Vulnerability Exposes 900M Android Devices—and Fixing Them Won’t Be Easy

Ron Czapala

https://www.wired.com/2016/08/quadroot-android-vulnerability-qualcomm/

Excerpt:

THE LATEST ANDROID vulnerability to fret about isn’t limited to any particular device, or any specific firmware version. That’s because it doesn’t start with Android at all, but with Qualcomm, the company that provides internal components for hardware manufacturers. Lots of them. In this case, 900 million Android smartphones with Qualcomm inside are at risk, and fixing them will be no easy task.

As security research firm Check Point detailed this week, the vulnerability in question is actually a set of four issues, collectively called QuadRooter, and affects Qualcomm chipsets from manufacturers ranging from HTC to LG to OnePlus to Google, which contracts with other makers for its own Nexus devices. It’s serious; compromised devices would give bad actors root access, meaning they could collect any data stored on the phone, control the camera and microphone, and track its GPS location. It’s like giving someone the keys to your house, then holding the door open for them while they make off with the jewels.

Heater.

Not a big problem, unless you go out of your way to install dodgy apps.

http://www.androidcentral.com/quadrooter-5-things-know-about-latest-android-security-scare

MikeDYur

I go out of my way to look for apps that require no permissions, or what they specifically need to run. After running the Quadrooter Scanner from the playstore, I got these vulnerability's. I tried over the air programming, but didn't clear them up. I don't like apps that continually ask for updates, and then want more permissions. Going to get rid of everything and make this a dumb phone.

Heater.

As as far as I can tell the vulnerabilities are built into the driver software on your phone. They have been there forever, they were not introduced by any apps you have installed.
They are only exploitable if you ignore a bunch of security warnings and load some dodgy app from some strange place.

But I agree. The way permissions are handled on phones is terrible. And for that reason I never install any apps.

MikeDYur

Thanks Heater, I was almost on a mission.

Phil Pilgrim (PhiPi)

Since the vulnerability comes from Qualcomm components, is it safe to assume they only affect CDMA phones and not GSM phones?

-Phil

Ron Czapala

Phil Pilgrim (PhiPi) wrote: »

Since the vulnerability comes from Qualcomm components, is it safe to assume they only affect CDMA phones and not GSM phones?

-Phil

Nope - I have a Moto G GSM with a Qualcomm MSM8226 Snapdragon 400 chipset and the CheckPoint app shows it is vulnerable...

MikeDYur

@Heater, You were right. I scanned my wife's phone when she got home, it came up with the same problems. And she is a game nut, she will download a game even if it had a whole page of permissions.

erco

Unless the free vulnerability app is actually a rootkit...

Who ya gonna call?

MikeDYur

erco wrote: »

Unless the free vulnerability app is actually a rootkit...

Who ya gonna call?

If someone is looking through my camera, they could see this comming.

BTW: It comes with the engineers short course on proper usage.