Vulnerability to steal photos and call voices without permission from Pixel and Samsung Android smartphones is discovered
by
Israeli security company Checkmarx said, “Google and Samsung Android smartphones can use cameras and microphones without the user ’s permission. Vulnerable I found a sex. ' This vulnerability named ' CVE-2019-2234 ' is said to have been fixed by Google and Samsung at the time of writing the article, but the same vulnerability also lurked on Android smartphones of manufacturers other than both companies It is possible that there is.
Android_Camera_Vulnerability_Report_FINAL_v2_ (002) .pdf
(PDF file) https://info.checkmarx.com/hubfs/Reports/Android_Camera_Vulnerability_Report_FINAL_v2_(002).pdf
How Attackers Could Hijack Your Android Camera to Spy on You
https://www.checkmarx.com/blog/how-attackers-could-hijack-your-android-camera
Google & Samsung fix Android spying flaw. Other makers may still be vulnerable | Ars Technica
https://arstechnica.com/information-technology/2019/11/google-samsung-fix-android-spying-flaw-other-makers-may-still-be-vulnerable/
When you play the following movie, you can see how Checkmarx is actually taking over the camera and microphone of an Android smartphone with a dummy application.
Hijacking Google Pixel Camera Application-YouTube
Checkmarx has tested the vulnerabilities of Pixel 2 XL and Pixel 3 with Android 9, but Samsung has confirmed that it has an impact on its smartphones.
This time, Checkmarx uses a
The app returned to the home screen immediately after launching the app, but the attacker's PC already has a hacking menu.
Click “Take Photo” and the camera on your smartphone will start for a moment ...
I immediately returned to the home screen with no shutter sound.
However, photos taken by the smartphone's rear camera are sent to the attacker's PC. Furthermore, from the GPS information included in the
Even if the smartphone is turned down, the ceiling of the room captured by the rear camera is projected on the PC, and you can see that the camera can be used without problems even when the smartphone is in the sleep state. Also, the attacker can detect that the screen has been turned down by information from the proximity sensor.
By exploiting this vulnerability, it is possible to steal video and audio as well as photos. In the movie, a woman is calling with a smartphone in her right ear.
The video captured by the smartphone during the call was displayed on the attacker's PC. In this way, being able to obtain information from proximity sensors means that smartphones can steal video while aiming at the moment during a call. Of course, since the video also includes audio, the content of the conversation is okay.
Media files stored on the SD card can also be freely accessed, so all photos and movies taken before installing the fake app will be stolen. In addition, you can delete photos and videos that have been stolen, so the victim won't notice when they check the photos on their smartphones.
According to Checkmarx, the vulnerabilities discovered this time are likely due to the fact that the Android smartphone's camera is linked to Google Assistant or a third-party assistant app. Google has confirmed through Checkmarx, “The Google device issue affected by this vulnerability has been fixed by a Google Camera update delivered in July 2019. Similar patches are available to all Android partners. It is possible. '
Checkmarx hasn't revealed the manufacturers of smartphones affected by the vulnerability, other than Google and Samsung, but it says, “To ensure proper damage mitigation and general security measures, all applications on the device are up to date. Please update to '.
Related Posts:
