Android Camera Flaw Discovered That Lets Attackers Record Videos, Take Photos, GPS Data Without Permission: Checkmarx

Google and Samsung have fixed the camera apps on their Android devices, but some other smartphone makers might haven't yet patched their offerings.

By Jagmeet Singh | Updated: 20 November 2019 15:37 IST

Android Camera Flaw Discovered That Lets Attackers Record Videos, Take Photos, GPS Data Without Permission: Checkmarx

Attackers could utilise the flaw to control the camera of your Android smartphone

Highlights

Checkmarx researchers notified Google about the flaw
Google raised the severity of the finding to "High" on July 23
Samsung on August 29 confirmed that its camera app also affected

An Android camera flaw has been reported that could allow attackers to take pictures, record videos, or extract GPS data without requiring any explicit permissions from users. The loophole, which was spotted on the Google Camera app available on Pixel devices and the Samsung Camera app that comes preloaded on Galaxy devices, can be executed remotely using a malicious app. It is known to be available on the Google Camera and Samsung Camera apps until July 2019 and is listed as CVE-2019-2234.

The vulnerability has been discovered by a team of security researchers at Checkmarx. The researchers found that while an app generally requires to obtain certain permissions to record videos, take pictures, and access GPS metadata, apps that have the default 'Storage' permission to use the device's SD card and its media content can exploit the Camera app to gain access to capture photos, videos, or obtain EXIF data and geolocation details. The flaw was noticed after analysing the Google camera app. However, it is also said to have existed in the Samsung Camera app.

"[O]ur researchers determined a way to enable a rogue application to force the camera apps to take photos and record video, even if the phone is locked or the screen is turned off. Our researchers could do the same even when a user was is in the middle of a voice call," Checkmarx researchers noted in a blog post.

There are a large number of apps on Google Play that ask for the Storage permission. Thus, the scope of the Android camera flaw appears to be quite wide.

Checkmarx researchers created a proof-of-concept app that works as a weather app but silently transmits a picture, video, and phone call recordings to a command-and-control server. The team after confirming the issue through the proof-of-concept app notified Google of its findings on July 4. The search giant had raised the severity of the finding to "High" on July 23 and noted that it may affect other Android smartphone vendors. Google also issued CVE-2019-2234 to help smartphone vendors fix the flaw on their Android devices.

"We appreciate Checkmarx bringing this to our attention and working with Google and Android partners to coordinate disclosure. The issue was addressed on impacted Google devices via a Play Store update to the Google Camera Application in July 2019. A patch has also been made available to all partners," Google said in a statement.

Checkmarx researchers said Samsung on August 29 also confirmed that the flaw had affected their camera app. The South Korean company -- just like Google - however, has fixed the issue.

That being said, it is still unclear whether other Android vendors have followed in the footsteps of Google and Samsung and fixed the vulnerability on their devices. It is recommended to have the latest software updates along with the most recent app versions to avoid uncertainties.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.