Vulnerability to make phone call without permission to Android 4.1.1, 4.1.2, 4.2.2, 4.3, 4.4.2

If the Android application requires an action such as a call, the OS can stop the behavior of the application that does not have access authority, but the security companyCuresecMade publicVulnerability information database (CVE)According to a smartphone with Android version 4.1.1, 4.1.2, 4.2.2, 4.3, 4.4.2 installed, a vulnerability has been discovered that allows outgoing calls without permission.

Cureblog - Der Blog der Curesec GmbH
http://blog.curesec.com/article/blog/35.html


In the latter half of 2013, Curesec is investigating the components of Android in detail, creating a vulnerability information database (CVE) on the vulnerability found, and reporting it to the Android security team to improve security. A similar investigation was continued and similar vulnerability was discovered and it is possible to make a phone call by external access without user's permission on Android version 4.1.1, 4.1.2, 4.2.2, 4.3, 4.4.2 smartphone It turned out that there was.

If you exploit the bug of the problem included in the code of "com.android.phone.PhoneGlobals $ Notification BroadcastReceiver.", The malware application will be able to make a call without acquiring the permission of the call,MMIcode·USSDIt is possible to send code as well. Although the number of compatible terminals is still small, this vulnerability has been fixed in the latest Android 4.4.4 (KitKat).

Curesec has released an application that can actually verify outgoing calls using vulnerabilities, and you can download apk files from the following.

CRT-Lolme.apk
http://www.curesec.com/data/CRT-Kolme.apk

I actually install and verify the application on Nexus 4 equipped with Android 4.4.2. For installation, it is necessary to check "Setting unknown application" set on self-responsibility.


Next, expand the downloaded apk file and tap "Install". It says "I do not need special permission".


Tap "Open".


Three "test call" buttons are installed in the application. For Android 4.4.2, tap the third "Test Call SDK> = 17" ......


The telephone application launched without any warning and started sending to the test number "31337".


I tried it with Galaxy S equipped with Android 4.3 and it says "Test call failed, Please try another SDK". Although it is the target version, no matter what button you pressed, the phone did not hang on your own.


As of now, only Nexus series below can update to Android 4.4.4.

◆Nexus Series
· Nexus 4
· Nexus 5
· Nexus 7 (2012 model · 2013 model)
· Nexus 10