Multiple Bugs Enable Eavesdropping on 37% of Android Phones

Security researchers have revealed new vulnerabilities in a popular Android chip which could have allowed threat actors to snoop on the audio of nearly two-fifths (37%) of the world’s smartphones.

CVE-2021-0661, CVE-2021-0662 and CVE-2021-0663 were fixed by Taiwanese microchip company MediaTek in its October bulletin after responsible disclosure by Check Point Research. A fourth issue, CVE-2021-0673, was fixed in October and will be published in the December bulletin.

The Check Point team said it reverse engineered one of the key components on the chip, the audio digital signal processor (DSP), which is deployed to reduce CPU usage and improve media performance.

The bugs in question could be exploited if the user downloads a malicious app.

That app would theoretically then leverage the MediaTek API to attack a library with permissions to talk to the audio driver. As the app has system privileges it would then be able to send crafted messages to the driver to execute code into the firmware of the audio DSP, said Check Point.

This would enable remote attackers to eavesdrop on audio conversations.

MediaTek’s chip is the main processor for “nearly every notable Android device,” including several Chinese manufacturers including Xiaomi, Oppo, Realme and Vivo, according to Check Point.

“Left unpatched, a hacker potentially could have exploited the vulnerabilities to listen in on conversations of Android users. Furthermore, the security flaws could have been misused by the device manufacturers themselves to create a massive eavesdrop campaign,” warned Check Point security researcher, Slava Makkaveev.

“Although we do not see any specific evidence of such misuse, we moved quickly to disclose our findings to MediaTek and Xiaomi.”

Tiger Hsu, product security officer at MediaTek, urged all users to update their handsets when patches become available, but was at pains to point out there’s no evidence the bugs are currently being exploited.

“Device security is a critical component and priority of all MediaTek platforms,” he added. “Regarding the audio DSP vulnerability disclosed by Check Point, we worked diligently to validate the issue and make appropriate mitigations available to all OEMs.”