Skip to main content

Millions of Android phones with Qualcomm chips are at risk: How to protect yourself

wireless emergency alert augmentation smartphone user
Tatsiana Yuralaits/123RF
A new widespread vulnerability that affects millions of Android devices around the world could allow hackers to read your SMS text messages, phone records, and perform any capabilities the radio allows.

What’s even worse is the fact that victims will have no idea if they have been hacked, and most of the affected devices won’t be patched.

Here’s a full breakdown of the hack, which phones it affects, and what you can do to protect yourself.

How it works

This hack involves the netd daemon, which is the network interface in Android. The problem arose when Qualcomm released new Application Program Interfaces (APIs) as part of the network_manager system service, which also involved the netd daemon. These APIs allowed additional tethering capabilities.

It’s not clear when exactly Qualcomm released these APIs, but it was discovered in January by Mandiant’s Red Team that the “netd service does not properly validate the interface name when a new upstream interface is added.”  Hackers could then use this invalid name for further system commands.

This vulnerability is labeled as CVE-2016-2060 with a medium risk. FireEye, a cyber security company, worked with Qualcomm to detail the vulnerability in a detailed blog post.

A hacker could exploit you with this vulnerability by having physical access to your device or by adding code to a malicious application that you install. The former would be the most unlikely situation, since the hacker would need to steal your device, and it would need to be unlocked. The latter is more likely, since millions of devices could be targeted remotely.

Unfortunately, a malicious application could interact with the API without your knowledge. You wouldn’t get any alerts and your device won’t run any slower. To make matters worse, Google Play might not flag these apps as malicious, since it would be impossible for Google’s security scanner to detect that such an app would be accessing the API for malicious reasons.

Affected devices

According to FireEye, devices dating back to Android Gingerbread are affected, but newer versions of Android aren’t. If your device is running Gingerbread, Ice Cream Sandwich, Jelly Bean, KitKat, or Lollipop, you’re likely affected if your phone has a Qualcomm processor.

According to the most recent Android distribution numbers (posted May 2, 2016), 92.4 percent of all devices have these versions of Android. However, not all of these devices have a Qualcomm processor. It’s unknown how many of them do, but it’s a safe bet that at least a half of them sport a Qualcomm chip, since it’s a popular processor. That would mean close to 50 percent of Android devices are affected or more than 500 million.

Qualcomm issues an update patch, but most users won’t get it

FireEye worked with Qualcomm starting in January 2016, which resulted in a fix by March 2016. FireEye said Qualcomm “was extremely responsive throughout the entire process” and achieved the 90 day window set to issue a fix.

Qualcomm sent the update to all manufacturers so that they can update their devices, but unfortunately, most people won’t get it since manufacturers generally stop updates within a year or two of a device’s existence.

Protecting yourself

The first thing you need to do is find out what version of Android your device is running. Head into Settings and tap on About Phone. Look under Android Version, and note the number. If it’s 5.1.x or below, you’re affected if your phone has a Qualcomm processor.

You can easily find out if you have a Qualcomm processor by installing CPU-Z from Google Play. Open the app, and it will tell you the make and model of your processor within a few seconds.

If your phone is affected, there isn’t much you can do to fully protect yourself if you continue to use your device. The best method would be to buy a newer phone that is running Android 6.0 Marshmallow, since it won’t be affected by this vulnerability.

We understand that buying a new phone might not be feasible at this time, so there are a few things you can do to lessen your chances of getting hacked, but understand there is no way to fully defend yourself other than buying a newer device.

  1. Never download third-party apps and sideload them.
  2. Pay attention to the apps you download from Google Play. If you stick with popular apps that are highly rated, you will lessen your chances of getting hacked.
  3. Download an antivirus app from Google Play such as Lookout Security and Antivirus. FireEye admits that apps like this probably won’t detect the vulnerability, but it’s not a bad idea to install one since that could change, not to mention, it might help you with other security threats.

Note: The FireEye Mobile Security app will detect the Qualcomm vulnerability, but it’s only for enterprise customers. If you have a corporate phone, check with your administrator to find out if your company subscribes to the service.

The good news is that FireEye has been monitoring the use of the API, and hasn’t found any occurrences of it being exploited. However, that could change as hackers learn of the flaw.

Looking at the big picture, it’s still more unlikely than likely that you will fall victim to an attack, but there’s always a chance no matter how small that is. If you follow the simple steps above, you will lessen your chances even more.

Editors' Recommendations

Robert Nazarian
Former Digital Trends Contributor
Robert Nazarian became a technology enthusiast when his parents bought him a Radio Shack TRS-80 Color. Now his biggest…
How to reset default apps on an Android phone or tablet
Someone holding a Google Pixel 5. The screen is on and shows the Home Screen with an app folder open.

One of the best things about owning an Android phone is being able to change your default apps. If you've ever opened a file or an internet link with a certain app, and you chose Always when prompted, then that type of file will be opened with that app every time, saving you from tapping that app every time, and reclaiming some precious time. But what happens if you're the indecisive type or if you suddenly find a better app you'd like to use as your default? It's easy enough to go change.
Stock Android
“Stock Android” refers to any basic Android device that is similar to Google’s version. If you’re the owner of a phone running Stock Android — like the Google Pixel 5, the Xiaomi Mi A3, or the Motorola One Vision, here’s how to reset your app preferences.

Resetting preferences for a single app

Read more
The best iPhone and Android apps for Black History Month 2024
best iPhone and Android apps for Black History Month.

February is celebrated as Black History Month to honor Black Americans' remarkable achievements and contributions. The theme for this year is "African Americans and the Arts," which shines a light on the impact of African Americans in different artistic fields, such as cultural expression, visual and performing arts, fashion, literature, and more.

In this regard, we present a list of popular iOS and Android apps developed by Black-owned businesses and cover various topics such as finance, entertainment, wellness, and more. These apps run on all the latest smartphones, including the Samsung Galaxy S24 Ultra and iPhone 15 Pro.
Calendly

Read more
How to save text messages on iPhone and Android
iMessage on an iPhone.

We receive a lot of important information via text. Whether it’s a date you need to set or important work-related info, you might find yourself wanting to save a text message. Modern smartphones all offer a way to back up your core data and transfer it to another device. However, transfers sometimes don’t include your text messages unless you save them ahead of time or are transferring across the same mobile operating system.

Here's how to save your text messages in Android and iOS.
How to save your text messages on iPhone
There are multiple ways to backup your iPhone text messages. Here are the easiest.
How to make iPhone text message backups using iExplorer
The most universal method of saving your iPhone text messages is via the iExplorer program.

Read more