Using an unrecoverable vulnerability, you can spy on any Android smartphone

[НСК-СБ]

Using an unrecoverable vulnerability, you can spy on any Android smartphone
09/03/2018, Mon, 11:15, Moscow time, Text: Vladimir Bakhur

A vulnerability has been discovered with the help of which attackers can obtain user information, determine and track his location, is relevant for almost all smartphones on various versions of the Android OS. You can only protect yourself from it with the latest Android 9.0 (Pie).

A gaping security hole in several generations of Android OS
A new vulnerability CVE-2018-9489, discovered in the Android operating system, allows applications to ignore and bypass restrictions on access and transfer of system information. This was reported by Nightwatch Cybersecurity, whose specialists first discovered and described this vulnerability.

According to Nightwatch Cybersecurity, the vulnerability allows attackers to gain unauthorized access to user data, such as the Wi-Fi network name used by the device, the network MAC address of the device, the server’s network address, BSSID, and the network’s BSS network identifier, as well as the server’s basic network ID and BSSID, as well as the network’s BSS network identifier and the server’s network identifier, BSS local IP addresses.

“System broadcasts with Android OS provide information about the user's device to all running applications, including the Wi-Fi network name, BSSID, local IP addresses, DNS server information and MAC address. Part of this information (MAC address) is accessed through the API starting with Android 6 and higher; additional permissions are usually required to access the rest of the information. Nevertheless, intercepting system messages, any application on the device can get this information, bypassing any prohibitions and access permissions checks. ” - noted analysts at Nightwatch Cybersecurity.

There will be no solution to the problem
The vulnerability problem is relevant not only for various versions of Android, but also for operating systems - clones based on it, for example, Amazon FireOS for Kindle readers.

Having access to the pool of this data, anyone with the help of preinstalled applications can track the movements of the smartphone user. In addition, attackers can take advantage of leakage data to carry out an attack on a Wi-Fi network with the risk of hacking and access of all devices on this network.

Screenshots with application permissions on Google Play
According to Nightwatch Cybersecurity analysts, Google is aware of this vulnerability and has already closed it in the latest version of the Android 9.0 Pie operating system.

The real problem is that today, updating to Android 9.0 is ready for only less than 0.1% of the entire global fleet of Android smartphones. For many smartphones, especially on older versions of the OS, the release of an update to the latest version of the OS is not planned at all.

What to do?
The most unpleasant fact was that Google does not plan to close the vulnerability CVE-2018-9489 in older versions of its mobile operating system, since the removal of the vulnerability “will be a violation of the API”, Nightwatch Cybersecurity noted.

All users of smartphones and other gadgets with older versions of Android OS Nightwatch Cybersecurity analysts strongly recommend that you refrain from downloading any unofficial or suspicious applications that could use the discovered vulnerability against the user.
Using an unrecoverable vulnerability, you can spy on any Android smartphone