Samsung, Pixel Users No Longer at Risk for Android Camera App Hijacking

The Pixel 2 and 2 XL sport a single camera sensor, but they produced better results than phones with two or three sensors.

Many of today’s flagship Android phones have fantastic cameras, but the camera app on Google and Samsung phones reportedly shipped with a nasty bug that could have allowed malicious apps to capture images without your authorization. The companies didn’t know about the bug until earlier this year when researchers from Checkmarx alerted them. It’s a good thing, too. This could have been a huge mess if someone exploited it in the wild. 

The report from Checkmarx is a bit surprising because we’re not used to seeing Android bugs like this anymore. Google implemented a robust permission system in Android 6.0 Marshmallow, and it has been strengthening its controls in subsequent versions. So, when apps want to access the camera, users have to approve the request. However, Checkmarx found a method by which apps could take control of the camera on Google Pixel and Samsung Galaxy Phones without asking for permission. 

The problem traces back to the Samsung Bixby and Google Assistant AI features and the way they communicate with the built-in camera apps. On these phones, the user can ask the assistant to take a photo. Assistant and Bixby have special status so they don’t have to go through the usual permission dialog. That makes the experience smoother, but it’s also where a malicious app could gain control of your camera. 

Checkmarx demonstrated that an app could pretend to be sending voice requests via Bixby or Assistant, but in reality, it was just accessing the camera directly. The app could then send the photos to a remote location without ever asking for camera access. You can see the attack in action above. 

Checkmarx reported the flaw to Google and Samsung earlier this year. Luckily, there is no evidence of this attack showing up in the wild, and you don’t have to worry about your phone’s security. Both Google and Samsung rolled out patched versions of their camera apps in July 2019 that prevent third-party apps from imitating voice requests for camera access. So, the bug is fixed, but at its peak, it would have affected millions of phones. Most of them would have been Samsung devices, but it’s still a bit embarrassing for Google as it frequently points out security snafus at other companies.

Now read:

• Google Ends Regular Updates for 2016 Pixel Phones, Promises One Last OTA in December
• Google Says Project Treble Has Massively Accelerated Android Updates
• The ‘New’ Galaxy Fold Is Still Extremely Fragile