BingoTingo Best Place To Gain Knowledge & WP Theme
Google warns that some Samsung-powered Android (opens in new tab) Devices suffer from very serious vulnerabilities that allow threat actors to penetrate the remote endpoints without user intervention.
In a blog post (opens in new tab) published on the Project Zero website earlier this week, Google’s researchers said they reported 18 zero-day vulnerabilities found in Samsung’s Exynos modems in late 2022 and early 2023. Of those 18, four are very severe, allowing internet-to-baseband remote code execution.
With many organizations relying on mobile devices to power their workforce, financially motivated hackers, as well as state-sponsored threat actors from the likes of China and Russia, will seek to exploit these flaws in malicious data theft and espionage campaigns.
No user interaction required
“Tests conducted by Project Zero confirm that these four vulnerabilities allow an attacker to remotely compromise a baseband-level phone without user intervention, and only that the attacker knows the victim’s phone number. With limited additional research and development, we believe that skilled attackers can quickly create an operational exploit to silently and remotely compromise affected devices,” the researchers said.
Of the four vulnerabilities, only one has an assigned CVE – CVE-2023-24033. The other three are pending.
Since the Android ecosystem is decentralized, the speed at which the bugs receive patches depends on the manufacturers. For example, Google already patched these flaws for its Pixel smartphone lineup in the March update.
For others, like Samsung or Vivo, it depends on how quickly these companies respond. For that reason, Google decided not to share more details about the flaws, so as not to give the attackers a head start.
While waiting for the patch, IT teams concerned about the bugs can look for a workaround: disabling Wi-Fi calling and Voice-over-LTE (VoLTE) essentially defuses the vulnerabilities.
Here’s the full list of all affected devices, according to Google’s Project Zero:
- Samsung mobile devices, including S22, M33, M13, M12, A71, A53, A33, A21, A13, A12, and A04 series;
- Vivo mobile devices, including those in the S16, S15, S6, X70, X60, and X30 series;
- Google’s Pixel 6 and Pixel 7 series devices;
- all wearables using the Exynos W920 chipset; And
- all vehicles using the Exynos Auto T5123 chipset.
Since the bugs only affect Android devices running Exynos, the news comes as an unexpected win for Qualcomm, especially in the SMB sector. Whether the company will capitalize on the news and how, remains to be seen.
Via: TechCrunch (opens in new tab)
