“Given the popularity of Android devices, this is a critical vulnerability that must be addressed,” said Slava Makkaveev, Security Researcher at Check Point Software Technologies. The user only needs to accept the CP and the malicious software will be installed without the sender needing to prove their identity. Researchers found that certain Samsung phones are the most vulnerable to this form of phishing attack because they do not have an authenticity check for senders of OMA CP messages. The message tricks users into accepting malicious settings that can, for example, route all their Internet traffic through a proxy server owned by the attacker and enable the attacker to read emails. This can be exploited, enabling hackers to pose as network operators and send deceptive OMA CP messages to users.Īn unauthenticated CP message as it appears to a Samsung user However, researchers found that the industry standard for OTA provisioning, the Open Mobile Alliance Client Provisioning (OMA CP), includes limited authentication methods. The affected Android phones use over-the-air (OTA) provisioning, which allows mobile network operators to deploy network-specific settings to a new phone joining their network. Check Point Research has revealed a security flaw in Samsung, Huawei, LG, Sony and other Android-based phones that leaves users vulnerable to advanced phishing attacks.
0 Comments
Leave a Reply. |
Details
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |