Security company FireEye has detected an Android exploit that allows attackers to steal device information by accessing the cellular radio.
FireEye, a leading cyber security firm, has uncovered a new flaw in the Android platform that affects devices and exposes them to attacks that allow criminals to access the cellular radio. The so-called privilege escalation exploit is a problem because it gives attackers the ability to take information from the network manager netd daemon.
The cybersecurity company says it notified Qualcomm about the exploit in January of this year, and since then the chip manufacturer has patched netd daemon:
“When contacted by FireEye, Qualcomm was extremely responsive throughout the entire process. They fixed the issue within 90 days – a window they set, not FireEye. FireEye would like to thank Qualcomm for their cooperation throughout the disclosure and diligence with addressing the issues.”
In its report, FireEye says that the exploit is only affecting devices running Android 4.3 Jellybean, but considering the fragmented nature of Android that is over 30% of all devices running the platform.
Android 4.4 KitKat, Lollipop, and Marshmallow builds are protected by newer “Security Enhancements for Android”. However, FireEye notes that access to other system properties can present problems for all Android devices and give attackers control.
Interestingly, the exploit has been around for years, operating without notice as Google Play and even FireEye's own Mobile Threat Prevention software did not classify the APIs as a threat. This has given the exploit a lot of time to infect devices, and while FireEye is not saying how many devices have been infected, the company adds:
“It is possible that hundreds of models are affected across the last five years.” Furthermore, the security company said that it would be “particularly difficult to patch all affected devices, if not impossible.”
Google's Android platform is the most popular mobile based operating system on the market, but it is known for its numerous and frequent security issues. Google, for its part, has worked hard to shore up security to the stock platform, but the company says in the hands of OEMs (who can change the system) that security is partly out of its hands.
