A 23-year-old Serbian youth activist had their Android telephone focused by a zero-day exploit developed by Cellebrite to unlock the system, in accordance with a brand new report from Amnesty Worldwide.
“The Android telephone of 1 scholar protester was exploited and unlocked by a complicated zero-day exploit chain focusing on Android USB drivers, developed by Cellebrite,” the worldwide non-governmental group mentioned, including the traces of the exploit have been found in a separate case in mid-2024.
The vulnerability in query is CVE-2024-53104 (CVSS rating: 7.8), a case of privilege escalation in a kernel element generally known as the USB Video Class (UVC) driver. A patch for the flaw was addressed within the Linux kernel in December 2024. It was subsequently addressed in Android earlier this month.
It is believed that CVE-2024-53104 was mixed with two different flaws – CVE-2024-53197 and CVE-2024-50302 – each of which have been resolved within the Linux kernel. They’re but to be included in an Android Safety Bulletin.
- CVE-2024-53197 (CVSS rating: N/A) – An out-of-bounds entry vulnerability for Extigy and Mbox units
- CVE-2024-50302 (CVSS rating: 5.5) – A use of an uninitialized useful resource vulnerability that might be used to leak kernel reminiscence
“The exploit, which focused Linux kernel USB drivers, enabled Cellebrite prospects with bodily entry to a locked Android system to bypass an Android telephone’s lock display and achieve privileged entry on the system,” Amnesty mentioned.
“This case highlights how real-world attackers are exploiting Android’s USB assault floor, making the most of the broad vary of legacy USB kernel drivers supported within the Linux kernel.”
The activist, who has been given the title “Vedran” to guard their privateness, was taken to a police station and his telephone confiscated on December 25, 2024, after he attended a scholar protest in Belgrade.
Amnesty’s evaluation discovered that the exploit was used to unlock his Samsung Galaxy A32 and that the authorities tried to put in an unknown Android software. Whereas the precise nature of the Android app stays unclear, the modus operandi is in keeping with that of prior NoviSpy spy ware infections reported in mid-December 2024.
Earlier this week, Cellebrite mentioned its instruments are usually not designed to facilitate any kind of offensive cyber exercise and that it really works actively to curtail the misuse of its expertise.
The Israeli firm additionally mentioned it should now not enable Serbia to make use of its software program, stating “we discovered it applicable to cease the usage of our merchandise by the related prospects at the moment.”