If you use an Android device, your phone may be vulnerable to a hacking technique that could allow an attacker to get complete access to your phone.
The vulnerability takes advantage of a phone’s mobile Remote Support Tool. These tools need administrative privileges in order to fulfill their intended purpose — diagnosing and fixing problems people have with their device. Unfortunately, this means that an attacker that is taking advantage of the flaw within the support tool will also have these privileges.
ZDNet reported that other than waiting for an update, there is no course of action for users to take since the certificates involved cannot be revoked.
Android offers no way to revoke the certificates that are providing privileged permissions. There are a variety of ways to exploit access to these certificates. Once successfully attacked, an invader can then masquerade as the original remote support app with all its system privileges.
It is not uncommon for remote support apps to be pre-installed on Smartphones, putting users at risk that have made no mistake whatsoever.
Engadget affirmed that while LG, Samsung, HTC, and ZTE devices are at risk, the Nexus device may be the exception to the rule. Check Point and Google have confirmed that it is not vulnerable.
Check Point noted that the devices that could suffer from Certifi-gate are from LG, Samsung, HTC and ZTE and that these OEMs have released updates to mitigate the issue. Both Check Point and Google have noted that Nexus devices are not prone to the vulnerability.
Google responded to Check Point, thanking the researcher who discovered the flaw. Meanwhile, Samsung has made an announcement claiming to have addressed the issue, though users will need to install updates on their phone to make them secure again.
Both Google and Samsung have warned users not to download insecure apps.