In-depth

Google patches Nexus bug that lets hackers steal data from locked devices

IBM’s security team found the Nexus 5X glitch after discovering a bypass hole

Google has patched a security bug in its Nexus 5X smartphones that could have exposed sensitive user data stored on handsets, even if they were locked.

IBM's security team found the Nexus 5X glitch after discovering a bypass hole that could allow hackers to dump memory from locked phones via a bootloader problem that could also facilitate wholesale memory dumps via USB, such as a charger.

IBM X-Force research lead Roee Hay said exploiting the flaw was simple and only required a device to be put into fastboot mode.

"A vulnerability in Nexus 5X's bootloader allows an attacker to obtain a full memory dump of the device," said Hay. "The vulnerability can be exploited by physical attackers or by non-physical ones having Android Debug Bridge [ADB] access to the device."

One possible scenario where a non-physical attacker can get ADB access is by first targeting an ADB-authorised developer's PC and infecting it with malware, the IBM researchers said.

Another way is by using malicious chargers targeting ADB-enabled devices. "Using such chargers requires the victim to authorise the charger once connected," the IBM team said.

In this instance, the victim is a Nexus 5X user with Android 6.0 MDA39E through 6.0.1. In order to achieve a successful attack, the attacker needs to reboot the phone into the well-known fastboot' mode, which can be done without any authentication.

"A physical attacker can do this by pressing the Volume Down' button during device boot," said IBM Security Intelligence. "An attacker with ADB access can do this by issuing the adb reboot bootloader' command. The fastboot mode exposes a USB interface, which on locked devices must not allow any security sensitive operation to be commanded."

However, what IBM discovered was that if the attacker issued the fastboot oem panic' command via the fastboot USB interface, the bootloader would be forced to crash.

The research team explained that such a crash caused the bootloader to expose a serial-over-USB connection, which allowed them to fetch a full memory dump of the device, using tools such as QPST Configuration. They were then able to expose the users' personal data.

Luckily, Google has patched the security bug since IBM's discovery. To make sure your device is safe from the attack, visit the Google website and download the most up to date Nexus software option.

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Identity Automation launches credential breach monitoring service
phishing

Identity Automation launches credential breach monitoring service

5 Oct 2021
Neiman Marcus data breach hits 4.6 million customers
data breaches

Neiman Marcus data breach hits 4.6 million customers

4 Oct 2021
Indiana notifies 750,000 after COVID-19 tracing data accessed
data breaches

Indiana notifies 750,000 after COVID-19 tracing data accessed

18 Aug 2021
Pearson fined $1 million for downplaying severity of 2018 breach
data breaches

Pearson fined $1 million for downplaying severity of 2018 breach

17 Aug 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021