1

Background Info: CVE-2019-2234 is a serious vulnerability or (maybe an APT) which allow other apps to record videos, take pictures, and extract EXIF data without having permissions.

Edit: This question is other devices rather than Pixel & Samsung

I've tested this PoC (changed package name to my camera's package name) to check if is this possible on my (non Pixel) device, but all I have is the camera activity has been launched without starting recording or taking pictures.

Launch Camera:

adb shell am start-activity -n com.android.camera/com.android.camera.CameraActivity --ez extra_turn_screen_on true -a android.media.action.CAMERA --ez android.intent.extra.USE_FRONTAL_CAMERA true

Launch Video:

adb shell am start-activity -n com.android.camera/com.android.camera.CameraActivity --ez extra_turn_screen_on true -a android.media.action.VIDEO_CAMERA --ez android.intent.extra.USE_FRONTAL_CAMERA true

Question

Part 1: If this device is vulnerable are there other extras to add to make the PoC work and proof that it's vulnerable? or just it's not?

Part 2: If the device is vulnerable, what would be the best mitigation solution for this?

Improve this question

1 Answer 1

Reset to default
2

If I understood the problem correctly the vulnerability is located in the camera apps. Updating apps is the responsibility of the Google PlayStore or in case of Samsung there is also the Samsung "Galaxy Store" which is usually comes pre-installed on all Samsung devices.

Therefore in this case no firmware update is required.

In both cases Google and Samsung have simply updated their camera apps. As the vulnerability was a responsible disclosure the updates that fix this vulnerability should be already available and will be automatically installed by the Google Play / Galaxy store.

Therefore Google and Samsung devices this vulnerability should be no longer an issue. The more important question is how many other camera apps of other manufacturer are also affected.

[Part 1] Regarding devices of other manufacturers there is no general way to be sure that their camera apps are affected or not. If the standard POC does not work and you want to make sure that the app is truly not affected you have to check every camera app individually if the vulnerability can be triggered in a similar way. To do so you have to decompile the app using the decompiler of your choice (Jadx, apktool, JEB, Ghidra, ...) and analyze the decompiled code.

Improve this answer
4
  • +1 Thanks for your reply, the OP asks about (other devices rather than Pixel and Samsung)
    – M. A.
    Commented Nov 21, 2019 at 8:53
  • @Abdelhafid Then you should explicitly write this in your question. The CVE only mentions Google Pixel and Samsung camera apps.
    – Robert
    Commented Nov 21, 2019 at 9:46
  • I've mentioned non Pixel devices in the OP, but it's OK, I've edited the question again
    – M. A.
    Commented Nov 21, 2019 at 9:53
  • 1
    @M.Abdelhafid AFAIK, it only depends on the camera apps, including stock and 3rd-party camera apps. It should be device-independent though, any Android devices can be exploited with buggy camera apps. You should try to download and install Google Camera app before July 2019 instead to test the PoC on your non-Pixel device.
    – Andrew T. ♦
    Commented Nov 21, 2019 at 9:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .