25 Smartphone Models Found Shipping With Severe Firmware Flaws: Defcon 2018

This year’s Defcon witnessed many interesting events, including the hacking of voting machines by 11-year-olds and macOS’s vulnerabilities to grant permissions to Malware with the help of invisible clicks.

In another interesting event at Defcon 2018, security researchers from US Mobile and IoT security firm Kryptowire have unearthed the fact that the default apps of 25 Android smartphone models are affected by about 47 vulnerabilities. 11 of the affected smartphones are sold in the US.

These vulnerabilities have been found in some of the big OEM brands. Not only some default apps have issues, but vulnerabilities have also been found in the firmware of core device drivers. In the case of firmware, drivers cannot be removed without affecting the phone’s core functionalities.

Some vulnerabilities involve crashing of devices while other could allow an attacker to send and receive text messages from user’s phone, obtain the affected users’ contact list, record phone screen, grant permissions to install third-party apps without letting users know and even wipe out the device’s entire data.

List of Affected OEM’s

Smartphones from small as well as big OEMs are under the radar. OEMs such as ZTE, Leagoo, and Doogee have been included in the list of insecure Android device manufacturers previously as well. Leagoo and Doogee have been reported to come preinstalled with apps that have banking trojans.

Here is a list of all the affected smartphone models.

ZTE ZMAX Pro
ZTE ZMAX Champ
ZTE Blade Spark
ZTE Blade Vantage
Vivo V7
Sony Xperia L1
SKY Elite 6.0L+
Plum Compass
Orbic Wonder
Oppo F5
Nokia 6 TA-1025
MXQ TV Box
LG G6
Leagoo P1
Leagoo Z5C
Essential
Doogee X5
Coolpad Revvl Plus
Coolpad Canvas
Coolpad Defiant
Asus Zenfone 3 Max
Asus Zenfone V Live
Alcatel A30

Does your smartphone feature in this list? Tell us in the comments.

Source: fossbytes