Microsoft: Millions of Android smartphones are at risk

Millions of Android smartphones are at risk of hacking. Microsoft has discovered security flaws in popular Android applications from the Play Store or installed by default by manufacturers. It seems that the Play Protect is completely incapable of identifying breaches of this type. To protect users, an emergency update has become available with the help of Microsoft experts.

Microsoft has just discovered the presence of a series of security flaws within certain Android applications. In a report published on its site, the American giant explains that it spotted “high-severity vulnerabilities in a mobile framework belonging to mce Systems” in September 2021.

This is an Israeli firm that provides software frameworks to developers. These pre-made frameworks make life easier for developers and for activating Android devices, Microsoft explains. However, the “extensive control” of the products provided by mce Systems makes them a prime target for hackers.

According to Microsoft researchers, this framework is in use by many companies specializing in the development of applications, including system applications integrated by default on the phone. Clearly, it is the apps that come pre-installed on Android phones that put users at risk. Often, it is not possible to get rid of these apps by uninstalling them.

Millions of Android smartphones are at the mercy of hackers according to Microsoft

According to Microsoft, these applications are present on millions of Android smartphones in circulation around the world. Some apps, available on the Play Store, have recorded millions of downloads. In detail, Microsoft has identified 4 security flaws by digging into the code of the framework. “The vulnerabilities we discovered can all be exploited in the same way,” Microsoft adds.

According to the research team, the flaws could allow a seasoned attacker to “implant a persistent backdoor” on a smartphone remotely. With this backdoor, it will be able to install viruses or spyware without your knowledge. Worse, a hacker could directly take control of your device without needing physical access to it.

As Microsoft points out, the framework is able to “access system resources and perform system-related tasks, such as adjusting the device’s audio, camera, power, and storage controls”. The framework developed by mce Systems also has “extended privileges” to work with system applications.

In addition, this is why the exploitation of a flaw located in the code of the framework endangers the personal data and the security of the users. In this context, Microsoft believes that the breaches can be due to high severity.

Microsoft researchers have also discovered that Google Play Protect, the security system that monitors Play Store apps, is totally powerless in this case. “These checks were not designed to detect these types of problems,” according to the report.

Also, this is not the first time that the reliability of Play Protect has been a subject of questions. To improve security on Android, Microsoft contacted Google teams. By collaborating, the two firms were able to help Play Protect “identify these vulnerabilities”.