Many Android devices ship with firmware vulnerabilities, researchers find

Asus, Essential, LG, and ZTE have all vowed to patch security flaws found by mobile security firm Kryptowire, according to Wired. The firm’s research was meant to point out that some security meltdowns stem from code written by phone companies to modify Android.

Researchers found bugs in the firmware of 10 separate devices carried across the major American carriers, according Wired, which saw an early version of Kryptowire’s report. The security lapses could lead to everything from letting an attacker lock someone out of their device, to getting control over their microphone and more — though most of the attacks that the researchers detailed required users to download some sort of malicious app before they could take advantage of the holes present in the firmware. Their research, funded by the Department of Homeland Security, is being presented today at the Black Hat USA security conference.

According to Kryptowire, these vulnerabilities stem from Android’s open nature, which allows third-parties to tweak the code and modify the interference or create completely different versions of Android. However, as the researchers found out, this open-style system can also lead to gaps in the phones’ security. Wired says the research looks at these flaws as a problem endemic to Android.

“A lot of the people in the supply chain want to be able to add their own applications, customize, add their own cod,” Kryptowire CEO Angelos Stavrou told Wired. “That increases the attack surface, and increases the probability of software error.”

One particularly bad example was found in the Asus Zenfone V Live smartphone. According to Wired, Kryptowire found enough holes in its code to expose users to a complete takeover of their device — screenshots and video recordings could be taken of their screen, and someone could, theoretically, read and changing their text messages. Asus said it is “aware of the recent security concerns” and that it is “working diligently and swiftly to resolve them” with a patch.

Essential, LG, and ZTE all responded to Wired with statements saying they had fixed some or all of the problems identified by Kryptowire after being alerted by the firm. Whether those patches have been rolled out to all users is less clear, however, as only AT&T confirmed it had deployed any of these updates. And as the researchers point out, this update process is, itself, broken for many, with updates often taking months to put together and make their way to users.