Technology
Forget Pegasus, camera on your Android phone can spy on you
New Delhi, Nov 21
WhatsApp snooping via Israeli spyware Pegasus has shown smartphones have become new-age surveillance tools and now, security researchers have identified that selfie camera in your smartphone can easily spy on you.
According to Erez Yalon and Pedro Umbelino, security researchers at cyber security firm Checkmarx, they have found vulnerabilities impact the camera apps of smartphone vendors like Google Pixel and some Samsung devices in the Android ecosystem, presenting significant implications to hundreds-of-millions of smartphone users.
Both Google and Samsung have issued a security patch for the vulnerabilities.
"Having a Google Pixel 2 XL and Pixel 3 on-hand, our team began researching the Google Camera app, ultimately finding multiple concerning vulnerabilities stemming from permission bypass issues," said Yalon.
After further digging, they found that these same vulnerabilities impact the camera apps of other smartphone vendors in the Android ecosystem - namely Samsung.
After a detailed analysis of the Google Camera app, the team found that by manipulating specific actions and intents, an attacker can control the app to take photos and/or record videos through a rogue application that has no permissions to do so.
Additionally, they found that certain attack scenarios enable malicious actors to circumvent various storage permission policies, giving them access to stored videos and photos, "as well as GPS metadata embedded in photos, to locate the user by taking a photo or video".
It is known that Android camera applications usually store their photos and videos on the SD card. Since photos and videos are sensitive user information, in order for an application to access them, it needs special permissions: storage permissions.
"Unfortunately, storage permissions are very broad and these permissions give access to the entire SD card. There are a large number of applications, with legitimate use-cases, that request access to this storage, yet have no special interest in photos or videos," said the researchers.
It means that a rogue application can take photos and/or videos without specific camera permissions, and it only needs storage permissions to take things a step further and fetch photos and videos after being taken.
Additionally, if the location is enabled in the camera app, the rogue application also has a way to access the current GPS position of the phone and user.
Google said that "We appreciate Checkmarx bringing this to our attention and working with Google and Android partners to coordinate disclosure.
"The issue was addressed on impacted Google devices via a Play Store update to the Google Camera Application in July 2019. A patch has also been made available to all partners," the company said.
Samsung has also patched the vulnerability, said the researchers.
According to Erez Yalon and Pedro Umbelino, security researchers at cyber security firm Checkmarx, they have found vulnerabilities impact the camera apps of smartphone vendors like Google Pixel and some Samsung devices in the Android ecosystem, presenting significant implications to hundreds-of-millions of smartphone users.
Both Google and Samsung have issued a security patch for the vulnerabilities.
"Having a Google Pixel 2 XL and Pixel 3 on-hand, our team began researching the Google Camera app, ultimately finding multiple concerning vulnerabilities stemming from permission bypass issues," said Yalon.
After further digging, they found that these same vulnerabilities impact the camera apps of other smartphone vendors in the Android ecosystem - namely Samsung.
After a detailed analysis of the Google Camera app, the team found that by manipulating specific actions and intents, an attacker can control the app to take photos and/or record videos through a rogue application that has no permissions to do so.
Additionally, they found that certain attack scenarios enable malicious actors to circumvent various storage permission policies, giving them access to stored videos and photos, "as well as GPS metadata embedded in photos, to locate the user by taking a photo or video".
It is known that Android camera applications usually store their photos and videos on the SD card. Since photos and videos are sensitive user information, in order for an application to access them, it needs special permissions: storage permissions.
"Unfortunately, storage permissions are very broad and these permissions give access to the entire SD card. There are a large number of applications, with legitimate use-cases, that request access to this storage, yet have no special interest in photos or videos," said the researchers.
It means that a rogue application can take photos and/or videos without specific camera permissions, and it only needs storage permissions to take things a step further and fetch photos and videos after being taken.
Additionally, if the location is enabled in the camera app, the rogue application also has a way to access the current GPS position of the phone and user.
Google said that "We appreciate Checkmarx bringing this to our attention and working with Google and Android partners to coordinate disclosure.
"The issue was addressed on impacted Google devices via a Play Store update to the Google Camera Application in July 2019. A patch has also been made available to all partners," the company said.
Samsung has also patched the vulnerability, said the researchers.

12 hours ago
On UK trip, US President Trump highlights his ‘very good relationship’ with PM Modi

12 hours ago
Indian envoy to US meets senior Pentagon official, holds 'valuable discussion'

13 hours ago
Newark Airport ranks last once again; even the new Terminal A couldn’t save it.

15 hours ago
Trade deal with US to bolster India’s regional role: Report

16 hours ago
Trump administration unveils 'patriotic education' initiative as new priority for federal education grants

18 hours ago
Tucson City Council in Arizona to open with ancient Hindu prayers

19 hours ago
Did Deepika Padukone exit 'Kalki 2898 AD' due to commitment issues?

19 hours ago
Tannishtha Chatterjee wishes ‘incredible woman’ Shabana Azmi on 75th b’day

19 hours ago
Ananya Panday flaunts bronzed glow post her Maldivian holiday

19 hours ago
Divya Dutta to Shabana Azmi: You are supremely precious in my life

19 hours ago
Kerala a bridge between India and Europe: CM Vijayan on blue economy conclave

19 hours ago
Bengal student murder: Protest erupts at Birbhum school, headmaster thrashed

19 hours ago
India-US tariff stalemate likely to be resolved in 8-10 weeks: Chief Economic Advisor