Skip to main content
  1. Home
  2. Mobile
  3. News

Researchers find serious exploits in Samsung, Apple and Huawei phones

By

galaxy note 8 vs. galaxy note 7 software
Image used with permission by copyright holder
If you own an iPhone 7 or Galaxy S8, you may want to check for updates. This week, Zero Day Initiative (ZDI) hosted its annual Pwn2Own contest in Tokyo as researchers from around the world gathered to show exploits on the iPhone 7, Samsung S8, and Huawei Mate 9 Pro.

This year’s event yielded 32 different vulnerabilities and awarded $515,000 in payments to researchers.

Recommended Videos

iPhone

iPhone X v iPhone 6S opinion 6s in hand
Image used with permission by copyright holder

Qihoo 360 Security exposed a vulnerability where hackers could use Wi-Fi to execute code on an iPhone 7. They also were able to exploit Safari through a bug in the browser and one in system services.

Tencent Keen Security Lab exposed a troubling Wi-Fi exploit where hackers could use a series of bugs to gain execution and escalate privilege on the iPhone 7 to install a rogue app. The app remained on the device even after a restart. 

Fluorescence (Richard Zhu) exploited a bug in the iPhone 7’s Safari browser with an out-of-bounds bug to escape the browser’s sandbox and execute code on the phone.

Samsung

Image used with permission by copyright holder

MWR Labs exposed a serious vulnerability on the Samsung Galaxy S8. The researchers used 11 vulnerabilities across six different applications to execute code and pull data from the device. This magnitude of bugs allowed the researchers to continue exploiting the phone even after a reboot.

Qihoo 360 Security used the Samsung internet browser on the Galaxy S8 to run code and then leveraged a privilege escalation in a Samsung application that persisted through a device reboot.

Huawei

Huawei Mate 9 review Huawei Mate 10
Andy Boxall/Digital Trends
Andy Boxall/Digital Trends

MWR Labs used a series of five bugs in different Huawei applications to escape the Google Chrome browser sandbox and remove data from a Huawei Mate 9 Pro.

Tencent Keen Security used a Huawei Mate 9 Pro to showcase the most devastating vulnerability during the contest. The researchers were able to execute a baseband attack on the device and execute code on the broadband processor.  They were then able to modify the device’s International Mobile Equipment Identity (IMEI), something that could cause huge disruptions if it was done in the wild.  This was the first broadband exploit ever submitted to ZDI.

Each year ZDI holds the Pwn2Own contest not only to show device exploits but to give vendors an opportunity to fix them. Exploits are provided to vendors, which are able to ask researchers directly any questions they may have. ZDI then gives the vendor 90 days to correct the issue. If the vendor is unable or does not fix the issue or provide a reasonable statement as to why the vulnerability is not fixed, ZDI publishes an advisory with additional details about the exploits in an effort to protect the public.

Editors' Recommendations

Topics
Steven Winkelman
Steven Winkelman
Former Digital Trends Contributor
Steven writes about technology, social practice, and books. At Digital Trends, he focuses primarily on mobile and wearables…
Here’s how Apple could change your iPhone forever
An iPhone 15 Pro Max laying on its back, showing its home screen.

Over the past few months, Apple has released a steady stream of research papers detailing its work with generative AI. So far, Apple has been tight-lipped about what exactly is cooking in its research labs, while rumors circulate that Apple is in talks with Google to license its Gemini AI for iPhones.

But there have been a couple of teasers of what we can expect. In February, an Apple research paper detailed an open-source model called MLLM-Guided Image Editing (MGIE) that is capable of media editing using natural language instructions from users. Now, another research paper on Ferret UI has sent the AI community into a frenzy.

Read more
Everything Apple says is wrong about the DOJ’s iPhone lawsuit
The Apple logo on the iPhone 14 Pro Max.

The antitrust season is in full swing in 2024. This time around, Apple is in the cross-hairs of regulators, bringing back memories of the historic Microsoft antitrust case that unfolded over two decades ago. Back then, the focus was on Windows and web browsers. In Apple’s case, the iPhone is the centerpiece, with a wide ecosystem woven around it.

Experts say the case against Apple, which dives deep into monopolistic conduct, is surprisingly strong. The Department of Justice, in its lawsuit, has targeted everything from the iMessage “green bubble” mess and Apple Watch incompatibility situation to the locked app ecosystem and objectionable practices that Apple has put in place to maintain its alleged monopoly.

Read more
We now know when Apple is adding RCS to the iPhone
The iPhone 14 Plus held in a man's hand.

Last November, Apple made a surprise announcement when it confirmed that RCS was coming to the iPhone in 2024. It's something iPhone and Android phone users alike have been waiting years for, but there was just one small problem: Apple never said when in 2024 RCS was coming. Thanks to Google, of all companies, we now have a better idea of when RCS is heading to the iPhone.

As spotted by 9to5Google, the Android website was recently updated with a new page dedicated to Google Messages. If you click on the "See more features" button for the section talking about RCS, there's a section titled "Better messaging for all" with the following text: "Apple has announced it will be adopting RCS in the fall of 2024. Once that happens, it will mean a better messaging experience for everyone."

Read more