Android has more than its fair share of security vulnerabilities, malware and cyber-attacks, but today a security researcher is reporting an even bigger problem, affecting tens if not hundreds of millions of devices.
Android’s full disk encryption can be broken via brute-force attacks thanks to a series of security vulnerabilities in different components of the platform. What’s worse is that this isn’t Google’s fault, and the problem may not be easily fixed with a patch.
Full disk encryption is what keeps your files secure on your device and what stops attackers, phone makers and even the government from getting at your data without your consent. It’s an important aspect of today’s digital security and it was the central issue in the recent spar between the FBI and Apple. In that case the spooks couldn’t get the data they wanted out of an iPhone because the device was fully encrypted, and not even Apple had the encryption key.
In theory, the same thing would happen with any Android phone that uses Android 5.0 or later. Unfortunately, as security researcher Gal Beniamini has now proved with working code, things aren’t so secure on Android devices, especially those running on Qualcomm processors.
While the technical details are all here, the gist of the research is that Android uses a strong 2048-bit RSA key alongside the user’s PIN, password or pattern to encrypt files. That strong RSA key makes brute-force attacks, where a computer simply tries every single possible combination of a password, almost impossible.
However, the researcher proved that thanks to flaws in the way Qualcomm implements some security measures, combined with Android kernel flaws, an attacker could get that key. That means that all that stands between him and your data is your password. And we know how good users are at choosing secure passwords.
The good news is that the researcher has been working with Qualcomm and Google and some of the software flaws he reported have already been patched. The bad news is that the core of the problem might be wholly unpatchable and might require new hardware to fix.
Beniamini explains that as soon as new escalation of privilege flaws are found the entire exploit-chain becomes viable again. And that’s not even counting the fact that most Android devices are still running on old versions of the OS and get no security or firmware updates anyway.
For its part, Qualcomm says it’s working with Google to address some of the issues in future devices, but Beniamini warns that other chip manufacturers may have used similarly flawed security implementations.
Source: Bits Please
45 Comments - Add comment