Over the weekend, researchers from the Cyber Security firm Check Point released a report on a new vulnerability. This report exposed some very risky vulnerabilities within the Qualcomm chipsets used in an estimated 900 million Android smartphones and tablets. This is roughly equivalent to 65 percent of the global 4G/LTE chipset market as of 2015.
There are a total of four different flaws within the chipset that when exploited by an attacker will allow them to gain control of your device. This allows the attacker to steal any data the device may store. These vulnerabilities are being named for the time being “QuadRooter.” Check Point has alerted both Qualcomm and Google to these flaws back in April. The team then followed the industry-standard practice of waiting for 90 days for patches to be produced before disclosing these vulnerabilities to the public. Android devices that are updated to Google’s newest security patch level are protected already against three out of four of these vulnerabilities. However, the fourth vulnerability CVE-2016-5340 still remains a prominent threat.
The most popular phones affected by the remaining QuadRooter vulnerability include, but are not limited to:
- BlackBerry Priv
- Blackphone 1 and 2
- Google Nexus 5X, 6 and 6P
- HTC One M9 and HTC 10
- LG G4, G5, and V10
- New Moto X by Motorola
- OnePlus One, 2 and 3
- Samsung Galaxy S7 and S7 Edge
- Sony Xperia Z Ultra
Unfortunately, there is not much that device owners can do to protect themselves from the remaining flaw found in this chipset. However, we recommend that you stay aware of the threat. The most straightforward way that this vulnerability can be exploited is through malicious applications from the app store. You should also check frequently with your manufacture to see if any patches are available for your device to fix these issues. Check Point has also released a QuadRooter Scanner app via Google Play, this app is designed to scan for any of these potential flaws in your device. This application can also provide users with more information.
The other CVEs associated with this vulnerability are (CVE-2016-2059), (CVE-2016-2503), and CVE-2016-2504).