Flaws that could give hackers complete access to a smartphone have been found in the microchips of millions of Android devices

Security flaws that could give hackers complete access to a smartphone have been found in the processors of hundreds of millions of Android devices, researchers claim.

Computer security firm Check Point says that the bugs could affect up to 900m Android phones, including some made by BlackBerry, Google and LG among others.

The bugs are caused by vulnerabilities in the processor chips used by US firm Qualcomm in those phones , and allows an attacker to craft a malicious app which can do almost anything on the phone – a flaw called “privilege escalation”. However, there is no evidence that the issue has yet been used in the wild to attack real phones.

The firm has dubbed the flaws “QuadRooter”, because there are four interconnected flaws which can be used to gain access to the “root” of the phone, the most secure section of the operating system. An attacker with root access has full control over a device and can do anything from completely replacing the operating system to logging every single action on the phone and uploading everything to a third party.

According to Check Point, speaking at the Def Con hacking convention in Las Vegas, an app taking advantage of QuadRooter could “give attackers complete control of devices and unrestricted access to sensitive personal and enterprise data on them”. The company named Google’s Nexus 5X, Nexus 6, and Nexus 6P, HTC’s One M9 and HTC 10, and Samsung’s Galaxy S7 and S7 Edge as some of the phones affected by the flaw.

Qualcomm said: “We were notified by the researcher about these vulnerabilities between February and April of this year, and made patches available for all four vulnerabilities to customers, partners, and the open source community between April and July.”

Just because manufacturers know of the bug and how to fix it, doesn’t mean consumers are safe: each individual manufacturer still has to create a specific fix for their model of phone, and in many cases individual mobile carriers then have to themselves agree to roll that fix out to their customers. As a result, Check Point suggested that the Android platform as a whole – which is open to dozens of different manufacturers and software developers – was part of the issue, with updates taking too long to pass through the system.

“This situation highlights the inherent risks in the Android security model,” the firm said. “Critical security updates must pass through the entire supply chain before they can be made available to end users. Once available, the end users must then be sure to install these updates to protect their devices and data.”

Last year, Google announced an initiative to solve these problems, confirming that their phones would be kept secure for at least three years after launch. The company’s own-brand Nexus smartphones have indeed received a fix for three of the four flaws identified by Check Point. The fourth fix missed out on the fix because the final patch wasn’t issued in time.

Check Point has encouraged users to keep their phone’s software up to date in order to keep it secure, and said it has also created a free app called QuadRooter Scanner, which can be used to check whether a user’s phone is at risk.

Unpatched users do still have some defence, however. A malicious app must be installed on their phone before it can take advantage of the vulnerability, and Google now explicitly vets apps uploaded to its own app store before publication to ensure they are safe to use. Some still slip through the cracks, however, and third-party app stores, particularly popular in China where the official Google Play Store isn’t available, may not have such protections.

The vulnerability is the most widespread seen in the Android platform since 2015’s Stagefright bug, which affected the operating system’s media handling technology. That bug affected the vast majority of Android phones, even after the security researcher who discovered it gave manufacturers 90 days advance warning to fix the problems before going public.

The embarrassing lag between learning of the problem and issuing a fix led some manufacturers, including Google and Samsung, to promise a radical overhaul in how they handle security fixes for top-tier phones. But the vast majority of Android phones aren’t the luxury models covered by such promises, and it remains unclear whether such mid-market devices will ever see fixes for flaws like QuadRooter.

