A vulnerability that can steal passwords and credit card information on Qualcomm chips is discovered
By
A vulnerability has been discovered that allows Qualcomm chips on Android smartphones to extract credit card and private key information in addition to passwords stored on the device.
The Road to Qualcomm TrustZone Apps Fuzzing-Check Point Research
https://research.checkpoint.com/the-road-to-qualcomm-trustzone-apps-fuzzing/
Qualcomm Chip Flaws Let Hackers Steal Private Data From Android Devices
The vulnerabilities in question were discovered by Check Point Research, a research and development department at Check Point Software Technologies , known for firewalls and VPN security products, over a four-month research period.
The Qualcomm chip had a system called 'Qualcomm Secure Execution Environment (QSEE)' based on ARM's 'TrustZone'. QSEE is a system that physically separates the area where the platform OS and normal applications are executed from the secure area where the 'Trusted Application', which is an application related to DRM processing, certificate management and encryption / decryption, is executed. In QSEE, while the secure area can recognize general-purpose OS processing, the general-purpose OS cannot recognize the secure area, so it is difficult to extract information such as passwords and credit cards stored in the secure area. It has been said.
By TheDigitalArtist
This time, Check Point Research broke through QSEE by using a method called “ fuzzing ”, which inputs a large amount of data and observes system behavior one by one. We created custom tools to perform fuzzing on Samsung, LG, and Motorola devices, and found vulnerabilities for each company's devices.
Using discovered vulnerabilities, you can run trusted applications, load patched trusted applications into secure areas, bypass Qualcomm's trust chain, or load trusted applications extracted from other devices. Check Point Research explains that various security problems such as
The Qualcomm chip vulnerability discovered this time affects not only smartphone devices but also IoT devices. Check Point Research has reported the results to each company, and Qualcomm, Samsung, and LG have already released patches.
Related Posts:
