CVE-2019-2234 vulnerabilities in Android Camera Apps

Attackers could exploit them to conduct several activities, including recording videos, taking photos, recording voice calls, tracking the user’s location.

The experts developed a PoC weather application, without specific permissions, that established a persistent connection with the attacker’s command-and-control (C&C) server that was able to siphon any kind of data from the target phone, even when the rogue app was closed.

The operator of the C&C console can see which devices are connected to it, and perform the following actions (among others):

• Take a photo on the victim’s phone and upload (retrieve) it to the C&C server
• Record a video on the victim’s phone and upload (retrieve) it to the C&C server
• Parse all of the latest photos for GPS tags and locate the phone on a global map
• Operate in stealth mode whereby the phone is silenced while taking photos and recording videos
• Wait for a voice call and automatically record:
  • Video from the victim’s side
  • Audio from both sides of the conversation

Patch and resolution