Google discovers that dozens of Android devices can be “silently” compromised

[ad_1]

Google has discovered that dozens of Android devices can be compromised without any user interaction due to multiple zero-day vulnerabilities in Samsung’s Exynos modems. Affected devices include smartphones, wearables, and even vehicles.

As reported by TechCrunch(Opens in a new window), Google’s Project Zero security analyst team discovered a total of 18 zero-day vulnerabilities. Four of these are severe enough to allow remote code execution from the broadband Internet, meaning an attacker only needs a victim’s phone number to compromise their phone, with no interaction required from part of the user.

Tim Willis, head of Project Zero, explains in a blog post(Opens in a new window) that, “With limited additional R&D, we believe skilled attackers would be able to quickly create an operational exploit to silently compromise the devices involved and at a distance”.

As vulnerabilities are found in Exynos modems, dozens of devices are affected. Google has provided the following list of products that can be compromised:

Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7 and Pixel 7 Pro from Google

Samsung devices of the S22, M33, M13, M12, A71, A53, A33, A21, A13, A12 and A04 series

Vivo devices of the S16, S15, S6, X70, X60 and X30 series

Any wearable device using the Exynos W920 chipset

All vehicles using Exynos Auto T5123 chipset

Maddie Stone, a security researcher on the Project Zero team, confirmed in a tweet(Opens in new window) that Samsung was given 90 days to release a patch, but none were released.

Because there is such a wide variety of devices affected by these vulnerabilities, the patch timeline will vary. Google included a fix for Pixel devices in the March 2023 Security Update(Opens in new window), but it needs to be installed and some Pixel models are still waiting for it to arrive (Pixel 6, Pixel 6 Pro and Pixel 6a) .

Recommended by our editors

If you own one of the affected devices and don’t want to wait for a security patch, Google recommends turning off Wi-Fi calling and Voice-over-LTE (VoLTE) in your device’s settings. It’s also worth checking if your device has any updates waiting to be installed.

As for the 14 other zero-day exploits found by Project Zero, Willis says they “aren’t that serious, as they require a malicious mobile network operator or an attacker with local access to the device.” However, Samsung will still have to produce a patch to fix these security vulnerabilities as soon as possible.

Google Pixel 7 and Pixel 7 Pro Reviewed Get our best stories!

Sign up for What’s New Now to get our best stories delivered to your inbox every morning.

This newsletter may contain advertisements, offers or affiliate links. Signing up for a newsletter indicates your agreement to our Terms of Use and Privacy Policy. You can unsubscribe from newsletters at any time.

[ad_2]