Software vulnerabilities in mobile devices are hardly an infrequent discovery nowadays — a recent report by researchers at NowSecure found that a quarter of mobile apps contain “at least one” high-risk security flaw — but it’s rare that one affects a broad swath of devices. But that’s just what Israeli cybersecurity firm Check Point detailed at the Defcon security conference in Las Vegas last week: a new bug, dubbed “Quadrooter,” that resides within the firmware of a Qualcomm chip contained in more than 900 million devices.
Check Point said that the new vulnerability could, in skilled hands, cede “complete control” of a smartphone or tablet to nefarious programmers. Specifically, it could allow a malicious app to bypass Android’s built-in security measures and grant itself administrative privileges, a level of access that entails the ability to collect “sensitive personal and enterprise data.”
Check Point discovered four specific vulnerability’s in Qualcomm’s firmware, said Adam Donefeld, the firm’s lead mobile security researcher. The firm hasn’t observed any exploits “in the wild,” as of yet, but expects to “in the next three to four months.”
Check Point published a preliminary list of affected devices:
- BlackBerry Priv
- Blackphone 1 and Blackphone 2
- Google Nexus 5X, Nexus 6, and Nexus 6P
- HTC One, HTC M9, and HTC 10
- LG G4, LG G5, and LG V10
- New Moto X by Motorola
- OnePlus One, OnePlus 2, and OnePlus 3
- Samsung Galaxy S7 and Samsung S7 Edge
- Sony Xperia Z Ultra
The flaw requires a would-be victim to install a malicious app — infected code posing as a legitimate update, for instance, or a pirated version of a paid application. Crucially, that precludes apps distributed through Google’s Play Store, which Google regularly scans for malware. Apps infected with Quadrooter’s delivery mechanism would have to be installed manually by toggling the “Unknown Applications” setting in Android’s settings menu.
It would also likely require that users disable Android’s “Verify Apps” feature, a malware filter that scans for known vulnerabilities in apps — including those installed manually, outside of the Play Store’s walled garden — at installation time.
A Google spokesperson confirmed as much in a statement to Android Central:
“We appreciate Check Point’s research as it helps improve the safety of the broader mobile ecosystem … Exploitation of these issues depends on users also downloading and installing a malicious application. Our Verify Apps and SafetyNet protections help identify, block, and remove applications that exploit vulnerabilities like these.”
That’d be a challenging feat. Android Central notes that the protection has been enabled by default in all Android versions since 4.2 Jelly Bean in 2012, and that it’s frequently updated with new virus definitions via Google Play Services, the Android framework responsible for delivering Google app updates. Google also conducts security scans of Android phones about “once per week” by default and can, in some cases, uninstall infected applications from handsets remotely.
A Qualcomm spokesperson told ZDNet that it issued patches to “customers, partners, and the open source community” between April and the end of July. Google, for its part, said that “most” of the fixes had been rolled into Android’s monthly security update — the collection of firmware fixes that the company makes available to its Android partners.
Google said it will issue a fourth and final fix in September, the month of its next security update. As ZDNet notes, that doesn’t mean Android phone makers won’t implement a fix sooner — Qualcomm’s already published patched code.
Check Point said the nature of the exploit highlights the difficulty in ensuring that Android devices, oversight of which typically involves at least a handful of parties, remain inoculated against new threats. “This situation highlights the inherent risks in the Android security model,” Check Point stated in its report. “Critical security updates must pass through the entire supply chain before they can be made available to end users. Once available, the end user must then be sure to install these updates to protect their devices and data.”
It’s a problem exacerbated when some partners refuse to play ball. Lenovo caused a stir when it implied in a recent statement that the Moto Z, its new flagship phone in the U.S., wouldn’t be receiving monthly security patches. The company has since clarified its stance, but the issue of infrequent, incomplete, or otherwise haphazard security updates has prompted activity at the federal level. The Federal Trade Commission and the Federal Communications Commission are compiling a report, due out later this year, about the decision process involved in “[patching] a vulnerability on a particular mobile device.”
The Quadrooter report follows the discovery of two major Android vulnerabilities in the past year, Stagefright and Fake ID. The former, a fix for which is scheduled for September, tapped into bugged code within Android’s multimedia playback and allowed apps to gain administrative access. The latter, meanwhile, let malicious apps assume the identity of legitimate software. A patch was issued in late July.