LG has issued a security update to fix a hacking issue on one of its G3 series phones that affected the Smart Notice app, a pre-installed app on all of its new devices.
Security researchers from BugSec and Cynet, Liran Segal and Shachar Korot, discovered that attackers could inject and then execute malicious JavaScript through Smart Notice.
The app, launched by LG in 2014, works by displaying various notifications on the user's home screen. These notifications appear for certain events, such as a reminder note, a callback reminder, a new contact, notifications for favorite contacts, and birthday notifications.
During their experiments, the researchers created a contact entry that contained malicious code and was added to the contact entries and was ultimately responsible for triggering callbacks and birthday notifications.
The vulnerability, the weak point in the overall security, was that an attacker did not necessarily need the user to approve the download of a new contact. The researchers experimented with infection vectors that uploaded malicious contacts to the victim's phone, without any interaction required. They explained that this could be done via QR codes, MMS messages, or WhatsApp contacts.
Once a user was infected with the contact in question, regardless of the method, every time the Smart Notice app was used to show the reminder, the malicious code would be executed in parallel.
The problem lies in the fact that LG developers forgot to add validation rules for the Smart Notice application to prevent the execution of malicious code, obtained from the contact list, on the phone.
BugSec and Cynet researchers claimed that during their tests, they were able to take full control of the device. In their experiment, which can be seen in the video below, they initially managed to establish a connection to the C&C server, from where they instructed the phone to carry out other commands.
[su_youtube url=”https://www.youtube.com/watch?v=sI8Xk0pQHU4″ width=”580″ height=”380″]
The researchers were able to launch phishing attacks, steal data from the device, and even install other apps that acted as backdoors.
Users who would like to avoid putting their phone at risk should upgrade to the latest version of Smart Notice, which LG released just yesterday.
