Android Phones With Qualcomm SoCs Had Critical Bug That Left Millions of Users at Risk

A new bug in the Qualcomm Mobile Station Modem infrastructure has been uncovered by Check Point Research. The cyber security organisation notes that the Qualcomm Modem Interface (QMI) software that handles the firmware debugger and updater service had a key security flaw that could bypass standard security and verification mechanisms. In what is an alarming but increasingly common occurrence of software bugs giving attackers access to privilege escalation routes and remote code execution backdoors, this vulnerability could reportedly lead to attackers gaining root level access, therefore having critical implications.

These implications include the ability for remote attackers to listen to and record active phone calls, obtain call and messaging logs, and even unlock SIM cards as part of SIM hijack attacks. This is done by attackers exploiting the firmware flaw in the Qualcomm modem to inject malicious code, which then gives them escalated access to phones. These vulnerabilities are key routes through which targeted spyware is spread among specific individuals – as part of of coordinated cyber espionage activities.

A similar flaw had surfaced in August 2020 as well, also reported by Check Point. The previous flaw was even more significant – it allowed attackers to access photos, videos, GPS data and microphone, alongside recording live phone calls. The previous issue persisted with the DSPs or co-processors in Qualcomm phones, and made for a pretty tricky patch process. This time, Qualcomm has claimed that it is already aware of the vulnerability and has issued a patch, putting the onus on Google for the rollout of the fix.

XDA Developers adds that the vulnerability, assigned with CVE-2020-11292, has not featured in any disclosed patch rolled out by Google over the past few months so far. To clarify this, a Qualcomm spokesperson reportedly told XDA that the patch will be listed as part of Google’s June security update that will be rolled out soon. The issue reportedly affects almost 40 percent of all Android devices out there, which is a massive number of smartphones that are potentially at risk.

Read all the Latest News, Breaking News and Coronavirus News here. Follow us on Facebook, Twitter and Telegram.