25 Smartphone Models Found Shipping With Severe Firmware Flaws: Defcon 2018
This year’s Defcon witnessed many interesting events, including the hacking of voting machines by 11-year-olds and macOS’s vulnerabilities to grant permissions to Malware with the help of invisible clicks.
In another interesting event at Defcon 2018, security researchers from US Mobile and IoT security firm Kryptowire have unearthed the fact that the default apps of 25 Android smartphone models are affected by about 47 vulnerabilities. 11 of the affected smartphones are sold in the US.
These vulnerabilities have been found in some of the big OEM brands. Not only some default apps have issues, but vulnerabilities have also been found in the firmware of core device drivers. In the case of firmware, drivers cannot be removed without affecting the phone’s core functionalities.
Some vulnerabilities involve crashing of devices while other could allow an attacker to send and receive text messages from user’s phone, obtain the affected users’ contact list, record phone screen, grant permissions to install third-party apps without letting users know and even wipe out the device’s entire data.
List of Affected OEM’s
Smartphones from small as well as big OEMs are under the radar. OEMs such as ZTE, Leagoo, and Doogee have been included in the list of insecure Android device manufacturers previously as well. Leagoo and Doogee have been reported to come preinstalled with apps that have banking trojans.
Here is a list of all the affected smartphone models.
- ZTE ZMAX Pro
- ZTE ZMAX Champ
- ZTE Blade Spark
- ZTE Blade Vantage
- Vivo V7
- Sony Xperia L1
- SKY Elite 6.0L+
- Plum Compass
- Orbic Wonder
- Oppo F5
- Nokia 6 TA-1025
- MXQ TV Box
- LG G6
- Leagoo P1
- Leagoo Z5C
- Essential
- Doogee X5
- Coolpad Revvl Plus
- Coolpad Canvas
- Coolpad Defiant
- Asus Zenfone 3 Max
- Asus Zenfone V Live
- Alcatel A30
Does your smartphone feature in this list? Tell us in the comments.
Source: fossbytes
Latest Jobs
-
- IDAM, Identity and Access Management consultant
- London
- N/A
-
The IDAM Consultant is responsible for leading implementation and support of high quality Identity and Access Management services while adhering to standards and best practices. The ideal Candidate would have experience primarily in IAM to serve as a member of a key client engagement teams that assist clients in employing proper information systems, resources, and controls to maximize efficiencies and minimize risk. Ability to take up challenges, adapt to the business needs, and staying focused on delivering results are essential to the success of this role. Key Accountabilities: • Serve as key member of the Identity Management Implementation teams delivering projects at client locations based from Home/London. • Participate in customer work shop to gathering understanding of the customer’s business requirements as it pertains to a solution to manage information security in their organization. Liaise with organizational teams such as Audit, Enterprise Architecture, Help Desk and Application owners • Develop and present a roadmap for security and identity and access management policies • Participate in detailed design and architecture workshops that will address requirements related to people, processes and technology • Perform hands-on implementation, troubleshooting, and setup of the technical infrastructure. • Provide training and knowledge transfer to internal employees and customers on various identity management products and technologies Qualifications Must Have Requisites: Must have previous years of experience and solid knowledge of: • Any Identity Manager: • Any Single Sign On Solution: • Directory servers: Sun DS, ODIEE • Application/Web Server: Websphere, Jboss, Weblogic, Tomcat • Languages: Java, .Net, Xpress • Web Technologies : HTML, XML • Operating Systems: Windows 2003/2008/2012, Unix, Solaris • Tools: VMware Workstation, LDAP Browser, SQL Developer
-
- Contract Cyber Security Project Manager
- London
- N/A
-
Aiding in the transformation of Cyber related projects and programmes ideally with Cloud Azure experience. Experience managing multiple project workstreams including Privileged access management (PAM) projects preferred. Prince2 experience. Outside IR35 Clients based in London
-
- Cloud Security Application architect, Contract
- London
- N/A
-
CSenior Cloud Security Application Architect / Security Consultant with a Cloud Application development background is needed for a 3-6 month initial contract (which is likely to extend) to help a Global business define, design, realign , document and migrate Cloud based applications / solutions in a secure way. Experience must include; Cloud Enterprise application architecture, an application development knowledge (tools, automation / deployment solutions), a background from a development would be ideal (this is not hands on development) but it would always help, This position will help drive the review and development of their cloud security offerings. Broader knowledge security policies and compliance is highly desirable. Client based in London
-
- Identity & Access Management Architect Contractor
- London
- N/A
-
Identity & Access Management Architect Contractor London • Extensive PAM / IAM experience required, • MUST have CyberArk and or Beyondtrust. Privileged access management • Technical review, recommendation, design and hands on technical skills key. • Cloud Azure architect experience ideal. • 6 month contract • Outside IR35