Android devices that contain firmware created by Taiwanese manufacturing behemoth Foxconn may be vulnerable to a debugging feature left inside the operating system bootloader.
The backdoor was discovered by US security expert Jon Sawyer, who dubbed it Pork Explosion, and noted that the flaw can be exploited by connecting an Android smartphone via USB to a computer with appropriate software for interacting with the phone during its boot-up procedure.
While the feature appears to be a debugger function left over by Foxconn, savvy hackers can exploit it to put a connected Android device into its factory test mode.
Form here hackers can gain complete control over the device as the factory test mode bypasses the SELinux Android security control giving people access without any need for authentication.
WHITEPAPER: Mobile Security and Risk Review
“In short, this is a full compromise over USB, which requires no logon access to the device. This vulnerability completely bypasses authentication and authorization controls on the device. It is a prime target for forensic data extraction.
“While it is obviously a debugging feature, it is a backdoor, it isn’t something we should see in modern devices, and it is a sign of great neglect on Foxconn’s part.”
The vulnerability appeared to affect the Nextbit Robin smartphone, but has since been patched, However, Foxconn provides manufacturing services to a huge number of Android devices so many more could be vulnerable to the exploit.
While hackers would need physical access to the phone, the exploit means stolen Android smartphones could be accessed even if the legitimate owner has security measures in place.
For more technical readers, Sawyer recommends taking the following action: “For those looking to detect vulnerable devices, you can check for the partitions “ftmboot” and “ftmdata”. The “ftmboot” partition contacts a traditional Android kernel/ramdisk image. This one has SELinux disabled, and adb running as root. The “ftmdata” partition is mounted on /data during ftm bootmode. These partitions are only a sign that the device is vulnerable.”
Flaws in Android devices and software are sadly not uncommon, with it recently being revealed that 900 million of them could be vulnerable to attack and work arounds of its security being harnessed by malware exploits.
Amazon faces strike actions at facilities across US days before Christmas as union members authorise…
Welcome to Silicon UK: AI for Your Business Podcast. Today, we explore how AI can…
Japanese tech investment firm SoftBank promises to invest $100bn during Trump's second term to create…
Synopsys to work with start-up SiMa.ai on joint offering to help accelerate development of AI…
Start-up Basis raises $34m in Series A funding round for AI-powered accountancy agent to make…
Data analytics and AI start-up Databricks completes huge $10bn round from major venture capitalists as…