domeet webmaster

ThisText from WeChat public number:New Wit (ID: AI_era), Source: forbes, etc., edit: Xiao Qin, Liang Liang, original title: “Android is exposed to serious camera loopholes! Lock screen can also sneak a sneak peek, or monitor hundreds of millions of users, title Figure from: Vision China

Awesome! Camera applications for Google and Samsung phones have recently been exposed to serious security vulnerabilities that could be used by hackers to monitor hundreds of millions of users. Through the vulnerability, hackers can take pictures of the victim’s mobile phone, record video, record call voice, and even track user location. Is the phone still safe?

You may have been watching, but you don’t know who is watching.

The camera has been upgraded from a mobile phone’s accompanying features to a way to record life. In the face of golden ginkgo forest, the first snow of the branches, the hot pot with friends, we will take out the mobile phone, open the camera to take a photo or record vlOg, this is already the channel through which we watch, record and express the world.

But if you don’t notice it, the phone camera is turned on to monitor your life. This may be the modern world of Truman.

Now, if this happens, there is a possibility of becoming a reality.

According to foreign media reports, Checkmarx’s security research team found vulnerabilities in Android phones. The attacker can bypass Android permissions by accessing the phone storage space, and can remotely without obtaining the user’s consent. Control the phone for remote taking, recording video, and monitoring conversations.

New results from Checkmarx’s cutting-edge software vulnerability research team, Google and Samsung mobile phone vulnerabilities can be monitored by cameras

The research team said that there are loopholes in the loopholes? Is it alarmist? First, let’s take a look at what Checkmarx’s security research team is all about.

Checkmarx is a high-tech software company in Israel and the manufacturer of Checkmarx CxSuite, the world’s most famous source code security scanning software. CheckmaRx was nominated as the leader of the 2019 Gartner Application Security Test Magic Quadrant, and was awarded the Archive Defense 2019 Infosec Award in the App Security category for market security, winning the annual Application Security Solutions Award.

The security research team’s research on cutting-edge software vulnerabilities in Amazon’s Alexa, Tinder, LeapFrog LeapPad, etc., “Good Morning America” ​​news, “Consumer Report” and “Fortune”, including well-known media reports, triggered Industry concerns.

This time, Checkmarx’s security research team is working on Google Camera app

Before, the research team also revealed that Amazon’s Alexa and Tinder have this problem.

Only considering the coverage of Google and Samsung phones, these vulnerabilities could affect or even threaten hundreds of millions of users.

Chilling: Malicious apps silently take pictures, videos, eavesdrops…

This vulnerability is named CVE-2019-2234, which itself allows a malicious application to remotely retrieve input from camera, microphone, and GPS location data. The impact of being able to do this is so serious that the Android open source project (AOSP) has a set of permissions, and any application must be available to the user.Request these permissions and get permission before you can enable such operations.

What the Checkmarx researchers did was create an attack scenario that abused the Google Camera app itself to bypass these permissions. To do this, they created a malicious application that took advantage of one of the most frequently requested permissions: Storage access.

The permission for a malicious application request is only “storage access”

“This malicious application running on an Android smartphone can read the SD card,” Yalon said. “It can not only access past photos and videos, but also take advantage of this new attack method to take random shots of new ones.” Photos and videos.”

Malicious apps quietly launch video recordings on your phone

Malicious application remote recording call

How can an attacker exploit a vulnerability in the Google Camera app?

Checkmarx created a proof of concept (PoC) vulnerability by developing a malicious application. This is a weather app that has been popular in the Google App Store. This application does not require any special permissions other than basic storage access. The application is less likely to alert the user because it is only required to request such a simple, normal license. After all, people are used to questioning unnecessary, extensive licensing requests and not questioning a single, common licensing request.

However, this app is far from harmless. It is divided into two parts, one is the client application running on the smartphone, and the other is the command and control server connected to it to execute the attacker’s command.

After installing and launching the application, it creates a persistent connection to the command and control server and then waits for instructions. Closing the application does not close the server connection.

What instructions can an attacker send, and what does it cause? This long list may make you shudder:

• Use your smartphone camera to take photos and upload them to the command serviceDevice.

• Use your smartphone camera to record video and upload it to the command server.

• By monitoring the proximity sensor of the smartphone to determine when the phone is close to the ear, waiting for the voice call to start, and recording the audio of both parties.

• In the course of a monitored call, the attacker can also record the user’s video while recording the audio.

• Get GPS tags from all the photos taken and use them to locate the phone owner on a global map.

• Access and copy stored photos and video information, as well as images captured during an attack.

• Being secretly by muteing your smartphone while taking pictures and recording videos, you won’t be alerted by the sound of the camera shutter.

• You can activate photo and video events regardless of whether your smartphone is unlocked.

< /p>

Google Camera App Vulnerability Disclosure Schedule

Google and Samsung recently released this information to ensure that both companies have released bug fixes. However, the vulnerability information was disclosed on July 4th, and Checkmarx submitted a vulnerability report to Google’s Android security team, which began the behind-the-scenes disclosure.

On July 13, Google initially set the severity of the vulnerability to medium, but further in Checkmarx