Qualcomm chip flaws put 'millions' of Android devices at risk

Vulnerabilities leave device owners open to data theft and malware that can become unremovable

More than 400 vulnerabilities in code found in Snapdragon mobile CPUs manufactured by Qualcomm are putting Android device users at risk of malware and data exfiltration. 

Following a deep dive on Qualcomm’s Snapdragon chips fitted into the majority of Android handsets, in a process dubbed ‘Achilles’, security researchers identified hundreds of flaws that can be readily exploited.

These flaws have been assigned with seven separate CVE tags and have been disclosed to Qualcomm, which has acknowledged them and notified the relevant device manufacturers, according to Check Point Research

The bugs have been assigned CVE-2020-11201, CVE-2020-11202, CVE-2020-11206, CVE-2020-11207, CVE-2020-11208 and CVE-2020-11209.

“Using our research methodologies and state-of-the-art fuzz testing technologies, we were able to overcome these issues – gaining us with a rare insight into the internals of the tested DSP chip,” Check Point Research said in a blog post. “This allowed us to effectively review the chip’s security controls and identify its weak points.

“We hope this research will help build a better and more secure environment for the DSP chip ecosystem, as well as provide the necessary knowledge and tools for the security community to preform regular security reviews for these chips in order to strengthen the security of mobile devices.”

Hackers can turn the phone into a spying tool without any user interaction, for example, exfiltrating information from the phone, including photos, videos, call-recording, real-time microphone data, GPS, location data, and other data points.

Attackers may also render the phone unresponsive, making all information stored on the device permanently unavailable. This includes all media such as photos and videos, as well as contact details. This, in effect, is equivalent to a targeted denial-of-service attack.

Related Resource

Introducing VMDR: Vulnerability Management, Detection and Response

The all-in-one vulnerability management service

Download now

Cyber criminals can also exploit the vulnerable code to install malware or other malicious code in order to hide their activities. This malicious code can then become unremovable.

These chips are more vulnerable to risks, meanwhile, because they are managed as ‘black boxes’, according to the researchers, and it can be very complex for anybody other than the manufacturer to review their design or functionality. 

Due to the ‘black box’ nature of the CPUs, it is also challenging for the mobile phone vendors themselves to fix these issues, as they will need to be addressed by the chip manufacturer, Qualcomm.

They decided not to publish the full technical details until vendors had comprehensive mitigations and fixes to these issues. 

IT Pro approached Qualcomm for details on a plan to fix these vulnerabilities.

Featured Resources

Humility in AI: Building trustworthy and ethical AI systems

How humble AI can help safeguard your business

Download now

Future of video conferencing

Optimising video conferencing features to achieve business goals

Download now

Leadership compass: Privileged Access Management

Securing privileged accounts in a high-risk environment

Download now

Why you need to include the cloud in your disaster recovery plan

Preserving data for business success

Download now

Most Popular

350,000 Spotify users hacked in credential stuffing attack
Security

350,000 Spotify users hacked in credential stuffing attack

24 Nov 2020
46 million Animal Jam accounts leaked after comms software breach
Security

46 million Animal Jam accounts leaked after comms software breach

13 Nov 2020
Samsung Galaxy Note might be discontinued in 2021
Mobile Phones

Samsung Galaxy Note might be discontinued in 2021

1 Dec 2020