Affiliate links on Android Authority may earn us a commission. Learn more.
MediaTek-related bug leaves KitKat devices vulnerable
Although MediaTek is downplaying the effects, it seems a software bug has created a vulnerability on Android devices running Android 4.4 KitKat. Exploits taking advantage of the vulnerability could gain root access to the device, brick the phone, or spy on communications. MediaTek has confirmed that the bug exists and they say their security team is working to come up with solutions.
The bug was pointed out by security researcher Justin Case, who tweeted about the vulnerability’s existence earlier this month. Today MediaTek acknowledged that the potential for malicious exploits was real. The Taiwan-based chipmaker says that the vulnerability is the result of smartphone manufacturers failing to follow their instruction to disable the debug feature before shipping the smartphones. The company did not release the names of the manufacturers responsible, and as a result, we don’t know for sure which device models this bug affects.
Case summed up the bug and the way it could be exploited by saying, “[MediaTek has] ‘nerved’ the property space, they made it so these properties can be changed, and changed by anyone/app. A malicious app could set the ‘ro.secure’ property to 0, ro.debuggable one to 1, ro.adb.secure prop to 0 (this would mean ADB didn’t need authentication) and then enable the ADB over Wi-Fi property, and get a local root shell.”
Although a large number of devices currently on the market run Android 4.4 using these chips, the chipmaker is downplaying the impact. They have declined to estimate how many devices are affected, but they’ve said that they are taking steps to make sure all manufacturers are aware of this issue.
What does this mean for you? Are any of your devices potentially affected by this security vulnerability? What do you think of how MediaTek is handling the issue? Let us know your thoughts in the comments below!