Bill Mann@CyberInsider
//
Google has released its April 2025 Android security update, addressing a total of 62 vulnerabilities. This includes fixes for two actively exploited zero-day vulnerabilities. The security bulletin addresses vulnerabilities across system components, the Linux kernel, and third-party hardware drivers, highlighting the importance of applying updates promptly. The two high-severity zero-days were reportedly used in targeted surveillance operations.
The exploited vulnerabilities are identified as CVE-2024-53150 and CVE-2024-53197. CVE-2024-53150 is an Android Kernel information disclosure vulnerability caused by an out-of-bound read weakness, potentially allowing local attackers to access sensitive information. CVE-2024-53197 is a high-severity privilege escalation flaw in the Linux kernel’s USB-audio driver for ALSA devices.
The privilege escalation flaw, CVE-2024-53197, was reportedly exploited by Serbian authorities to unlock confiscated Android devices. This was part of a zero-day exploit chain developed by Cellebrite, an Israeli digital forensics company. The exploit chain also included CVE-2024-53104, patched in February 2025, and CVE-2024-50302, patched last month. With this latest update, all three vulnerabilities in that chain are now fixed. Users are advised to apply the updates as soon as they are released by Android original equipment manufacturers (OEMs).
Recommended read:
References :
- CyberInsider: Google Patches Actively Exploited Android Zero-Day Vulnerabilities
- discuss.privacyguides.net: Google just fixed two critical Android zero-days and 60 other flaws
- The Hacker News: Google Releases Android Update to Patch Two Actively Exploited Vulnerabilities
- BleepingComputer: Google fixes Android zero-days exploited in attacks, 60 other flaws
- securityaffairs.com: Google addressed 62 vulnerabilities with the release of Android ‘s April 2025 security update, including two actively exploited zero-days.
- cyberinsider.com: Google’s April 2025 Android Security Bulletin addresses 60 vulnerabilities across system components, the Linux kernel, and third-party hardware drivers, including two high-severity zero-days that have been actively exploited in targeted surveillance operations.
- Threats | CyberScoop: Google addresses 2 actively exploited vulnerabilities in security update
- techcrunch.com: Google fixes two Android zero-day bugs actively exploited by hackers
- Malwarebytes: Google fixes two actively exploited zero-day vulnerabilities in Android
- cyberscoop.com: Google addresses 2 actively exploited vulnerabilities in security update
- techcrunch.com: Google fixes two Android zero-day bugs actively exploited by hackers
- MSSP feed for Latest: Google Patches Two Zero-Days in April 2025 Android Security Update
- infosec.exchange: NEW: Google has pushed out patches for two zero-days that were being (and may still be) exploited in the wild. Amnesty previously found that one of them was being used against a student activist in Serbia, by Serbian authorities armed with Cellebrite.
- Cyber Security News: Google addressed 62 vulnerabilities with the release of Android ‘s April 2025 security update, including two actively exploited zero-days.
@The DefendOps Diaries
//
A new version of the Triada trojan has been discovered preinstalled on thousands of new Android devices, raising significant cybersecurity concerns. This sophisticated malware, initially identified in 2016, has evolved to embed itself deeply into the Android system framework, making it difficult for users to detect or remove. Discovered on counterfeit versions of popular smartphone models sold at discounted prices through online stores, Triada poses a severe threat as it can steal user data immediately after device setup.
Triada's capabilities include stealing user data, such as social media and messenger accounts, and manipulating cryptocurrency transactions by replacing wallet addresses. The malware can also falsify caller IDs, monitor browser activity, and even activate premium SMS services. Experts warn that this new version infiltrates the device at the firmware level, indicating a compromised supply chain and urging users to exercise caution and purchase Android devices from reputable sources.
Recommended read:
References :
- bsky.app: A new version of the Triada trojan has been discovered preinstalled on thousands of new Android devices, allowing threat actors to steal data as soon as they are set up.
- BleepingComputer: A new version of the Triada trojan has been discovered preinstalled on thousands of new Android devices, allowing threat actors to steal data as soon as they are set up.
- The DefendOps Diaries: Explore the threat of Triada malware in counterfeit Android devices and learn how to protect against this sophisticated cyber threat.
- BleepingComputer: A new version of the Triada trojan has been discovered preinstalled on thousands of new Android devices, allowing threat actors to steal data as soon as they are set up.
- www.it-daily.net: Triada Trojan discovered on counterfeit Android smartphones
- PCMag UK security: Counterfeit Android Phones Preloaded With a Special Surprise: Malware
- Sam Bent: Triada Malware Preloaded on Counterfeit Androids Hijacks 2,600+ Devices for Crypto Theft and Espionage
- www.scworld.com: Updated Triada trojan compromises thousands of Android devices
- securityaffairs.com: New Triada Trojan comes preinstalled on Android devices
- The Hacker News: Triada Malware Preloaded on Counterfeit Android Phones Infects 2,600+ Devices
- Cyber Security News: Trinda Malware Infects Android Devices to Manipulate Phone Numbers During Calls
- Cyber Security News: New Triada Malware Attacking Android Devices to Replaces Phone Numbers During Calls
- www.techradar.com: Dodgy Android smartphones are being preloaded with Triada malware
Alex Lekander@CyberInsider
//
Serbian authorities reportedly used a Cellebrite-developed Android zero-day exploit chain to unlock the device of a student activist and attempt to install spyware. This exploit targeted vulnerabilities in Android, allowing authorities to bypass security measures. Amnesty International discovered the exploit after analyzing the student's phone, which prompted them to alert Google.
Google has since fixed three zero-day vulnerabilities in Android that were exploited by Cellebrite forensic tools. Following the reports of misuse for political reasons, Cellebrite blocked Serbia from further use of its solution. The company took action after claims emerged that the equipment was being used improperly.
Recommended read:
References :
- infosec.exchange: NEW: Google fixed three zero-day vulnerabilities in Android that were used by authorities to unlock phones with Cellebrite forensic tools. The fixes come after Amnesty alerted Google, following the analysis of a Serbian student protester's phone.
- bsky.app: Serbian authorities have reportedly used an Android zero-day exploit chain developed by Cellebrite to unlock the device of a student activist in the country and attempt to install spyware.
- CyberInsider: Serbia Used Cellebrite Zero-Day Android Attack on Student Activist
- securityaffairs.com: Cellebrite blocked Serbia from using its solution because misuse of the equipment for political reasons
- techcrunch.com: Amnesty International said that Google fixed previously unknown flaws in Android that allowed authorities to unlock phones using forensic tools. On Friday, Amnesty International published a report detailing a chain of three zero-day vulnerabilities developed by phone-unlocking company Cellebrite, which its researchers found after investigating the hack of a student protester’s phone in Serbia. The
- The Hacker News: Amnesty Finds Cellebrite’s Zero-Day Used to Unlock Serbian Activist’s Android Phone
- infosec.exchange: Amnesty International has uncovered a sophisticated cyber-espionage campaign in Serbia, where authorities used Cellebrite kit with Linux USB CVE-2024-53104 exploit chained with 2 other CVEs to unlock the Android phone of a student activist
- aboutdfir.com: Cellebrite cuts off Serbia over abuse of phone-cracking software against civil society
- securityaffairs.com: Serbian student activist’s phone hacked using Cellebrite zero-day exploit
- Talkback Resources: Cellebrite zero-day exploit used to target phone of Serbian student activist [app] [exp]
info@thehackernews.com (The Hacker News)@The Hacker News
//
Google has released the February 2025 Android security updates, patching a total of 48 vulnerabilities. Among these fixes is a critical zero-day kernel vulnerability, identified as CVE-2024-53104, which Google has confirmed is being actively exploited in the wild. This particular flaw is a privilege escalation issue found within the USB Video Class (UVC) driver, potentially allowing attackers to gain elevated permissions on affected devices.
The vulnerability, with a CVSS score of 7.8, stems from an out-of-bounds write condition within the "uvc_parse_format()" function of the "uvc_driver.c" program, specifically when parsing UVC_VS_UNDEFINED frames. This flaw, present since Linux kernel version 2.6.26 released in mid-2008, could lead to memory corruption, program crashes, or even arbitrary code execution. While the specific actors behind the exploitation remain unclear, the potential for "physical" privilege escalation raises concerns about misuse by forensic data extraction tools.
Recommended read:
References :
- cyberinsider.com: Google Fixes Zero-Day Flaw Exploited in Targeted Android Attacks
- BleepingComputer: The February 2025 Android security updates patch 48 vulnerabilities, including a zero-day kernel vulnerability tagged as exploited in the wild.
- securityaffairs.com: Google fixed actively exploited kernel zero-day flaw
- The Hacker News: Google Patches 47 Android Security Flaws, Including Actively Exploited CVE-2024-53104
- CyberInsider: Google Fixes Zero-Day Flaw Exploited in Targeted Android Attacks
- ciso2ciso.com: Google fixed actively exploited kernel zero-day flaw
- BleepingComputer: The February 2025 Android security updates patch 48 vulnerabilities, including a zero-day kernel vulnerability tagged as exploited in the wild.
- Pyrzout :vm:: Social post about google actively exploited kernel zero-day flaw.
- www.bleepingcomputer.com: The February 2025 Android security updates patch 48 vulnerabilities, including a zero-day kernel vulnerability tagged as exploited in the wild.
|
|
FlagThis - #androidsecurity