We all know how it goes. First, a hotshot security researcher finds a flaw in the Android OS. Then, he or she communicates it to Google, which patches it as soon as possible.
Finally, Google relays this information to phone manufacturers, who proceed to sit on it for weeks or months — or do absolutely nothing at all, leaving users completely vulnerable. This pattern has repeated yet again, this time with a complicated but widespread set of software flaws involving Qualcomm Atheros Wi-Fi chips, which are found on many of the Qualcomm mobile chipsets used on millions of phones.
What to Do
If you have a Google Pixel, Pixel 2, Nexus 5x, Nexus 6P, or indeed any other handset sold directly by Google and still receiving security patches, apply the November Android security patch as soon as you receive it. (The November patch also fixes the KRACK vulnerability, which is unrelated to those discussed in this story.)
If you have a phone made by another manufacturer, we can't tell you whether it uses a Qualcomm Atheros Wi-Fi chip, and if so, whether it is susceptible to these new flaws. But it would be best to apple the Android November patch as soon as you receive it, whenever your phone maker decides to push it out.
MORE: Best Android Antivirus Apps
Scotty Bauer, a developer and bug-hunter, discovered the six vulnerabilities, which he documented in a blog post yesterday (Nov. 6) entitled "Please Stop Naming Vulnerabilities."
"In today's world everyone knows that a security vulnerability isn't really a security vulnerability unless it has been given a name other than a CVE, a Hype Krew has been hired to promote it, a blog post has been written for it, and a Blakhat talk is delivered," he posited.
Out of respect for Bauer's wishes, we'll simply refer to the bugs he discovered as Qualcomm Atheros vulnerabilities, since they affect the qcacld driver for Qualcomm Atheros Wi-Fi chips. Qualcomm Atheros chips enable the Wi-Fi on Google’s Pixel and Nexus phones, as well as many other Android handsets.
It’s not easy to find a comprehensive list of how many phones use those particular Wi-Fi chips, but if Google uses them, you can imagine that a lot of other high-end phone manufacturers do the same. Some diligent Googling reveals that Qualcomm's current line of Snapdragon chips, found on dozens of high-end Android phones including Google's Pixel and Pixel 2, includes Qualcomm Atheros Wi-Fi chipsets, although we can't tell exactly which driver each model uses.
Unless you have a pretty good understanding of Android kernel memory and Wi-Fi drivers, Bauer's post is pretty dense reading. In broad terms: The Qualcomm Atheros Wi-Fi driver runs on 691,000 lines of code. Bauer poked at this code until he found a few holes. Because it's possible to access the Android kernel (the deepest level of the OS) through the flaws, an attacker could gain complete control of a victim's phone.
If you have a Pixel or Nexus phone, there's good news: Google has already released patches for the issue in question. To apply the patches, all you have to do is update your system software in the Settings menu. (Or boot up your phone and wait a few minutes; Android phones download security updates automatically, unless you tell them not to.)
If you don't have a Pixel or Nexus phone, the news is a little harder to parse. It's not easy to determine whether any given phone has a qcacld Qualcomm Atheros Wi-Fi driver. Furthermore, even though Google will communicate this information to other phone manufacturers and wireless carriers, each company's process for patching Android is a little different. You could get a patch tomorrow — or never.
Your best bet would be to keep your phone updated and stay away from unsecured Wi-Fi networks. While this isn't a 100 percent guarantee of safety, very few hackers would take the time and effort necessary to leverage an extremely complicated attack over a home Wi-Fi network equipped with proper security protocols.
If there’s any big lesson here, it's that Android — as versatile and efficient as it is — combines a lot of disparate elements from many different manufacturers and programmers, even in its flagship phones. Pick at it long enough, and you're bound to find a vulnerability. Whether anyone exploits that vulnerability is one fair question. Whether every Android manufacturer deigns to patch it is another.
Best Android Antivirus Apps
You'll have to pay $15 per year for Bitdefender Mobile Security, but its excellent malware protection and intuitive user interface make it well worth paying for.
Norton Mobile Security may seem pricey, but its excellent protection, multidevice license and unique privacy features make it a worthwhile investment.
Avast Mobile Security has solid malware protection, but some of its many features don't work well.
