While Google can take pride in the flexibility and adaptability of the Android mobile platform, as well as it being open source and all that, security and privacy has really been one of Android’s weak points. Because it is designed to be accepting of tweaks even at the root level, malicious code can easily be inserted and run usually without the user knowing. This is where full disk encryption (FDE) comes in to give users a level of security and privacy for their personal data, but even this seems to have holes in it.
Security researcher Gal Beniamini has discovered a hole in Android’s FDE system that leaves devices open to brute force attacks. What’s more surprising, though, is that Beniamini has discovered that the newer Qualcomm-powered devices are more vulnerable to this, because of a certain combination of flaws in the Android kernel and Qualcomm hardware. To clarify, any device running Android 5.0 or later may be at risk, but the Qualcomm-Android combination just makes the risk worse.
The basic outline of the vulnerability is this – FDE keeps all of a device’s data secure by making it unreadable without a unique key, and that key is usually generated from the user’s password. You’d think it would be easy to brute force the device at this point, but the FDE system also binds the key to specific hardware which leaves you with a 256-bit unique and randomly generated ID fused into the device’s hardware, so you can’t use the FDE key on just any device.
The problem is that Android vulnerabilities now allow enterprising hackers to get the FDE key, and what’s left for hackers to do is just brute force the user’s password, which only takes time depending on how strong the password is. The bright of this is that Beniamini is working with both Qualcomm and Google to address this encryption issue. Hopefully we’ll get a patch that will deal with this soon.
SOURCE: Gal Beniamini
