Skip to main content

Millions of Android phones with Qualcomm chips are at risk: How to protect yourself

A new widespread vulnerability that affects millions of Android devices around the world could allow hackers to read your SMS text messages, phone records, and perform any capabilities the radio allows.

What’s even worse is the fact that victims will have no idea if they have been hacked, and most of the affected devices won’t be patched.

Recommended Videos

Here’s a full breakdown of the hack, which phones it affects, and what you can do to protect yourself.

How it works

This hack involves the netd daemon, which is the network interface in Android. The problem arose when Qualcomm released new Application Program Interfaces (APIs) as part of the network_manager system service, which also involved the netd daemon. These APIs allowed additional tethering capabilities.

It’s not clear when exactly Qualcomm released these APIs, but it was discovered in January by Mandiant’s Red Team that the “netd service does not properly validate the interface name when a new upstream interface is added.”  Hackers could then use this invalid name for further system commands.

This vulnerability is labeled as CVE-2016-2060 with a medium risk. FireEye, a cyber security company, worked with Qualcomm to detail the vulnerability in a detailed blog post.

A hacker could exploit you with this vulnerability by having physical access to your device or by adding code to a malicious application that you install. The former would be the most unlikely situation, since the hacker would need to steal your device, and it would need to be unlocked. The latter is more likely, since millions of devices could be targeted remotely.

Unfortunately, a malicious application could interact with the API without your knowledge. You wouldn’t get any alerts and your device won’t run any slower. To make matters worse, Google Play might not flag these apps as malicious, since it would be impossible for Google’s security scanner to detect that such an app would be accessing the API for malicious reasons.

Affected devices

According to FireEye, devices dating back to Android Gingerbread are affected, but newer versions of Android aren’t. If your device is running Gingerbread, Ice Cream Sandwich, Jelly Bean, KitKat, or Lollipop, you’re likely affected if your phone has a Qualcomm processor.

According to the most recent Android distribution numbers (posted May 2, 2016), 92.4 percent of all devices have these versions of Android. However, not all of these devices have a Qualcomm processor. It’s unknown how many of them do, but it’s a safe bet that at least a half of them sport a Qualcomm chip, since it’s a popular processor. That would mean close to 50 percent of Android devices are affected or more than 500 million.

Qualcomm issues an update patch, but most users won’t get it

FireEye worked with Qualcomm starting in January 2016, which resulted in a fix by March 2016. FireEye said Qualcomm “was extremely responsive throughout the entire process” and achieved the 90 day window set to issue a fix.

Qualcomm sent the update to all manufacturers so that they can update their devices, but unfortunately, most people won’t get it since manufacturers generally stop updates within a year or two of a device’s existence.

Protecting yourself

The first thing you need to do is find out what version of Android your device is running. Head into Settings and tap on About Phone. Look under Android Version, and note the number. If it’s 5.1.x or below, you’re affected if your phone has a Qualcomm processor.

You can easily find out if you have a Qualcomm processor by installing CPU-Z from Google Play. Open the app, and it will tell you the make and model of your processor within a few seconds.

If your phone is affected, there isn’t much you can do to fully protect yourself if you continue to use your device. The best method would be to buy a newer phone that is running Android 6.0 Marshmallow, since it won’t be affected by this vulnerability.

We understand that buying a new phone might not be feasible at this time, so there are a few things you can do to lessen your chances of getting hacked, but understand there is no way to fully defend yourself other than buying a newer device.

  1. Never download third-party apps and sideload them.
  2. Pay attention to the apps you download from Google Play. If you stick with popular apps that are highly rated, you will lessen your chances of getting hacked.
  3. Download an antivirus app from Google Play such as Lookout Security and Antivirus. FireEye admits that apps like this probably won’t detect the vulnerability, but it’s not a bad idea to install one since that could change, not to mention, it might help you with other security threats.

Note: The FireEye Mobile Security app will detect the Qualcomm vulnerability, but it’s only for enterprise customers. If you have a corporate phone, check with your administrator to find out if your company subscribes to the service.

The good news is that FireEye has been monitoring the use of the API, and hasn’t found any occurrences of it being exploited. However, that could change as hackers learn of the flaw.

Looking at the big picture, it’s still more unlikely than likely that you will fall victim to an attack, but there’s always a chance no matter how small that is. If you follow the simple steps above, you will lessen your chances even more.

Robert Nazarian
Robert Nazarian became a technology enthusiast when his parents bought him a Radio Shack TRS-80 Color. Now his biggest…
Android 16 is finally expanding beyond Google Pixel phones
Android 16 logo on Google Pixel 6a held in hand.

The next major build of Android has reached a handful of new milestones, ahead of its public release. Google has just started the rollout of Android 16’s fourth beta update, reaching the second platform stability. 

Developers who have optimized their apps to target Android 16 can now ship their updates via the Google Play Store. The latest beta update is also the near-final version, as all the app behaviours and background functionalities have been finalized. 

Read more
Android phones get new security feature that iPhone owners already have
The Google Pixel 9a on a table showing the screen.

Google is taking a page out of Apple's playbook by launching a new security feature that makes Android phones automatically restart after a few days of inactivity.

The new auto-restart feature (or auto-reboot, if you want to call it that) was patched into the latest Google Play services update, which was released on Monday. The release notes say that the update forces your Google Pixel 9, Samsung Galaxy S25, or other Android phone to restart itself "if locked for [three] consecutive days," which means you need to enter your PIN code if you want to unlock it after not using it for that period of time. It resembles the Inactivity Reboot feature on iOS 18.1, only iPhones would restart themselves after four days.

Read more
Google just changed Android 15 and it might kill off some phones
Private Space option in app library of Android 15.

Google just made an announcement that could represent the death of a lot of Android phones.

Starting with Android 15, Google says, the minimum storage capacity of devices will jump up - leaving some devices obsolete.

Read more