IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Qualcomm and Mediatek flaws left millions of Android users at risk

An open source audio codec used by chipset firms is believed to have put two-thirds of Android users' private calls and files at risk

Qualcomm and MediaTek, two of the biggest chipmakers in the world, have been found to have used vulnerable technology in smartphones that could have led to privacy violations of Android users.

Check Point Research (CPR) discovered a number of vulnerabilities in the Apple Lossless Audio Codec (ALAC), a component responsible for compressing audio data, that could have led to users’ calls and stored images being accessed by cyber attackers.

The researchers believe that more than two-thirds of the world’s Android smartphones were vulnerable to the attacks at some point.

The vulnerabilities were found in the ALAC code which Apple made open source in 2011; the ALAC has since been installed in a wide variety of non-Apple audio playback devices and programmes - not just Android smartphones, CPR said.

Apple has since updated the code since it went open source, but the code in question had not been updated since 2011 and both Qualcomm and MediaTek ported the vulnerable ALAC code into their audio decoders.

Attackers could have used the vulnerabilities to conduct a remote code execution (RCE) attack on smartphones by sending victims a malformed audio file, the researchers said, but will not unveil full details of how the vulnerabilities can be exploited until they are presented at the CanSecWest conference in May.

Related Resource

Microsoft 365 protection made MSPEasy

The cloud protection solution built for MSPs

Whitepaper cover with layered graphic of tablet, envelope and padlockFree Download

“We've discovered a set of vulnerabilities that could be used for remote execution and privilege escalation on two-thirds of the world's mobile devices,” said Slava Makkaveev, reverse engineering and security research, at CPR. “The vulnerabilities were easily exploitable. A threat actor could have sent a song (media file) and when played by a potential victim, it could have injected code in the privileged media service.

“The threat actor could have seen what the mobile phone user sees on their phone. In our proof of concept, we were able to steal the phone's camera stream. What is the most sensitive information on your phone? I think it's your media: audio and videos. An attacker could have stolen that through these vulnerabilities. The vulnerable decoder is based on the code shared by Apple 11 years ago.”

MediaTek tracks both vulnerabilities as CVE-2021-0674 and CVE-2021-0675, scoring 5.5 and 7.8 out of ten on the CVSSv3 threat severity scale, and were patched by the company in December 2021.

Qualcomm tracks the security vulnerability as CVE-2021-30351, scoring 9.8, a critical rating, and affected a score of Snapdragon products. Qualcomm patched the issue in December 2021 and CPR waited until this week to publish details to allow users time to patch.

CPR recommends all Android users regularly patch their phones to the latest version that Google issues on a monthly basis.

Featured Resources

Activation playbook: Deliver data that powers impactful, game-changing campaigns

Bringing together data and technology to drive better business outcomes

Free Download

In unpredictable times, a data strategy is key

Data processes are crucial to guide decisions and drive business growth

Free Download

Achieving resiliency with Everything-as-a-Service (XAAS)

Transforming the enterprise IT landscape

Free Download

What is contextual analytics?

Creating more customer value in HR software applications

Free Download

Recommended

Best smartphone 2022: The top handsets from Apple, Samsung, Google and more
Mobile

Best smartphone 2022: The top handsets from Apple, Samsung, Google and more

8 Apr 2022
Google will cull out-of-date Play store apps in bid to improve Android security
Google Android

Google will cull out-of-date Play store apps in bid to improve Android security

7 Apr 2022
Businesses on alert as mobile malware surges 500%
mobile security

Businesses on alert as mobile malware surges 500%

10 Mar 2022
Microsoft and Qualcomm to develop custom AR chips for the metaverse
augmented reality (AR)

Microsoft and Qualcomm to develop custom AR chips for the metaverse

5 Jan 2022

Most Popular

16 ways to speed up your laptop
Laptops

16 ways to speed up your laptop

13 May 2022
Preparing for the 3G sunset
Network & Internet

Preparing for the 3G sunset

18 May 2022
(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security
Careers & training

(ISC)2 launches free scheme to get 100,000 UK citizens into cyber security

17 May 2022