Skip to main content

Millions of Android phones with Qualcomm chips are at risk: How to protect yourself

wireless emergency alert augmentation smartphone user
Tatsiana Yuralaits/123RF
A new widespread vulnerability that affects millions of Android devices around the world could allow hackers to read your SMS text messages, phone records, and perform any capabilities the radio allows.

What’s even worse is the fact that victims will have no idea if they have been hacked, and most of the affected devices won’t be patched.

Here’s a full breakdown of the hack, which phones it affects, and what you can do to protect yourself.

How it works

This hack involves the netd daemon, which is the network interface in Android. The problem arose when Qualcomm released new Application Program Interfaces (APIs) as part of the network_manager system service, which also involved the netd daemon. These APIs allowed additional tethering capabilities.

It’s not clear when exactly Qualcomm released these APIs, but it was discovered in January by Mandiant’s Red Team that the “netd service does not properly validate the interface name when a new upstream interface is added.”  Hackers could then use this invalid name for further system commands.

This vulnerability is labeled as CVE-2016-2060 with a medium risk. FireEye, a cyber security company, worked with Qualcomm to detail the vulnerability in a detailed blog post.

A hacker could exploit you with this vulnerability by having physical access to your device or by adding code to a malicious application that you install. The former would be the most unlikely situation, since the hacker would need to steal your device, and it would need to be unlocked. The latter is more likely, since millions of devices could be targeted remotely.

Unfortunately, a malicious application could interact with the API without your knowledge. You wouldn’t get any alerts and your device won’t run any slower. To make matters worse, Google Play might not flag these apps as malicious, since it would be impossible for Google’s security scanner to detect that such an app would be accessing the API for malicious reasons.

Affected devices

According to FireEye, devices dating back to Android Gingerbread are affected, but newer versions of Android aren’t. If your device is running Gingerbread, Ice Cream Sandwich, Jelly Bean, KitKat, or Lollipop, you’re likely affected if your phone has a Qualcomm processor.

According to the most recent Android distribution numbers (posted May 2, 2016), 92.4 percent of all devices have these versions of Android. However, not all of these devices have a Qualcomm processor. It’s unknown how many of them do, but it’s a safe bet that at least a half of them sport a Qualcomm chip, since it’s a popular processor. That would mean close to 50 percent of Android devices are affected or more than 500 million.

Qualcomm issues an update patch, but most users won’t get it

FireEye worked with Qualcomm starting in January 2016, which resulted in a fix by March 2016. FireEye said Qualcomm “was extremely responsive throughout the entire process” and achieved the 90 day window set to issue a fix.

Qualcomm sent the update to all manufacturers so that they can update their devices, but unfortunately, most people won’t get it since manufacturers generally stop updates within a year or two of a device’s existence.

Protecting yourself

The first thing you need to do is find out what version of Android your device is running. Head into Settings and tap on About Phone. Look under Android Version, and note the number. If it’s 5.1.x or below, you’re affected if your phone has a Qualcomm processor.

You can easily find out if you have a Qualcomm processor by installing CPU-Z from Google Play. Open the app, and it will tell you the make and model of your processor within a few seconds.

If your phone is affected, there isn’t much you can do to fully protect yourself if you continue to use your device. The best method would be to buy a newer phone that is running Android 6.0 Marshmallow, since it won’t be affected by this vulnerability.

We understand that buying a new phone might not be feasible at this time, so there are a few things you can do to lessen your chances of getting hacked, but understand there is no way to fully defend yourself other than buying a newer device.

  1. Never download third-party apps and sideload them.
  2. Pay attention to the apps you download from Google Play. If you stick with popular apps that are highly rated, you will lessen your chances of getting hacked.
  3. Download an antivirus app from Google Play such as Lookout Security and Antivirus. FireEye admits that apps like this probably won’t detect the vulnerability, but it’s not a bad idea to install one since that could change, not to mention, it might help you with other security threats.

Note: The FireEye Mobile Security app will detect the Qualcomm vulnerability, but it’s only for enterprise customers. If you have a corporate phone, check with your administrator to find out if your company subscribes to the service.

The good news is that FireEye has been monitoring the use of the API, and hasn’t found any occurrences of it being exploited. However, that could change as hackers learn of the flaw.

Looking at the big picture, it’s still more unlikely than likely that you will fall victim to an attack, but there’s always a chance no matter how small that is. If you follow the simple steps above, you will lessen your chances even more.

Editors' Recommendations

Robert Nazarian
Former Digital Trends Contributor
Robert Nazarian became a technology enthusiast when his parents bought him a Radio Shack TRS-80 Color. Now his biggest…
How to turn your old phone into a security camera

If you're like most people, you've probably amassed a drawer of unused electronics over the years. Many of these are probably smartphones -- after all, carriers offer great promotions nowadays, giving you a chance to upgrade your device every two years without paying hefty fees. However, instead of letting your old smartphones collect dust (or worse, throwing them away), consider turning them into a makeshift security camera.

There are plenty of great iOS and Android apps available that help turn your old smartphone into a security camera. These work by using your old smartphone's built-in cameras to provide a live stream to your new smartphone. Best of all, many of these are affordable (or free) and work with just about any phone you might have purchased over the last decade.

Read more
This $375 Android phone surprised the heck out of me
Person holding the POCO X6 Pro in hand in front of a bunch of flowers.

"There's plenty of fish in the sea." Besides its usual romantic denotation, the idiom fits the segment of Android phones very well. Android phones come with countess variations that go unseen or underappreciated in the shadow of the iPhone and Samsung Galaxy phones. There will be an Android device for every (reasonable) permutation of specifications you can conceive.

But, the Poco X6 Pro is unlike other fish in the sea. For its launch price of 350 euros (around $375 USD), the mid-ranger from Xiaomi's spin-off brand (and successor to the Poco X5 Pro we reviewed last year) is packed with many features that feel unusual at this price. Besides being classified as a mid-range Android phone, the Poco X6 Pro aspires to compete with flagships -- or flagship killers.

Read more
Google is launching a powerful new AI app for your Android phone
Google Gemini app on Android.

Remember Bard, Google’s answer to ChatGPT? Well, it is now officially called Gemini. Also, all those fancy AI features that previously went by the name Duet AI have been folded under the Gemini branding. In case you haven’t been following up all the AI development flood, the name is derived from the multi-modal large language model of the same name.

To go with the renaming efforts, Google has launched a standalone Gemini app on Android. Moreover, the Gemini experience is also being made available to iPhone users within the Google app on iOS. But wait, there’s more.

Read more