We commend the security researchers from Check Point for using industry-standard coordinated disclosure practices. Providing technologies that support robust security and privacy is a priority for Qualcomm. In a statement, Qualcomm officials wrote: “Accordingly, we decided not to share all the technical details, as it would give hackers a roadmap on how to orchestrate an exploitation.”

“From our experience, the implementation of these fixes takes time, so some of the phones may still be prone to the threat,” he wrote in an email. Because of the intricacies involved, it’s not yet clear which vulnerable Android devices are fixed and which ones aren’t. “A hacker can also exploit the vulnerability to unlock the device’s SIM, thereby overcoming the limitations imposed by service providers on it.” Fixes take timeĬheck Point spokesman Ekram Ahmed told me that Qualcomm has released a patch and disclosed the bug to all customers who use the chip. “This means an attacker could have used this vulnerability to inject malicious code into the modem from Android, giving them access to the device user’s call history and SMS, as well as the ability to listen to the device user’s conversations,” the researchers wrote. The nearly undetectable code might then be able to tap into some of a phone’s most vital functions. The heap overflow the researchers found can be exploited by a malicious app installed on the phone, and from there the app can plant malicious code inside the MSM, Check Point researchers said in a blog post published Thursday. The chips run in 31 percent of the world's smartphones, according to figures from Counterpoint Research. Phone-makers can customize the chips so they do additional things like handle SIM unlock requests. The vulnerability, discovered by researchers from security firm Check Point Research, resides in Qualcomm’s Mobile Station Modem, a system of chips that provides capabilities for things like voice, SMS, and high-definition recording, mostly on higher-end devices made by Google, Samsung, LG, Xiaomi, and OnePlus. Makers of high-end Android devices are responding to the discovery of a Qualcomm chip flaw that researchers say could be exploited to partially backdoor about a third of the world’s smartphones.

Problems collecting chips pop slots