Samsung, Pixel Users No Longer at Risk for Android Camera App Hijacking
Many of today’s flagship Android phones have fantastic cameras, but the camera app on Google and Samsung phones reportedly shipped with a nasty bug that could have allowed malicious apps to capture images without your authorization. The companies didn’t know about the bug until earlier this year when researchers from Checkmarx alerted them. It’s a good thing, too. This could have been a huge mess if someone exploited it in the wild.
The report from Checkmarx is a bit surprising because we’re not used to seeing Android bugs like this anymore. Google implemented a robust permission system in Android 6.0 Marshmallow, and it has been strengthening its controls in subsequent versions. So, when apps want to access the camera, users have to approve the request. However, Checkmarx found a method by which apps could take control of the camera on Google Pixel and Samsung Galaxy Phones without asking for permission.
The problem traces back to the Samsung Bixby and Google Assistant AI features and the way they communicate with the built-in camera apps. On these phones, the user can ask the assistant to take a photo. Assistant and Bixby have special status so they don’t have to go through the usual permission dialog. That makes the experience smoother, but it’s also where a malicious app could gain control of your camera.
Checkmarx demonstrated that an app could pretend to be sending voice requests via Bixby or Assistant, but in reality, it was just accessing the camera directly. The app could then send the photos to a remote location without ever asking for camera access. You can see the attack in action above.
Checkmarx reported the flaw to Google and Samsung earlier this year. Luckily, there is no evidence of this attack showing up in the wild, and you don’t have to worry about your phone’s security. Both Google and Samsung rolled out patched versions of their camera apps in July 2019 that prevent third-party apps from imitating voice requests for camera access. So, the bug is fixed, but at its peak, it would have affected millions of phones. Most of them would have been Samsung devices, but it’s still a bit embarrassing for Google as it frequently points out security snafus at other companies.
Continue reading
Massachusetts Passes Robust Automotive Right-to-Repair Law
Right to repair advocates scored a major victory this week with the passage of Question 1 in Massachusetts. Hailed as the most advanced right to repair law in the land, Question 1 requires that automakers create an open data platform for sharing diagnostic and repair information with independent shops and vehicle owners.
Sony May Let Users Move Games Off PS5, Xbox Series X SSD Is User-Replaceable
Microsoft is using a user-replaceable SSD for the Xbox Series X, while Sony is researching PS5 game transfers.
Xbox Series X Launch Is Microsoft’s Biggest Ever, Causes ISP Traffic Spike
Microsoft claims the Xbox Series X is its most successful debut in history and specifically calls out the Xbox Series S for bringing new players into the fold.
How Does Windows Use Multiple CPU Cores?
We take multi-core awareness for granted these days, but how do the CPU and operating system communicate with each other in the first place?