Qualcomm software flaw lets hackers access your SMS and phone history

If you are using handsets that run the older versions of the Android operating system, beware because your SMS and call logs are no longer exclusively visible to you alone.

Security researchers at FireEye have disclosed a five-year-old Android flaw that allows third-party prying eyes to view your text messages and recent calls without you knowing it. The old vulnerability most affects Android versions as old as the Jelly Bean 4.3 while newer Android versions that feature the Security Enhanced Linux run lesser risks.

Exploiting the vulnerability gives attackers heightened privileges into a device, which is why they can view SMS and phone history logs. According to the researchers, the flaw lies in a software that Qualcomm maintains within the Code Aurora Forum.

Although the infected software received a fix already, it would be practically impractical to roll out the patch to all Android devices because of the wide diversity of original equipment manufacturers. That means most older Android handsets are not likely to get the fix to the flaw. After all, it is a five-year-old vulnerability, and counting the number of Android devices affected by it seems an arduous task already.

Fortunately, the security researchers at least assured that there has been no known public exploit so far, though that is not a cause for complacency. The security flaw was born out of Qualcomm’s omission for the need to assess the inputs versus the Android netd daemon’s interface parameter, which is part of the Android Open Source Project.

The flaw specifically emerged when Qualcomm introduced a new application programming interface within the network_manager system service, leading to the “netd” daemon. This is intended to add more tethering capabilities to the Android devices. Qualcomm changed the “netd” daemon to plug the security hole.

It has yet to be established how far-reaching the scope of the flaw is. The only thing that’s sure for now is that Qualcomm chips are present in almost all Android devices we know so far such as the Samsung Galaxy handsets, HTC, LG, and Nexus.

Attackers have to have physical access to a handset in order to take advantage of the flaw. Alternatively, loading the exploit onto legit applications and have the user install those applications will also provide the attackers escalated privileges to a device. So beware with what you download even from major app stores such as Google Play Store and Apple App Store. Although the latest Android handsets are less susceptible to the threat, FireEye warns that malicious apps have the capability to change some Android system properties.