Mediatek has confirmed that a ‘potential security issue’ has been discovered on certain smartphones and tablets that are running Android 4.4 Kitkat. The company hasn’t confirmed which brands or models might be affected but states that the vulnerability could allow someone to enable root permissions remotely via a malicious application.
Mediatek states that the problem arrises when debugging on a phone is left active when released to the public. The company says that Chinese phone makers have been warned to check this in the future but phones already in users hands could be at risk.
AFTER TESTING, PHONE MANUFACTURERS SHOULD DISABLE THE DE-BUG FEATURE BEFORE SHIPPING SMARTPHONES. HOWEVER, AFTER INVESTIGATION, WE FOUND THAT A FEW PHONE MANUFACTURERS DIDN’T DISABLE THE FEATURE, RESULTING IN THIS POTENTIAL SECURITY ISSUE.
If loaded on a phone with debug activated, a malicious application could change permissions of core Android security settings to enable ADB over WIFI and allow remote root access.
Activating debug on a phone or tablet is also often used by more experienced Android users, modders etc, but those more tech savvy people are more less prone to installing dodgy software. Casual users with little knowledge of modding are more likely to find this a security issue.
At this time we don’t know if Mediatek will be making a fix to remotely turn off debug in all phones with the problem or if simply telling manufacturers to double-check their settings in the future is their ‘fix’.
Source:http://www.gizchina.com/2016/01/30/security-issue-found-on-mediatek-android-kitkat-devices/
No comments:
Post a Comment