular

RMIT to be first Australian university to implement AWS supercomputing facility
high-performance computing (HPC)

RMIT to be first Australian university to implement AWS supercomputing facility

28 Jul 2021
Samsung Galaxy S21 5G review: A rose-tinted experience
Mobile Phones

Samsung Galaxy S21 5G review: A rose-tinted experience

14 Jul 2021
Zyxel USG Flex 200 review: A timely and effective solution
Security

Zyxel USG Flex 200 review: A timely and effective solution

28 Jul 2021