Hackers can break into Android devices by sending a text
Not long ago, we saw the emergence of sim swapping attacks utilizing a loophole in the two-factor authentication process. Now in the latest, researchers from Check Point have discovered vulnerabilities in certain Android-based phones including the likes of Samsung, Huawei, Sony, and LG which allows attackers to access your information.
These phone companies collectively happen to make up 50% of all Android phones according to statistics from 2018, therefore, chances are that every second Android user is now vulnerable to the attacks identified by Check Point.
The technology exploited is called Over-the-Air provisioning (OTA) which has been used commonly by cellular networks to update network settings on a user’s phone. As it requires nothing more than a tap, its ease of use is behind its popularity as a method to do so.
How it does this is through classical phishing. When the suggested settings message appears, one is naturally inclined to believe that is must be from a legitimate authority. However, there is no actual way of verifying where it originated from due to the industry-standard contained within the Open Mobile Alliance Client Provisioning (OMA CP) protocol, and this very ambiguity is what attackers exploit.
They send OTP messages claiming to be a cellular network and when an unsuspicious user accepts them, they’re basically agreeing to however the hackers want them to handle the information routing process even if the phone cannot be hacked in this way.
To list them, the settings that can be changed includes browser homepage & bookmarks, mail servers, proxy addresses and much more. On the lighter side, Android users will at least now know the reason behind their settings randomly changing.
The equipment required to construct such an attack isn’t expensive either making it attractive to a wider pool of black hat hackers. As Check Point puts it,
On the other hand, Sony has refused to fix anything citing the use of standard measures as a pretext. Moreover, Check Point’s researchers successfully tested the exploits on different phones including Huawei P10, Sony Xperia XZ Premium, LG G6, and the Samsung Galaxy S9.
It is important to note that among these brands, Samsung phones were the most vulnerable as they featured no authenticity check at all contrary to the others.
However, the fact that Huawei and Sony have left their current phones vulnerable is very alarming and if anything, it is an open invitation for their users to switch to safer alternatives. Perhaps, Apple can have a good laugh about it? or maybe not since Google hackers recently exposed how iPhones were being hacked for years using malicious websites.
Latest Jobs
-
- Senior Data Privacy Consultant. Client Facing | London
- London
- N/A
-
Senior Data Privacy Consultant. Client Facing | London Senior Data Privacy Consultant needed for a key client facing opportunity. Must be willing to undergo SC Security Clearance. Hybrid role- onsite with customer / office 2-3 days a week. London Key Responsibilities: Lead and support client facing data privacy projects. Assess compliance, define and deliver strategic projects / implement privacy solutions. Manage project teams and develop business opportunities. Required Experience: Experience in data protection and privacy standards. Background in consulting. Skills and Qualifications: Business consulting experience IAPP Privacy Manager / Privacy Technologist Location Greater London UK based role. Not able to provide VISA sponsorship.
-
- Security Analyst - Internal role. London commutable. Permanent
- London
- N/A
-
Security Analyst - Internal role. London commutable opportunity. Operational Security - Investigate, escalate and proactively work to ensure household name remains protected. Project Security - Coordinate, log change requests with project delivery teams to meet security requirements Policy / compliance - work with team to aid in uplifting these as and where needed This role is role to investigate, escalate and proactively work to protect a globally recognised brand. You must have current hands on operational analytical security experience with Microsoft technology stack Someone with a SOC Analyst / security engineering background would be well suited. This position will join a small team and would suit someone that has broad experience across the security threat landscape. Experience / knowledge across industry GRC standards such NIST, ISO27001 etc very advantageous and a priority. You will work across multiple teams proactively working to secure the business. Must be able to commute to Central London 3 days a week. Visa sponsorship not available Apply today to find out more.
-
- Network / Security Infrastructure Engineer | West London | Permanent
- London
- N/A
-
Network / Security Infrastructure Engineer | West London | Current Config, Install, upgrade experience On prem / Datacetner experience essential. Hands on experience MUST include: Routing, Switching, Network Security (firewall, IDS etc), Microsoft exchange / Exchange 365. Scripting / automation experience wanted. Python, Powershell etc Regular travel to West London is required. Visa sponsorship not available. Apply today for more information chris.holt@dclsearch.com Use this whatapp link to reach out https://wa.me/message/6USF5RAQBOZIP1
-
- SailPoint File Access Manager Consultant/ Architect
- N/A
- discussed on applications
-
SailPoint File Access Manager (SailPoint FAM) Consultant/ Architect is required for an up coming projects, Ideally looking for someone with experience in Designing and deploying SailPoint FAM , this is a new Deployment, you will work with customer in the initial workshop phase, to understand requirements and to get the initial design, you will then be responsible for deploying the solution. This is a home based role, with some onsite visits required during the length of the project. We are looking for someone who has previous experience in Deploying SailPoint FAM (ideally done design work) Need to have experience with SharePoint and ideally Azure and Share file