Secret chips in replacement parts can completely hijack your phone’s security

Minimalist · Aug 18, 2017

People with cracked touch screens or similar smartphone maladies have a new headache to consider: the possibility the replacement parts installed by repair shops contain secret hardware that completely hijacks the security of the device.

The concern arises from research that shows how replacement screens—one put into a Huawei Nexus 6P and the other into an LG G Pad 7.0—can be used to surreptitiously log keyboard input and patterns, install malicious apps, and take pictures and e-mail them to the attacker. The booby-trapped screens also exploited operating system vulnerabilities that bypassed key security protections built into the phones. The malicious parts cost less than $10 and could easily be mass-produced. Most chilling of all, to most people, the booby-trapped parts could be indistinguishable from legitimate ones, a trait that could leave many service technicians unaware of the maliciousness. There would be no sign of tampering unless someone with a background in hardware disassembled the repaired phone and inspected it.
Click to expand...

https://arstechnica.com/information...tely-hack-your-phone-and-you-wouldnt-know-it/

J_L · Aug 20, 2017

You'll never know all the possibilities...

guest · Jul 10, 2018

Evil third-party screens on smartphones are able to see all that you poke
Of course researchers added machine learning to the mix too
July 10, 2018
https://www.theregister.co.uk/2018/07/10/touchscreen_secrets/

Boffins from Ben-Gurion University in Israel have shown it's possible to impersonate a user by tracking touch movements on smartphones with compromised third-party touchscreens, whether they're sending emails, conducting financial transactions or even playing games.

The research provides a new spin on what was already a recognised threat. Broken smartphone touchscreens are often switched with aftermarket third-party components that have been found to have malicious code embedded.

The researchers recorded 160 touch interaction sessions from users running many different applications. [...] The team said the machine learning results demonstrated an accuracy rate of 92 per cent.

"Now that we have validated the ability to obtain high-level context information based on touch events alone, we recognize that touch injection attacks are a more significant potential threat," Dr Oren added.
"Using this analysis defensively, we can also stop attacks by identifying anomalies in a user's typical phone use and deter unauthorized or malicious phone use."
Click to expand...

Log in or Sign up

Secret chips in replacement parts can completely hijack your phone’s security

Minimalist Registered Member

J_L Registered Member

guest Guest

Log in or Sign up

Secret chips in replacement parts can completely hijack your phone’s security

Minimalist Registered Member

J_L Registered Member

guest Guest

Useful Searches