ByBill Toulas-November 20, 2019.661 Researchers discovered troubling vulnerabilities in the Android ecosystem’s camera program. The PoC will secretly snatch media and Gps data from the camera, and eavesdrop calls. Fixing patches have already been issued by Google and Samsung but others remain open. The Checkmarx team developed a design proof to exploit the discovered vulnerabilities and proved that it is possible for an attacker to take control of camera apps to capture videos and bypass different storage permission policies. This action can be accomplished through an unrelated rogue code that will activate the appropriate features on the camera app, and may even provide microphone recordings and location data to accompany the photographs taken. Another simplified method for stealing data is basically based on it being exfiltrated directly from the Sd card and sent to the C C server without the user knowing anything. The only thing that needs to function for this is to have the victim install the rogue software and grant permissions for Sd storage access. The PoC will quietly take photos and videos, as it has the power to mute the shutter sound of the camera regardless of the user’s environment. Moreover, and because the rogue software also makes the microphone available, there is also the risk of eavesdroping phone calls or taking pictures and videos during a phone call, and even pulling Gps data at once. The researchers sent Google their report and PoC and the latter reported the bug within just a week. Google found the effect of the discovered bug was much larger than they initially anticipated, so they approached multiple vendors around two months after the initial discovery and told them of the issues. The Play Store update of the Google Camera app has already been updated so you’re no longer at risk if you’re using a Google computer. Samsung also published patches in their camera app to fix the bugs, so if you own a Galaxy system, you’re protected. However, Google has acknowledged privately that many other Android phone makers remain vulnerable to this day, so this is another case that reveals the vulnerabilities that stem from the broken nature of Android.