Capitol hill, Residential neighborhood in Washington, D.C., United States

New Delhi, Nov 11 Google has warned that a commercial surveillance vendor was exploiting three zero-day security vulnerabilities in new Samsung smartphones that could have been exploited to steal users' data.All three vulnerabilities were in the manufacturer's custom components rather than in the Android Open Source Project (AOSP) platform or the Linux kernel."It's also interesting to note that 2 out of the 3 vulnerabilities were logic and design vulnerabilities rather than memory safety," said Maddie Stone, Project Zero."While we understand that Samsung has yet to annotate any vulnerabilities as in-the-wild, going forward, Samsung has committed to publicly sharing when vulnerabilities may be under limited, targeted exploitation, as part of their release notes," Stone added in a blog post."We hope that, like Samsung, others will join their industry peers in disclosing when there is evidence to suggest that a vulnerability is being exploited in-the-wild in one of their products".The Google Threat Analysis Group (TAG) obtained a partial exploit chain for Samsung devices that it believes belonged to a commercial surveillance vendor."All 3 vulnerabilities are within Samsung custom components, including a vulnerability in a Java component," said the team.The exploit sample targeted Samsung phones running kernel 4.14.113 with the Exynos SOC."Samsung phones run one of two types of SOCs depending on where they're sold. For example the Samsung phones sold in the United States, China, and a few other countries use a Qualcomm SOC and phones sold in most other places (example Europe and Africa) run an Exynos SOC," said the Google team.Examples of Samsung phones that were running kernel 4.14.113 in late 2020 (when this sample was found) include the S10, A50, and A51 smartphones, the team added."The analysis of this exploit chain has provided us with new and important insights into how attackers are targeting Android devices. It highlights a need for more research into manufacturer specific components," said Google.Disclaimer: This post has been auto-published from an agency feed without any modifications to the text and has not been reviewed by an editor

Capitol HillFOLLOW

Capitol hill, Latest News

Automation Anywhere, the #1 leader in cloud-native intelligent automation, announced today that Neeti Mehta Shukla, the company's Co-Founder and Social Impact Officer, is the recipient of Women's Entrepreneurship Day Organization (WEDO) Technology Pi ...

Los Angeles, Nov 16 Actress Kerry Washington once stored her breast milk in the White House fridge. The ... ...

Senior officials from several governments, the UN Environment Program (UNEP) and the UN Framework Convention on Climate Change (UNFCCC) ... ...

After reports emerged about Russian missiles falling in Polish territory, the United States on Tuesday stressed on the need ... ...

The United States has condemned the explosion in Istanbul that resulted in the death of at least six people. ... ...

The United States cannot stop Pakistan from purchasing Russian oil and it will be possible to do so soon, ... ...

SaaS-based physical access control and smart buildings startup Spintly raised USD 2.5M in a pre-series A round of funding. The round saw participation from Lets Venture, Accel Nest, SucSEED Indovation, RiSo Capital, Defang Technology, 91 Ventures, Ky ...

New Delhi, Nov 11 Google has warned that a commercial surveillance vendor was exploiting three zero-day security vulnerabilities ... ...