Last week at the DEF CON in Las Vegas, security researchers detailed 47 vulnerabilities in the operating system and apps of 25 Android smartphones. These vulnerabilities range from “innocent” flaws that crash devices to dangerous bugs that could allow attackers to gain root access to the device.
Some of the most dangerous vulnerabilities allow attackers to receive and send text messages, take screenshots and videos from the device's camera, view all contacts, install third-party applications without the owner's consent, or even delete all the device's contents.
The vulnerabilities were discovered to exist in pre-installed applications (which are usually not possible to remove) but also in the device drivers themselves, which cannot be removed without losing basic device functions (such as using the camera). The list of affected device manufacturers is long and includes big names such as ZTE, Sony, Nokia, LG, Asus, Alcatel, but also lesser-known companies such as Vivo, SKY, Plum, Orbic, Oppo, MXQ, Leagoo, Essential, Doogee and Coolpad.
“With so many hundreds of devices on the market, manually checking all devices is not an effective solution for finding vulnerabilities,” says Angelos Stavrou, CEO of Kryptowire, and announces the platform that will soon be released narrowed for enterprises, for automatic security checking of all new Android applications and drivers.
However, for some of the companies mentioned earlier, this is not the first time they have been released with dangerous software. In previous reports, devices from ZTE, Leagoo, and Doogee were sold with malware, in some cases even with banking trojans.
