Security Vulnerability in Qualcomm Chips Affects Nearly 40 Percent of Smartphones; Compromises Flagship Android Phones

Verify Level researchers found a safety vulnerability in Qualcomm’s Cell Station Modem (MSM) chips affecting practically 40% of smartphones available in the market. The safety flaw impacts even the most recent flagship telephones utilizing Qualcomm chips manufactured by Google, Samsung, LG, Xiaomi, and One Plus. If exploited, the bug might permit hackers to inject malicious code and entry textual content and audio conversations on Android telephones.

Verify Level found the vulnerability months after disclosing about 400 vulnerabilities affecting Qualcomm’s Snapdragon digital sign processor (DSP) in August 2020.

Safety vulnerability in Qualcomm chips permits attackers to unlock SIM on Android telephones

Verify Level’s analysis discovered that the safety vulnerability CVE-2020-11292 might permit hackers to use Qualcomm chips to entry textual content messages and listen in on conversations.

Menace actors might additionally exploit the vulnerability to unlock the subscriber identification module (SIM) and authenticate on the affected units.

Susceptible Qualcomm chips might additionally permit hackers to make use of the Android OS because the preliminary entry level to inject malicious code. This makes Android telephones extremely susceptible to the MSM safety flaw in comparison with different smartphones.

Moreover, they may use susceptible Qualcomm chips to hide malicious code and keep away from detection by any cell safety options.

The cybersecurity agency notified Qualcomm of the safety vulnerability in October 2020. The chipmaker validated the outcomes and issued patches two months later in December 2020. Checkpoint additionally printed the technical particulars of the vulnerability in a weblog submit dated Might 26, 2021.

Qualcomm vulnerability impacts even the newest 5G smartphones

Machine producers use Qualcomm chips to offer community connectivity for 2G/3G/4G/5G cell units. Android telephones talk with MSM Qualcomm chips by means of the Qualcomm MSM Interface (QMI).

QMI provides numerous companies comparable to Wi-fi knowledge service (WDS) and Machine administration service. OEMs can add companies to QMI. For instance, LG consists of LGE resim service to deal with SIM unlock requests in its T-Cell Android telephones.

A susceptible MSM might due to this fact be used to use these companies and bypass system safety features comparable to authentication by malicious actors. A risk actor might accomplish this by exploiting the heap overflow safety vulnerability within the QMI.

Moreover, Qualcomm real-time OS (QuRT), which manages the MSM, could be debugged, dumped, and rooted on Android telephones. TrustZone is the one bulwark towards potential exploitation of the QuRT on Android telephones.

Nevertheless, profitable exploits have been carried towards Qualcomm Trusted Execution Surroundings (QTEE), in accordance with Verify Level safety researchers.

“In our analysis, we fuzzed MSM knowledge companies so we might discover a solution to patch QuRT on trendy SoCs straight from Android,” the report authors wrote.

Qualcomm fastened one other safety vulnerability in 2020, affecting Snapdragon digital sign processor. The flaw might have allowed attackers to gather real-time microphone knowledge, name recordings, pictures, movies, and GPS and site knowledge.

The chipmaker suggested customers to keep away from downloading Android functions from third-party sources to keep away from profitable exploitation of susceptible Qualcomm chips.

“Relating to the Qualcomm Compute DSP vulnerability disclosed by Verify Level, we labored diligently to validate the difficulty and make applicable mitigations obtainable to OEMs. Now we have no proof it’s at present being exploited. We encourage end-users to replace their units as patches grow to be obtainable and to solely set up functions from trusted places such because the Google Play Retailer.”

Verify Level safety researcher Slava Makkaveev famous that the DSP processes private data and was accessible for invocation from third-party functions. This permission uncovered the element to potential exploitation by malicious actors who’re serious about accessing private data.

The analysis on Snapdragon DSP famous that attackers might exploit Qualcomm chips by means of Qualcomm’s Hexagon SDK. They may write directions to crash, modify or execute malicious code by means of the skeleton libraries gluing Android telephones to Qualcomm chips.

Want to make sure safety of third-party elements

“This latest safety difficulty with Qualcomm highlights the significance of thorough safety vetting pre and post-deployment,” says Shachar Menashe, VP Safety at Vdoo. “On this case, it appears we’re coping with a privilege escalation vulnerability, which implies it lets potential attackers run code on the Qualcomm modem if you have already got excessive privileges on the Android software layer.”

Menashe says that his firm Vdoo discovered an identical safety vulnerability within the QCMAP element of the QMI. He famous that the QMI ought to additional investigated for doubtlessly extra vulnerabilities.

#Safety vulnerability found by Verify Level on Qualcomm chips might permit #hackers to inject malicious code and unlock SIM in #Android telephones. #respectdata

Click on to Tweet

“Automated evaluation can assist establish zero-day vulnerabilities and configuration dangers, even in closed-source elements,” Menashe added. “Producers must belief that their third-party elements are safe, particularly when these programs are utilized in practically 40% of the cellphones offered in the present day.”