Urgent.News

What's breaking now, across thousands of outlets.

Editions

Tech

Android users beware — if you own one of these budget smartphones, your device could be hacked with a simple video call

Security researchers uncover exploit on budget smartphones equipped with a Unisoc system-on-chip, initiated by starting a video call and able to grant root access to an attacker

Android users beware — if you own one of these budget smartphones, your device could be hacked with a simple video call

Budget smartphones equipped with Unisoc system-on-chip (SoC) devices may be susceptible to a security exploit transmitted through video calls. This vulnerability, discovered by researcher 0x50594d, can provide attackers with root-level access to the infected devices. The exploitation occurs due to improper isolation of shared resources within the modem firmware of four Unisoc SoCs: T612, T616, T606, and T7250.

To execute the exploit, the attacker must first gain root access, typically achieved through rooting. Additionally, the testing was conducted on a closed VoLTE network and older Android security patches. While the exploit was demonstrated on three specific models—Realme C33, Xiaomi Redmi A5, and Motorola E13—the vulnerability could potentially affect any device utilizing the aforementioned SoCs. Unisoc has yet to respond to the disclosed security flaw.

Written by urgent.news from TechRadar's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.

Read the original at techradar.com →

More in Tech

The test was green. Every real connection would have failed.

This is a submission for DEV's Summer Bug Smash: Smash Stories powered by Sentry . The setting WebRTC-Direct in libp2p has a neat trick for connecting without a certificate authority: the peer's…

  • Code in DEV Summer Bug Smash involved WebRTC-Direct in libp2p
  • RTCConfiguration certificate handling incorrect in aiortc ≥ 1.5
  • Fix involved setting mangled certificates attribute directly

The /sdp endpoint that trusted its callers: fixing a memory-amplification DoS in py-libp2p

This is a submission for DEV's Summer Bug Smash: Clear the Lineup powered by Sentry . Project Overview py-libp2p is the Python implementation of libp2p — the peer-to-peer networking stack that…

  • py-libp2p's /sdp endpoint handled SDP offer/answer packets without certificate authority
  • POST /sdp handler buffered request body and headers in memory without bounds
  • Fix introduced bounded constants to prevent memory-amplification DoS

More from Thursday 20 August →