Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

9/4/2019
02:40 PM
0%
100%

Android Phone Flaw Allows Attackers to Divert Email

Researchers find that a spoofing a service message from the phone carrier is simple and effective on some brands of Android smartphones.

Using text messages with embedded links, security researchers from Check Point Software Technologies recently discovered that spoofing messages from a phone carrier could be used to configure certain features, including e-mail and the directory server, of several brands of Android phones.

The attack uses over-the-air (OTA) provisioning messages, a technique used by carriers to deploy certain configurations to phones for their network: but the malicious attack exploits design weaknesses on several brands of Android phones, including Samsung, Sony, LG, and Huawei.

While OTA provisioning has been used in the past to set up wireless access point proxies to hijack traffic, this is the first time that an attack has been shown to hijack email on mobile phones, says Slava Makaveev, a security researcher with Check Point. 

"The ability to configure email and directory servers is a vendor-specific extension for the protocol," he says. "The email server provisioning is a design weakness." 

The security flaw puts users of the phones at risk if they trust the source of any over-the-air update. On a Samsung phone, an attacker could, without any sort of authentication check, change the MMS message server, the proxy address for Internet traffic, the browser homepage and bookmarks, the email server, and any directory servers for synchronizing contacts and calendar.

Sony, LG, and Huawei phones, meanwhile, pose only slightly higher hurdles for an attacker — a valid IMSI (international mobile subscriber identity), which is specific to the phone, but could be retrieved by an application with the right permissions, according to Check Point.

Even without the IMSI, there is a way to fool the user. "For those potential victims whose IMSI could not be obtained, the attacker can send each victim two messages," Makkaveev wrote in Check Point's technical brief. "The first is a text message that purports to be from the victim's network operator, asking him to accept a PIN-protected OMA CP, and specifying the PIN as an arbitrary four-digit number. Next, the attacker sends him an OMA CP message authenticated with the same PIN."

The underlying design flaw is that while requiring the user to accept the changes, all of these provisioning methods appear with all the trappings of an official message from the phone carrier - with the specific dialog box labeled "New Settings."

"When you first join a new carrier network, you'll get a warm, welcome message from your carrier — do not trust it," Check Point's Makkaveev said in statement. "People naively think those messages are safe. Simply, we can't trust those texts anymore." 

OTA provisioning is not part of the basic Android distribution but many carriers implement their own, as specified in the Open Mobile Alliance Client Provisioning (OMA CP) standard. However, the standard includes only a few ways to authenticate messages and makes the security check optional. 

Weak Authentication

Check Point researchers found that Samsung phones don't perfrom authentication checks on client-provisioning messages, and several other phone makers — including Huawei, LG, and Sony — have weak authentication using the IMSI, a semi-private identifier for the phone. Because of the weak authentication, the source of any over-the-air provisioning messages that come in cannot be verified, Check Point stated in its advisory.

"A recipient cannot verify whether the suggested settings originate from her network operator or from a dangerous imposter looking to read their emails," the company said

Check Point notified each phone provider in March and gave them a chance to update their software. Samsung patched its software in May and LG released a fix in July, according to Check Point. Huawei plans to fix the next version of their phones, and Sony did not consider the issue to be a vulnerability, Check Point said. 

In the past, patching of firmware has been a laborious process for Android phones. The original software maker has to patch the issue, the hardware make has to approve the fix, as does the carrier, and then the use has to update. For that reason, Check Point does not know how widespread the issue currently is, says Makaveev.

"We don't know how many people have downloaded the latest patches provided by Samsung and LG — we highly recommend they do that," he says. "Holders of Huawei and Sony devices are not protected at all."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's top story: 'It Takes Restraint': A Seasoned CISO's Sage Advice for New CISOs

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT's Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
janettjworkman
50%
50%
janettjworkman,
User Rank: Apprentice
10/31/2019 | 2:53:01 AM
Thank you somuch
Thank you somuch
COVID-19: Latest Security News & Commentary
Dark Reading Staff 11/19/2020
New Proposed DNS Security Features Released
Kelly Jackson Higgins, Executive Editor at Dark Reading,  11/19/2020
How to Identify Cobalt Strike on Your Network
Zohar Buber, Security Analyst,  11/18/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: A GONG is as good as a cyber attack.
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-25660
PUBLISHED: 2020-11-23
A flaw was found in the Cephx authentication protocol in versions before 15.2.6 and before 14.2.14, where it does not verify Ceph clients correctly and is then vulnerable to replay attacks in Nautilus. This flaw allows an attacker with access to the Ceph cluster network to authenticate with the Ceph...
CVE-2020-25688
PUBLISHED: 2020-11-23
A flaw was found in rhacm versions before 2.0.5 and before 2.1.0. Two internal service APIs were incorrectly provisioned using a test certificate from the source repository. This would result in all installations using the same certificates. If an attacker could observe network traffic internal to a...
CVE-2020-25696
PUBLISHED: 2020-11-23
A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If an interactive psql session uses \gset when querying a compromised server, the attacker can execute arbitrary code as the operating sy...
CVE-2020-26229
PUBLISHED: 2020-11-23
TYPO3 is an open source PHP based web content management system. In TYPO3 from version 10.4.0, and before version 10.4.10, RSS widgets are susceptible to XML external entity processing. This vulnerability is reasonable, but is theoretical - it was not possible to actually reproduce the vulnerability...
CVE-2020-28984
PUBLISHED: 2020-11-23
prive/formulaires/configurer_preferences.php in SPIP before 3.2.8 does not properly validate the couleur, display, display_navigation, display_outils, imessage, and spip_ecran parameters.