Android flaw allowed attackers to spy on users through phone camera

Thanks to a security flaw, Android apps had the ability to take photos and record conversations without users knowing it. 

According to a bombshell report released Tuesday by cybersecurity firm Checkmarx, a major Android flaw gave attackers shockingly broad permissions to a phone without consent from users. The flaw, dubbed CVE-2019-2234, allowed an app developer to gain unparalleled access to a device’s camera, turning a user's phone into a spying device. Checkmarx was able to uncover all of these vulnerabilities through a fake weather app it created.

An attacker could silence the camera shutter to hide the fact that it was recording video and photos without consent. These actions could even be taken when the malicious app was closed, with the screen off and the phone locked.  Read more...