Check Point analysts have found that many Android devices (notably Samsung, Huawei, LG, Sony and possibly other manufacturers) are vulnerable to interesting attacks. You will need to simulate a single special SMS message, which usually comes from mobile operators, and an attacker will be able to intercept the email or traffic coming from vulnerable devices.
The problem identified by experts is related to the OMA CP (Open Mobile Alliance Client Provisioning) specifications. This is a standard that allows mobile operators to send network settings as special messages to client devices.These messages can contain MMS server parameters, a proxy address, a mail server, a browser home page and bookmark settings, servers for contact and calendar synchronization, and so on.
Check Point researchers found that four smartphone manufacturers had implemented this standard on their devices in an insecure way. Samsung, Huawei, LG and Sony smartphones can receive OMA CP messages, even if they come from an untrustworthy source.
Experts point out that the easiest way to attack Samsung devices is that they accept all OMA CP messages without authentication or verification. Huawei, LG and Sony smartphones are slightly better protected because, in their case, the sender of the message must at least provide IMSI details.
Although IMSI codes are theoretically difficult to obtain, Check Point experts explain that nothing is impossible here. For example, mobile operators provide paid services with which they convert phone numbers into IMSI codes for third-party mobile service providers. In other words, an attacker can obtain the IMSI from the provider at a low cost. Even worse, nearly a third of Android applications have access to IMSI details, because they have requested and received the appropriate permissions. This means that hackers can use IMSI codes obtained through malicious applications or data leaks.
Although the attack described by Check Point is not automatic (the user must press a button and accept the installation of the attacker’s new settings), the researchers warn that attackers can easily spoof the sender. In fact, the recipient has no real way of determining who sent the message. Unfortunately, this means that many users will agree to replace their device settings with new ones, believing they come from a genuine mobile operator.
Therefore, by modifying the settings, the attacker can, for example, redirect all of the victim’s traffic through their malicious server. To carry out such an attack, no special equipment is needed: a GSM modem (a $10 USB dongle, or a phone operating in modem mode) and a simple script will suffice to send the special SMS messages.
Fortunately, three of the four manufacturers identified in the expert report are already working to resolve this problem:
- Samsung included a fix for this problem in its May update kit ( SVE-2019-14073 );
- LG released its fix in July ( LVE-SMP-190006 );
- Huawei plans to make the necessary user interface fixes for the next generation of Mate and P series smartphones.
The only manufacturer that will not resolve the problem is Sony. The researchers explained that Sony engineers “refused to acknowledge the vulnerability, claiming that their devices complied with the OMA CP specification”.
But Check Point analysts recommend that not only manufacturers release fixes, but also that users install them. According to them, mobile operators should block OMA CP messages at the network level so that such messages cannot pass through their networks, unless they are sent by the operator itself. According to the experts, it is currently impossible to trust OMA CP messages and it is best to reject them all.
