Vulnerabilities in MediaTek chips expose millions of Android devices to eavesdropping
Another reason to only download apps from trusted app stores
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Cybersecurityresearchers have uncovered multiple security flaws in chips made by Taiwanese manufacturerMediaTekfound in 37% of the world’ssmartphones, warning that some could be chained together to enable attackers to eavesdrop on unsuspecting users.
Check Point Research (CPR) found the security flaws inside the audio processor that’s used in all modern MediaTek mobile chips.
CPR explained that MediaTek chips contain a special AI processing unit (APU) and audio Digital signal processor (DSP), both of which have custom microprocessor architectures. In order to find the degree to which MediaTek DSP could be used as an attack vector, CPR reverse engineered the MediaTek audio processor to reveal several security flaws.
We’re looking at how our readers use VPNs with streaming sites like Netflix so we can improve our content and offer better advice. This survey won’t take more than 60 seconds of your time, and we’d hugely appreciate if you’d share your experiences with us.
Click here to start the survey in a new window«
New attack vector
CPR brought the vulnerabilities to the attention of MediaTek, who has since patched the bugs.
Explaining how a threat actor could exploit the security vulnerabilities, CPRsaysa hypothetical attack would begin with the user installing a maliciousAndroidapp, which uses the MediaTek API to attack a library that has permissions to talk with the audio driver.
The app, which has system privileges, sends crafted messages to the audio driver to execute code in the firmware of the audio processor, which enables it to capture the audio passing through the DSP.
“In summary, we proved out a completely new attack vector that could have abused the Android API. Our message to the Android community is to update their devices to the latest security patch in order to be protected,” says Slava Makkaveev, security researcher at Check Point Software.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Both CPR and MediaTek assert that they haven’t found any evidence of the vulnerability being exploited in the wild.
Meanwhile, if you are really concerned about privacy, you should consider using one of thesebest VPNor thesebest secure smartphones
With almost two decades of writing and reporting on Linux, Mayank Sharma would like everyone to think he’sTechRadar Pro’sexpert on the topic. Of course, he’s just as interested in other computing topics, particularly cybersecurity, cloud, containers, and coding.
Phishing attacks surge in 2024 as cybercriminals adopt AI tools and multi-channel tactics
This new phishing strategy utilizes GitHub comments to distribute malware
Smeg Combi Steam Oven review: a multi-functional countertop oven that looks stunning and cooks well
