Google Assistant on Android devices could be tricked into taking photos, videos

guest · Nov 19, 2019

Google Assistant on Android devices could be tricked into taking photos, videos
Security researchers found a flaw through Android's voice commands that allowed for eavesdropping and location tracking
November 19, 2019
https://www.cnet.com/news/google-as...s-could-be-tricked-into-taking-photos-videos/

On Tuesday, researchers from cybersecurity company Checkmarx disclosed vulnerabilities in several Android devices, including Google's Pixel line and Samsung's Galaxy series.
The security flaws would have allowed attackers to take photos and videos on the devices without people knowing, or to eavesdrop or do location tracking, according to Erez Yalon, Checkmarx's director of security research.

Checkmarx informed Google and Samsung about the security issue in July. The two companies told Checkmarx they fixed the issue in a Play Store update the same month. While the patch is available, it's unclear if every affected device maker has issued the fix.

"The issue was addressed on impacted Google devices via a Play Store update to the Google Camera Application in July 2019. A patch has also been made available to all partners."
Samsung said since it was notified by Google about the issue, it's released patches to address all the potentially affected device models. "We value our partnership with the Android team that allowed us to identify and address this matter directly," Samsung said in a statement.
Click to expand...

For instance, Android apps that use the camera have to be given permission to run the command "android.media.action.VIDEO_CAPTURE," Yalon explained, but Google Assistant already has permission.
The researchers found that any app could take advantage of that loophole.

To demonstrate a potential attack, Checkmarx researchers developed an innocent-seeming weather app. The app would appear to give the latest forecast, but in the background, it could send a "voice" request to Google Assistant to take a photo or start recording video.
But you'd never hear it -- the app was doing it all in the code, Yalon said.
Click to expand...

Checkmarx: How Attackers Could Hijack Your Android Camera to Spy on You

Additionally, we found that certain attack scenarios enable malicious actors to circumvent various storage permission policies, giving them access to stored videos and photos, as well as GPS metadata embedded in photos, to locate the user by taking a photo or video and parsing the proper EXIF data [3]. This same technique also applied to Samsung’s Camera app.
Click to expand...

Log in or Sign up

Google Assistant on Android devices could be tricked into taking photos, videos

guest Guest

Log in or Sign up

Google Assistant on Android devices could be tricked into taking photos, videos

guest Guest

Useful Searches