Living in the age of AI comes with risks, and some of those risks are clearly security related. Namely that if someone wants to wield AI to find vulnerabilities and break open things we know, love, and rely on, they can do exactly that.
We’re beginning to see aspects of that, such as with the recent PHP apocalypse, where lots of websites went down to fix an issue inside the system that runs roughly 70 percent of websites around the world.
There’s even the potential to use outdated and unpatched TVs as a mechanism to break into your home network, essentially turning the smart home into a target.
In the past, computers have been the place where attacks like ransomware have played, locking down files in exchange for money, and mobiles aren’t immune.
While ransomware on mobiles isn’t necessarily a new thing, security specialist Bitdefender has found a potentially complicated approach which echoes how ransomware works in an app that can simply crash a phone, forcing it to restart in an endless loop, and potentially give an attack a way to extort the phone owner.
It’s a flaw Bitdefender calls “GhostMap”, and while it’s technically not a hack attempt in the wild and lurking on anyone’s device just yet, it’s a bug apparently found inside Android that can force a phone to stop working, and basically be forced into a factory reset.
Not technically an attack right now, the company says it considers “the risk posed by this bug to be significant”, noting that “in theory, an attacker could hide this technique in a fake app to disable a victim’s phone”.
While Bitdefender has reportedly tested the issue, it did apparently report it to Google through its Android & Devices Vulnerability Reward Program back in August twice, and the maker of Android closed the first report, marking it as “Won’t Fix” and that it couldn’t be reproduced, while the second attempt said it was outside the scope of a security update fix.
Back in 2016, however, a version of this bug was patched, though Bitdefender noted it was a weaker version, fixed across Android 4.4.4 to Android 7.0. To put that into perspective, ten years on, we’re at Android 17 in version numbers.
We’ve not yet seen the malware, but Pickr did reach out to Google and hasn’t heard anything back by the time of publishing.
However, the potentially positive news (at least for now) is that an application capable of doing this — of stopping a phone from working and potentially using it to hold onto a device — isn’t found in the wild. This isn’t happening to anyone’s phones just yet.
But the company did note that its own mobile security solution was able to pick up on the app issue, and that could mean other security specialists will cotton on soon to prevent the app installs, as could Google. If the flaw is as serious at Bitdefender warns, this would mean a patch for a bunch of phones very shortly, too.
