Cybersecurity researchers have identified a security vulnerability in MediaTek chipsets that could expose sensitive data on many Android smartphones worldwide. The company has issued a security patch following the discovery.
Researchers from cybersecurity firm Ledger identified the vulnerability, which could allow attackers to access protected phone data through a USB connection. The issue was identified during testing on the CMF Phone 1 device.
According to the researchers, access to encrypted storage was achieved within 45 seconds during testing. The device used in the test was equipped with a MediaTek Dimensity 7300 processor. Researchers said the encrypted storage could be accessed even when the device was powered off.
Ledger Chief Technology Officer Charles Guillemet warned about the vulnerability after the research findings. During testing, the research team found that security protections on certain smartphones using MediaTek chipsets could be bypassed.
Researchers stated that attackers could gain access to sensitive information by connecting the phone to a computer via a USB connection for a short period.
The researchers said the vulnerability does not require attackers to install malware on the device. According to the findings, a brief USB connection could allow attackers to access and decrypt information stored on the phone.
The data that could potentially be accessed includes device PINs, passwords, and other protected information stored on the phone.
Industry estimates indicate that approximately 25 percent of Android smartphones worldwide use MediaTek processors. Researchers said this suggests a large number of users could be affected by the vulnerability.
MediaTek has acknowledged the issue and released a security patch. The company has advised smartphone manufacturers and users to update their devices to the latest available system update to address the risk.
