Justin Case – handle for one of XDA’s more infamous and inflammatory, but really quite brilliant security researchers – has found a “backdoor” to a MediaTek processor that may be exploited by hackers if they knew about it. If that’s not enough of a problem, the researcher found out that the chipset manufacturer had no proper bug reporting mechanism in place that he had to get their attention via Twitter.
The backdoor is described by MediaTek themselves as a “de-bug feature created for telecommunication inter-operability testing in China.” But manufacturers were supposed to disable this backdoor upon shipping the devices. Wonder of wonders, some manufacturers didn’t. The code above was discovered in an Obi Alligator S454 device. Don’t worry, we’re not familiar with is as well – but the chipset it was using was a MediaTek MT6582, which worryingly is being used by some higher profile devices out there.
MediaTek has replied over Twitter that they will be showing this issue to their “Product Security Taskforce.” When asked why MediaTek does not have a proper bug-reporting method, they said, “We’re assessing how to garner users’ feedback in a more formal manner and will get back to you. Cheers.” Well, that will have to do for now. The official reply to this issue is quoted below:
“We are aware of this issue and it has been reviewed by MediaTek’s security team. It was mainly found in devices running Android 4.4 KitKat, due to a de-bug feature created for telecommunication inter-operability testing in China.”
“After testing, phone manufacturers should disable the de-bug feature before shipping smartphones. However, after investigation, we found that a few phone manufacturers didn’t disable the feature, resulting in this potential security issue.” – MediaTek Spokesperson
VIA: SlashGear
