INSECURITY RESEARCH HAS FOUND THAT hackers can do bad things to replacement smartphone screens to implant the kind of vulnerability that makes you want to strap your phone to your head and run face first into a wall.
Yeah, the screen. The touchscreen specifically. Research has found that it is possible to insert a cheap £8 malicious chip into the screen when it has been sent somewhere for replacement, for example.
Omer Shwartz, Amir Cohen, Asaf Shabtai and Yossi Oren, from Israel's Ben-Gurion University presented their findings on this in a paper called Shattered Trust: When Replacement Smartphone Components Attack at the UseNix conference, or WOOT 17, showing how they were able to place a bad chip at the heart of hardware with a little soldering, some effort and some malice.
The researchers were able to hack into a Nexus 6P and an LG G Pad 7.0 by embedding the malicious chip. They found that in addition to recording keyboard inputs, installing apps and other remote commands, the attack could also exploit vulnerabilities in the smartphone's operating system kernel.
You can see from the photos that this is not an elegant hack, but as a proof of concept it definitely works, even if it does look like a box of wires.
"Phone touchscreens, and other similar hardware components such as orientation sensors, wireless charging controllers, and NFC readers, are often produced by third-party manufacturers and not by the phone vendors themselves, as a result of this trust, very few integrity checks are performed on the communications between the component and the device's main processor. In this paper, we call this trust into question, considering the fact that touchscreens are often shattered and then replaced with aftermarket components of questionable origin," they wrote.
"We analyze the operation of a commonly used touchscreen controller. We construct two standalone attacks, based on malicious touchscreen hardware, that function as building blocks toward a full attack: a series of touch injection attacks that allow the touchscreen to impersonate the user and exfiltrate data, and a buffer overflow attack that lets the attacker execute privileged operations.
"Combining the two building blocks, we present and evaluate a series of end-to-end attacks that can severely compromise a stock Android phone with standard firmware. Our results make the case for a hardware-based physical countermeasure."
Yeah they do, a phone case perhaps made of rubber and some kind of strap for your wrist. Preferably a short one. µ
EC says merged entity will 'continue to face significant competition'
Alexa, give me a reason to be cheerful about the UK economy
No, it isn't 1 April
Uniloc claims feature infringes a previously HP-owned patent