IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Qualcomm chip flaws put 'millions' of Android devices at risk

Vulnerabilities leave device owners open to data theft and malware that can become unremovable

More than 400 vulnerabilities in code found in Snapdragon mobile CPUs manufactured by Qualcomm are putting Android device users at risk of malware and data exfiltration. 

Following a deep dive on Qualcomm’s Snapdragon chips fitted into the majority of Android handsets, in a process dubbed ‘Achilles’, security researchers identified hundreds of flaws that can be readily exploited.

These flaws have been assigned with seven separate CVE tags and have been disclosed to Qualcomm, which has acknowledged them and notified the relevant device manufacturers, according to Check Point Research

The bugs have been assigned CVE-2020-11201, CVE-2020-11202, CVE-2020-11206, CVE-2020-11207, CVE-2020-11208 and CVE-2020-11209.

“Using our research methodologies and state-of-the-art fuzz testing technologies, we were able to overcome these issues – gaining us with a rare insight into the internals of the tested DSP chip,” Check Point Research said in a blog post. “This allowed us to effectively review the chip’s security controls and identify its weak points.

“We hope this research will help build a better and more secure environment for the DSP chip ecosystem, as well as provide the necessary knowledge and tools for the security community to preform regular security reviews for these chips in order to strengthen the security of mobile devices.”

Hackers can turn the phone into a spying tool without any user interaction, for example, exfiltrating information from the phone, including photos, videos, call-recording, real-time microphone data, GPS, location data, and other data points.

Attackers may also render the phone unresponsive, making all information stored on the device permanently unavailable. This includes all media such as photos and videos, as well as contact details. This, in effect, is equivalent to a targeted denial-of-service attack.

Related Resource

Introducing VMDR: Vulnerability Management, Detection and Response

The all-in-one vulnerability management service

Download now

Cyber criminals can also exploit the vulnerable code to install malware or other malicious code in order to hide their activities. This malicious code can then become unremovable.

These chips are more vulnerable to risks, meanwhile, because they are managed as ‘black boxes’, according to the researchers, and it can be very complex for anybody other than the manufacturer to review their design or functionality. 

Due to the ‘black box’ nature of the CPUs, it is also challenging for the mobile phone vendors themselves to fix these issues, as they will need to be addressed by the chip manufacturer, Qualcomm.

They decided not to publish the full technical details until vendors had comprehensive mitigations and fixes to these issues. 

IT Pro approached Qualcomm for details on a plan to fix these vulnerabilities.

Featured Resources

Meeting the future of education with confidence

How the switch to digital learning has created an opportunity to meet the needs of every student, always

Free Download

The Total Economic Impact™ of IBM Cloud Pak® for Watson AIOps with Instana

Cost savings and business benefits

Free Download

The business value of the transformative mainframe

Modernising on the mainframe

Free Download

Technology reimagined

Why PCaaS is perfect for modern schools

Free Download

Most Popular

How to boot Windows 11 in Safe Mode
Microsoft Windows

How to boot Windows 11 in Safe Mode

7 Jun 2022
Attracting and retaining talent through training
Sponsored

Attracting and retaining talent through training

13 Jun 2022
Delivery firm Yodel disrupted by cyber attack
cyber attacks

Delivery firm Yodel disrupted by cyber attack

21 Jun 2022