Android Security Flaw Let Apps Access People's Cameras for Secret Video and Audio Recordings

A security flaw in Android smartphones from companies like Google and Samsung allowed malicious apps to record video, take photos, and capture audio, uploading the content to a remote server sans user permission.

The vulnerability was discovered by security firm Checkmarx, and was highlighted today by Ars Technica. The flaw had the potential to leave high-value targets open to having their surroundings illicitly recorded by their smartphones.

Image via Checkmarx

Android is meant to prevent apps from accessing the camera and the microphone on a smartphone without user permission, but with this particular exploit, an app could use the camera and the microphone to capture video and audio without express user consent. All an app needed to do was get permission to access a device's storage, which is commonly granted as most apps ask for this.

To demonstrate how the flaw worked, Checkmarx created a proof-of-concept app that appeared to be a weather app on the surface but was scooping up copious amounts of data in the background.

The app was able to take pictures and record videos even when the phone's screen was off or the app was closed, as well as access location data from the photos. It was able to operate in stealth mode, eliminating the camera shutter sound, and it could also record two-way phone conversations. All of the data was able to be uploaded to a remote server.

When the exploit was used, the screen of the smartphone being attacked would display the camera when recording video or taking a photo, which would let affected users know what was going on. It could be used secretly when a smartphone display was out of sight or when a device was placed screen down, and there was a feature for using the proximity sensor to determine when a smartphone was facedown.

Google addressed the vulnerability in its Pixel phones through a camera update that was launched back in July, and Samsung has also fixed the vulnerability, though it's not known when. From Google:

"We appreciate Checkmarx bringing this to our attention and working with Google and Android partners to coordinate disclosure. The issue was addressed on impacted Google devices via a Play Store update to the Google Camera Application in July 2019. A patch has also been made available to all partners."

From Samsung:

"Since being notified of this issue by Google, we have subsequently released patches to address all Samsung device models that may be affected. We value our partnership with the Android team that allowed us to identify and address this matter directly."

According to Checkmarx, Google has said that Android phones from other manufacturers could also be vulnerable, so there may still be some devices out there that are open to attack. Google has not disclosed specific makers and models.

Since this is an Android bug, Apple's iOS devices are not affected by the security flaw.

It's not known why apps were able to access the camera without user permission. In an email to Ars Technica, Checkmarx speculated that it could potentially be related to Google's decision to make the camera work with Google Assistant, a feature that other manufacturers may have also implemented.

Top Rated Comments

(View all)
Avatar
19 weeks ago
I love my iPhone.
Score: 28 Votes (Like | Disagree)
Avatar
19 weeks ago
And people still say Android is better...
Score: 26 Votes (Like | Disagree)
Avatar
19 weeks ago
Google - "Yeah whatever, whoever you are, your app is out there"

Apple - "Yeah, register, prove who you are, let us check the app before it gets released, Nah buggy and a resource hog, fix it, ok done, fine it's available on the store"

Android users - but I get a really open app store and can download anything I want, apple store is ****.
Apple users - I saw you in the shower last night.
Score: 24 Votes (Like | Disagree)
Avatar
19 weeks ago
"security flaw"

Yeah, right. On a Google OS?
Score: 20 Votes (Like | Disagree)
Avatar
19 weeks ago
Another day, another major Android OS security flaw. But thats not even the real problem. The real issue is that most android phones wont get the proper updates to fix it, leaving millions permanently vulnerable.
Score: 20 Votes (Like | Disagree)
Avatar
19 weeks ago
The amount of people quick to **** on Android is absolutely ridiculous. Ya'll really need to chill with that ****. Yes, it's a major security flaw.

The article also states that Google already pushed out an update to patch the issue. As for other manufacturers putting out a fix, we already know carriers play a role in how fast can get patch updates for Android.

I'm a long time iOS user, was on a Pixel 2 for a year and a half. You know why? Because it's a great phone. And Android is a fantastic platform that can do A LOT of things better than iOS can. At least with an Android, you don't feel like you're using a device in a way the manufacturer wants you to, which is my biggest criticism of iOS as both a user and a UX Designer.

This crapping all over Android is absolutely ridiculous, especially in the forums on this site. Competition is good for both iOS and Android users. And Android does offer a ton of that. It makes both platforms better and gives users more choice. Don't sit here and try to act like you're above people that choose a platform that isn't the one you chose. Because it doesn't satisfy your needs doesn't mean it fails for someone else. You don't know their workflows, use cases, etc.
Score: 16 Votes (Like | Disagree)

Top Stories

Seemingly Unreleased Version of Logic Pro X With Live Loops Appears on Apple's Education Site [Updated]

Sunday March 29, 2020 7:23 am PDT by Hartley Charlton
Update: Apple has replaced the Logic Pro X image with an older version. Original story follows. A seemingly unreleased version of Logic Pro X has appeared on Apple's education site, as spotted by a Reddit user. The image from Apple's education products page shows a 16-inch MacBook Pro running Logic Pro X, but with a familiar interface that looks extremely similar to GarageBand's Live Loops ...

Zoom Updates iOS App to Stop Sending Data to Facebook

Friday March 27, 2020 5:35 pm PDT by Juli Clover
Zoom, a video conferencing app that many people are using at the current time to keep in touch with coworkers while working from home, was sending data to Facebook without disclosing the data sharing to customers. As of today, Zoom has updated its iOS app to remove the SDK that was providing data to Facebook through the Login with Facebook feature, according to Motherboard, the site that...

Apple Suppliers Worried About iPhone Demand, Production Ramp-Up for New iPhones Reportedly Postponed

Friday March 27, 2020 5:56 pm PDT by Juli Clover
Most of the factories in China that supply devices and components to Apple are back to churning out products, but Apple suppliers are said to be worried about how much demand there will be for the current iPhone models and the new iPhones expected in the fall. According to Reuters, a senior official at one of Apple's major supply companies said that orders for quarter ending in March are...

2020 iPad Pro Teardown Provides Closer Look at LiDAR Scanner and Confirms Incremental Update

Saturday March 28, 2020 9:56 am PDT by Hartley Charlton
iFixit today shared a video teardown of the new iPad Pro, which Apple unveiled earlier this month. iFixit found that most of the internals of the 2020 iPad Pro are the same as the 2018 model, confirming that the device is a relatively incremental update. The most notable new feature seen inside the new iPad Pro was the LiDAR scanner, which measures the distance to surrounding objects up...

Apple Watch Series 6 Could Feature Touch ID Fingerprint Sensor, Pulse Oximetry and Sleep Tracking Support

Friday March 27, 2020 11:28 am PDT by Juli Clover
The upcoming Apple Watch Series 6 set to be released this fall could include a Touch ID fingerprint sensor built into the crown of the device, according to Israeli site The Verifier, which cites "senior sources" who have worked with its staff for a "number of years" as the source of the rumor. It's not clear how the alleged Touch ID fingerprint sensor would be implemented, as the Digital...

Bloomberg: Apple's 5G iPhone Still on Schedule for Fall Launch, But Future Products Could Be Delayed

Monday March 30, 2020 2:40 am PDT by Tim Hardwick
Apple's 5G iPhone is still on track to launch within the company's typical annual fall release schedule, according to a new Bloomberg report on filed on Monday. Signs are that Apple's Chinese-centric manufacturing -- of which Hon Hai is the linchpin -- is slowly getting back on track. The next iPhones with 5G wireless capabilities remain on schedule to launch in the fall, partly because mass...

Kuo: Apple to Launch Several Macs With Arm-Based Processors in 2021, USB4 Support Coming to Macs in 2022

Thursday March 26, 2020 8:19 pm PDT by Joe Rossignol
Apple plans to launch several Mac notebooks and desktop computers with its own custom designed Arm-based processors in 2021, analyst Ming-Chi Kuo said today in a research note obtained by MacRumors. Kuo believes that Arm-based processors will significantly enhance the competitive advantage of the Mac lineup, allow Apple to refresh its Mac models without relying on Intel's processor roadmap,...

Top Stories: Hands-On With 2020 iPad Pro and MacBook Air, iOS and iPadOS 13.4 Released, iPhone 12 Delay?

Saturday March 28, 2020 6:00 am PDT by MacRumors Staff
After last week's flurry of product launches, Apple's new iPad Pro and MacBook Air have started to make their way into consumers' hands, and we've gone hands-on with both of them this week. Apple this week also released iOS and iPadOS 13.4 (as well as macOS, watchOS, and tvOS updates) with a number of new features and improvements. Subscribe to the MacRumors YouTube channel for more videos. ...

Deals: Huge Refurbished iPhone Sale Discounts iPhone 7, 8, X, XR, and XS (From $120)

Friday March 27, 2020 5:47 am PDT by Mitchel Broussard
Woot is back today with a big sale on refurbished iPhones, including markdowns on the iPhone 7, iPhone 7 Plus, iPhone 8, iPhone 8 Plus, iPhone X, iPhone XR, iPhone XS, and iPhone XS Max. Note: MacRumors is an affiliate partner with Woot. When you click a link and make a purchase, we may receive a small payment, which helps us keep the site running. As with every Woot purchase, those...

Apple Releases ProRes RAW Beta for Windows

Monday March 30, 2020 9:33 am PDT by Juli Clover
Apple today released ProRes RAW for Windows in a beta capacity (via Mark Gurman), with the software designed to allow ProRes RAW and ProRes RAW HQ video files to be watched in compatible applications on Windows machines. According to Apple, the software will let the files be played within several Adobe apps: Adobe After Effects (Beta) Adobe Media Encocder (Beta) Adobe Premiere...