Samsung, Motorola, LG Users Beware Of New Qualcomm Security Flaw

Users of some of the most popular smartphone brands could be at serious risk of cyberattack following the recent discoveries of security researchers on a new set of vulnerabilities in Qualcomm chipsets. Experts at Check Point recently uncovered new vulnerabilities impacting Qualcomm hardware that could enable attackers to steal crucial information from LG, Motorola, and Samsung devices. The findings reveal that the secure world in the CPU of Qualcomm has a flaw that could lead to data getting leaked, devices getting rooted, bootloader getting unlocked, and undetectable APTs being executed.

Information about these newly discovered Qualcomm flaws surfaced only a few months after Qualcomm released a patch to fix the vulnerability that enables attackers to get encryption keys and private data saved in the chipset’s secure world. Check Point initially shared its findings during the Recon Montreal security conference in June, and Qualcomm rolled out fixes for all the flaws following the security company’s disclosure. LG and Samsung both seeded patches to fix their handsets while until now, Motorola is still working on a fix.

Unknown to many, Qualcomm chips have a secure area within the processor known as a Trusted Execution Environment (TEE). This is used to make sure that the data and code the chips contain stays secure and confidential. The Qualcomm TEE is founded on TrustZone technology from ARM, and it enables sensitive data to be stored in a way that it would be impossible to tamper.

Interestingly, Check Point’s four-month investigation utilizing an automated testing system called fuzzing, wherein researchers were able to perform a trustlet in the real world and installed a modified variant necessary to communicate within the secret world. It turned out that Samsung, LG, and Motorola handsets have multiple security flaws. These flaws could enable attackers to initiate trusted apps in the real world and load a patched trusted app into the secret world or even load a trustlets from a different device.

Although TEEs are definitely a new attack ground that cybercriminals will most likely exploit, at present, there is no evidence that these new sets of vulnerabilities uncovered in Qualcomm chipsets are already exploited. But, just a precautionary measure, users of Samsung, LG, and Motorola devices are advised to install the best antivirus software on their devices.