Hacking Smartphones Running on MediaTek Processors

 

A dangerous backdoor has been discovered in the MediaTek processor that could be exploited to hack Android devices remotely.

MediaTek is a Taiwan-based hardware company that manufacture hardware chips and processor used in the smartphones and tablets.

The backdoor was discovered by security researcher Justin Case, who already informed MediaTek about the security issue via Twitter, as the chipset manufacturer had no proper vulnerability reporting mechanism in place.

The vulnerability is apparently due to a debug tool that was opened up for carriers to test the device on their networks, but unfortunately, it was left open in the shipped devices, thus leaving the serious backdoor open to hackers.

If exploited, the debug feature could allow hackers to compromise personal data of an Android device, including user’s private contacts, messages, photos, videos and other private data.

MediaTek acknowledged the issue, saying "We are aware of this issue, and it has been reviewed by MediaTek’s security team. It was mainly found in devices running Android 4.4 KitKat, due to a debug feature created for telecommunication inter-operability testing in China."

The issue actually resides in MediaTek MT6582 processor, which worryingly is being used in many high profile Android devices.

So, if your smartphone is using this processor, the only thing you can do for now is to…

...Keep your Android device off the Internet in an effort to protect yourself.

The company also said that it has notified all OEMs of the potential loophole, so it's now up to the affected OEMs to issue a security patch to close the backdoor.

"While this issue affected certain manufacturers, it also only affected a portion of devices for those manufacturers. We have taken steps to alert all manufacturers and remind them of this important feature," MediaTek spokesperson released a statement.

Read more

Samsung Get Sued for Failing to Update its Smartphones

 

 

One of the world's largest smartphone makers is being sued by the Dutch Consumers' Association (DCA) for its lack in providing timely software updates to its Android smartphones.

The majority of manufacturers fail to deliver software updates for old devices for years.

However, the consumer protection watchdog in The Netherlands, The Dutch Consumentenbond,filed a lawsuit against Samsung, due to the manufacturer's grip over the local market compared to other manufacturers.

Last year, the discovery of the scary Stagefright Security Bug, which affected over 1 Billion Android devices worldwide, forced Samsung to implement a security update process that "fast tracks the security patches over the air when security vulnerabilities are uncovered a security update process that "fast tracks the security patches over the air when security vulnerabilities are uncovered," and that the security updates will occur once per month.

However, the watchdog also blames Korean OEM Samsung for not being transparent regarding the critical security updates, like the update to fix Stagefright exploits, that are necessary to "protect [its] consumers from cyber criminals and the loss of their personal data."

Majority of Samsung Handsets Vulnerable to Issues

According to DCA's own research, at least 82 percent of Samsung smartphones available in the Dutch market examined had not received any software updates on the latest Android version in two years.

This failure in providing the software updates left the majority of Android devices vulnerable to issues on security and others.

The DCA says that the agency has previously contacted Samsung many times and discussed the matter privately with the manufacturer giant to resolve the situation, but it failed to reach an agreement with the company, and so it decided to go to court.

At this point, I should mention that these are entirely valid claims.

Like most other manufacturers, Samsung doesn't provide timely software updates to its devices.

No doubt, the Samsung Galaxy S6 series have received Stagefright patches on time, but the manufacturer failed to provide Stagefright fixes for its majority of midrange and entry-level Android devices.

Furthermore, none of Samsung's devices currently runs the latest Android 6.0 Marshmallow, three months after it officially launched.

DCA's Demands from Samsung

The agency has requested the manufacturer to update all of its smartphone devices to the latest version of Android operating system for two years since the handset is purchased (not launched).

In some ways, the agency wants Samsung to treat software updates as part of the warranty that has its length mandated at two years in the European Union.

"[We are] demanding that Samsung provides its customers with clear and unambiguous information about this," The DCA writes. "Also, [we are] demanding that Samsung actually provides its smartphones with updates."

Response by Samsung

In response to the lawsuit, Samsung released an official statement saying the company was working on improving its updates on software and security.

"We have made a number of commitments in recent months to better inform consumers about the status of security issues, and the measures we are taking to address those issues,"reads the statement. 

"Data security is a top priority and we work hard every day to ensure that the devices we sell and the information contained on those devices are is safeguarded."

Read more

Google patches critical media processing and rooting vulnerabilities in Android

The flaws can be exploited remotely through emails, Web pages, MMS, and rogue apps.

A statue for Google's Android Marshmallow operating system sits on the Google campus in Mountain View on August 17, 2015. 

Google has released a new batch of security fixes for its Nexus smartphones and tablets, addressing flaws that could allow attackers to compromise the Android devices via rogue emails, Web pages, and MMS messages.

Firmware updates are being rolled out to supported Nexus devices as an over-the-air update and the patches will be added the Android Open Source Project (AOSP) over the next 48 hours. Builds LMY48Z and Android Marshmallow with a Dec. 1, 2015, Security Patch Level contain these fixes, Google said in its security bulletin.

The updates address five vulnerabilities rated as critical, 12 rated as high and two as moderate. A significant number of flaws were again located in the OS’ media processing components, which handle audio and video file playback and corresponding file metadata parsing.

One of the critical vulnerabilities is located in mediaserver, a core part of the operating system, and can be exploited to execute arbitrary code with privileges that third-party applications are not supposed to have. Attackers can exploit the flaw remotely by tricking users into playing specifically crafted media files in their browsers or by sending them via multimedia message (MMS).

It’s worth noting that Google has disabled automatic parsing of multimedia messages received in Google Hangouts and Messenger, the default messaging applications in Android.

Three other media processing vulnerabilities that can lead to remote code execution via email, Web browsing and MMS have been patched in the Skia graphics engine and the user mode display driver loaded by mediaserver.

The last critical vulnerability patched in this release is a privilege escalation flaw in the Android kernel. It potentially allows rogue applications to execute code as root, the highest privilege on the system.

This is the type of flaw that enables so-called Android rooting, which some enthusiasts use to gain complete control over their devices. But in the hands of malicious attackers, such a flaw can lead to a full and persistent device compromise that can only be fixed by re-flashing the operating system.

Additional privilege escalation flaws have been fixed in other components with this release, but they’re rated only as high because they don’t provide root access. They can, however, give rogue apps dangerous permissions that they shouldn’t have.

Google recommends that users of older Android versions update to the latest one, if possible—for example, if their device manufacturers provided updates. That’s because newer versions of Android have security enhancements in place that can make exploitation of some vulnerabilities harder or impossible.

Google’s security team also uses features like Verify Apps and SafetyNet to monitor for and block potentially harmful applications. For example, apps that use privilege escalation flaws to root devices are not allowed in Google Play and Verify Apps will block known rooting apps by default.

For comprehensive coverage of the Android ecosystem, visit Greenbot.com.

Read more