Newly-discovered vulnerabilities-“Quadrooter” found in Android devices that ship with a Qualcomm chip, could allow an attacker to take absolute control of an affected device.
Quadrooter which includes four undisclosed vulnerabilities will affect over 900 million phone and tablets, according to researchers at security firm, Check Point .
Adam Donenfeld , Lead Mobile Security Researcher at Check Point said that an attacker would have to trick a user into installing a malicious app, which unlike some malware wouldn’t require any special permissions. If any of the flaws are successfully exploited, an attacker can gain root access, which gives the attacker full access to an affected Android device, its data, and its hardware — including its camera and microphone.
Check Point said most phone makers have devices that are vulnerable Google’s Nexus 5X, Nexus 6, and Nexus 6P, HTC’s One M9 and HTC 10, Samsung Galaxy S7 and S7 Edge and BlackBerry DTEK50 are some of those named vulnerable to one or more of the flaws.
Chip maker, Qualcomm said the company has fixed all the flaws, and had issued patches to customers, partners, and the open source community between April and the end of July. Most of those fixes have already gone into Android’s monthly set of security patches, which Google issues early each month to its own-brand Nexus devices. Many other phone and tablet makers roll out those patches at the same time or in the following few days.
Three flaws were fixed in Google’s latest set of monthly security updates, but one of the vulnerabilities is still outstanding, largely because the final patch wasn’t issued in time. The fourth flaw will be fixed in the upcoming September update, due out a little after the start of next month, Google confirmed.
“Qualcomm has a significant position in the development chain, in that a phone maker isn’t taking the Android open-source code directly from Google, they are actually taking it from Qualcomm”, Michael Shaulov, Head of Mobility Product Management at Check Point
He explained that this only complicates the patching process, which led to the delay in getting the final fix out in time to meet Check Point’s three-month period of private disclosure. “No-one at this point has a device that’s fully secure. That basically relates to the fact that there is some kind of issue of who fixes what between Qualcomm and Google.”