Chipmaker Qualcomm on Monday said hackers had exploited a zero-day (a security flaw unknown to the hardware maker at the time of the exploit) in dozens of chipsets found in popular Android devices. I admitted it.
The zero-day vulnerability, officially designated CVE-2024-43047, was identified by Qualcomm, citing unspecified “indications” from Google's Threat Analysis Group, the company's research arm that investigates government hacking threats. “There may be limited and targeted exploitation.” Qualcomm said Google's assessment was confirmed by Amnesty International's Security Lab, which works to protect civil society from digital surveillance and spyware threats.
The US cybersecurity agency CISA has included the Qualcomm flaw in its list of vulnerabilities that are known to be or have been exploited.
At this time, there are not many details about who was actually exploiting this vulnerability. This means that the person using the zero-day was actually targeting individuals in a hacking campaign. It is also not yet known which individuals were targeted or why.
Qualcomm spokesperson Katherine Baker told TechCrunch that the company praised “Google Project Zero and researchers at Amnesty International Security Lab's adoption of collaborative disclosure practices” and said the company is working hard to fix the vulnerability. He said it was now ready for publication.
The chipmaker has contacted Amnesty International and Google for more information about the threat activity.
Neither Google nor Amnesty International responded to TechCrunch's requests for comment.
A Qualcomm spokesperson said, “The fix is available to our customers as of September 2024.” It is now up to Qualcomm's customers, the Android device manufacturers using the vulnerable chipsets, to release patches to their customers' devices.
In its advisory, Qualcomm lists 64 chipsets affected by this vulnerability. This includes the company's flagship Snapdragon 8 (Gen 1) mobile platform, which is potentially vulnerable to millions of users around the world from Motorola, Samsung, OnePlus, Oppo, Xiaomi and ZTE. means that
That said, the fact that Google and Amnesty International are investigating the use of this zero-day under “limited and targeted exploitation” means that the hacking campaign is aimed at specific individuals rather than mass targets. This suggests that there is a high possibility that it was used.
Brian Heater contributed reporting.