'SNAP' vulnerability affects Smart Notice application pre-installed on every new LG device.
Bugsec and Cynet researchers have discovered a vulnerability in LG Android phones' pre-installed notification application that allows an attacker to run arbitrary JavaScript code on the devices.
The "SNAP" bug, as researchers have dubbed it, takes advantage of the fact that the Smart Notice app doesn't validate the information it presents to the user. Via the birthday notification or callback reminder functions, researchers were able to add a new contact to the device's contact list -- a malicious contact, with a script embedded.
Using this method, researchers say they could lift data, force the user to malicious websites, or make the phone "go crazy," getting it stuck in an infinite loop until a hard reset. See the research teams' demo for more.
About the Author(s)
You May Also Like
Beyond Spam Filters and Firewalls: Preventing Business Email Compromises in the Modern Enterprise
April 30, 2024Key Findings from the State of AppSec Report 2024
May 7, 2024Is AI Identifying Threats to Your Network?
May 14, 2024Where and Why Threat Intelligence Makes Sense for Your Enterprise Security Strategy
May 15, 2024Safeguarding Political Campaigns: Defending Against Mass Phishing Attacks
May 16, 2024
Black Hat USA - August 3-8 - Learn More
August 3, 2024Cybersecurity's Hottest New Technologies: What You Need To Know
March 21, 2024