It’s hard to resist the appeal of a cheap smartphone, especially since it’s now almost as capable as more expensive models. It is for this reason that previously unknown Chinese manufacturers such as Huawei and Xiaomi are rapidly overtaking More established premium manufacturers like Samsung, Sony and even Apple.
But, as with everything, you get what you pay for. A recently discovered vulnerability in many budget Chinese phones that could allow an attacker to gain root access confirms this mod. Here’s what you need to know.
Understanding the Attack
Many phones use an SoC (system on a chip) built by the Taiwanese company MediaTek, which is one of the largest semiconductor manufacturers in the world. In 2013, they produced a phenomenal 220 million smartphone chips. One of their biggest sellers is the MT6582, which is used in a number of budget smartphones, many of which are made by Chinese manufacturers such as Lenovo and Huawei.
The MT6582 shipped with a debug setting enabled, which the manufacturer says was used to test «telecom interoperability» in China.
While MediaTek was necessary to actually design the chip and ensure it works properly, leaving it on a consumer device poses an incredible security risk to consumers. What for? Because it allows an attacker or malware to gain root access to the phone .
This will allow them to change and delete important system files and settings, spy on the user, and install even more malware without the user’s consent. If an attacker wants to, they can even lock the phone, rendering it useless.
According to The Register, this vulnerability can only be executed on phones running version 4.4 KitKat of the Android operating system.
The discovery of this vulnerability follows a similar flaw found in the OS version 3.8 keychain of the Linux kernel, which was disclosed by researchers in January. Using this vulnerability could allow an attacker to gain root access to the computer.
This vulnerability affected almost all Linux distributions, as well as many Android phones. Luckily, a fix was released quickly.
put down the pitchfork
While phones from Lenovo and Huawei have been particularly hard hit, they are not to be blamed. While this may seem attractive, given that some of these manufacturers have a history of security-related violations.
Lenovo is particularly to blame for this. In 2014 they cracked the SSL protocol for all their users with SuperFish owners ends They then saddled their laptops with non-replaceable BIOS-based malware. They then installed the creepy Big Brother analytics program. about their high-quality ThinkPad and ThinkCenter desktops.
But here their hands are clean. One day. The blame lies squarely on MediaTek’s doorstep, which shipped these chips to manufacturers with customization enabled.
