Android Vulnerability Allowed Attackers to Secretly Record Videos

Nov. 20, 2019

According to anofficial blog postfrom Checkmarx,a detailed analysis of the Google Camera app by the company’s researchers found that by manipulating specific actions and intents, an attacker can control the app to take photos and/or record videos through a rogue application that has no permissions to do so. The vulnerability also apparently allows malicious actors to circumvent storage permission policies to access media files on the phone, as well as GPS metadata to locate the user.

A proof-of-concept (PoC) attack designed and implemented by the researchers seemingly shows that malicious apps won’t need any special permission beyond the basic storage permission.“When the client starts the (malicious) app, it essentially creates a persistent connection back to the command-and-control (C&C) server and waits for commands and instructions from the attacker … Even closing the app does not terminate the persistent connection”, said the company.

Once the device is compromised, the attacker can take photos and videos with the victim’s phone and upload it to the C&C server. They can also potentially parse all photos for GPS tags and locate the phone on a global map, thereby ascertaining the geo-location of the unsuspecting victim. What’s more, the audio-video permission also allows the hacker to automatically record phone calls from both sides of the conversation.

Passionate techie. Professional tech writer. Proud geek.