Critical bug in Android could allow access to users’ media files
Security analysts have found that Android devices running on Qualcomm and MediaTek chipsets were vulnerable to remote code execution due to a flaw in the implementation of the Apple Lossless Audio Codec (ALAC).
ALAC is an audio coding format for lossless audio compression that Apple open-sourced in 2011. Since then, the company has been releasing updates to the format, including security fixes, but not every third-party vendor using the codec applies these fixes.
This vulnerability enables a remote attacker to execute code on a target device by sending a maliciously crafted audio file and tricking the user into opening it. The researchers are calling this attack “ALHACK.”
The impact of remote code execution attacks comes with severe implications, ranging from data breach, planting and executing malware, modifying device settings, accessing hardware components such as the microphone and camera, or account take over.
The case with audio codec flaws
Fixes of remote code execution flaws in closed-source audio processing units are present almost in every monthly Android security update.
However, exploiting them is rarely trivial, and the component vendors provide few technical details to reduce exploitation risk.
For example, Android patches from April included nine fixes for critical vulnerabilities in closed-source components. One of them is CVE-2021-35104 (9.8 severity score) – a buffer overflow that led to improper parsing of headers while playing FLAC audio clips.
The bug affected chipsets present in almost the entire range of products Qualcomm released over in the past several years.
How to stay safe
The standard security advice applies here, too: keep your devices up to date, in this case it means running the Android patch level “December 2021” or later.
If the device no longer receives security updates from the vendor, installing a third-party Android distribution that still provides Android patches is valid option.
Finally, when receiving audio files from unknown or suspicious sources/users, it is best not to open them since they could trigger the vulnerability.