Newly Discovered Android Vulnerabilities Exploited in Student Phone Hack: What You Need to Know

Amnesty International has recently revealed that Google has addressed critical vulnerabilities in Android, which had previously allowed authorities to unlock devices using advanced forensic tools. This discovery emphasizes the ongoing battle for digital privacy and security, particularly for activists and journalists.

Details of the Vulnerabilities Discovered

On Friday, Amnesty International published a comprehensive report that highlighted a series of three zero-day vulnerabilities. These flaws, developed by the phone-unlocking company Cellebrite, were uncovered during an investigation into the hacking of a student protester’s phone in Serbia. According to the report, these vulnerabilities exist within the core Linux USB kernel, suggesting that the issue is not confined to a single device or manufacturer, potentially affecting over a billion Android devices.

Understanding Zero-Day Vulnerabilities

Zero-day vulnerabilities are critical bugs that remain unknown to the software or hardware developers at the time of discovery. They pose significant risks as they can be exploited by both criminal and government hackers, allowing unauthorized access to systems without any available fixes.

Investigation and Collaboration with Google

Amnesty International first detected traces of one vulnerability in mid-2024. Following a detailed investigation into the hacking incident involving a student activist in Serbia, the organization shared its findings with Google’s Threat Analysis Group. This collaboration led to the identification and subsequent patching of the three vulnerabilities by Google’s research team.

The Impact of These Vulnerabilities

During the investigation, Amnesty researchers discovered a USB exploit that enabled Serbian authorities to unlock the activist’s phone through Cellebrite tools. In a previous report from December, Amnesty highlighted instances where Serbian authorities had utilized Cellebrite forensic tools to unlock devices belonging to activists and journalists, subsequently installing spyware known as Novispy.

Cellebrite’s Response and Ethical Considerations

In response to the allegations, Cellebrite’s spokesperson, Victor Cooper, referred to a statement released earlier this week, affirming that the company had ceased its operations with the relevant Serbian customer following a thorough review of the claims made by Amnesty International. The statement read:

“After a review of the allegations brought forth by the December 2024 Amnesty International report, Cellebrite took precise steps to investigate each claim in accordance with our ethics and integrity policies. We found it appropriate to stop the use of our products by the relevant customers at this time.”

Continued Threats to Digital Privacy

Amnesty’s recent findings highlight the ongoing risks faced by activists and journalists. In January, the organization was contacted to analyze the device of a youth activist arrested by the Serbian Security Information Agency (BIA). The circumstances surrounding the arrest echoed previous documented abuses against protesters:

• Forensic analysis confirmed the use of Cellebrite on the activist’s phone.
• Authorities unlocked the activist’s Samsung A32 without consent or a legally sanctioned investigation.

Amnesty emphasized that such practices infringe upon fundamental human rights, stating, “The seemingly routine use of Cellebrite software against individuals exercising their rights to freedom of expression and peaceful assembly can never be a legitimate aim.”

Recommendations for Activists

Bill Marczak, a senior researcher at Citizen Lab, suggested that activists and journalists should consider switching to iPhones due to these vulnerabilities. This recommendation reflects a growing concern over the security of Android devices in the face of increasing state surveillance.

As Donncha Ó Cearbhaill, head of Amnesty’s Security Lab, remarked, “The far-reaching availability of such tools leaves me fearing that we are just scratching the surface of harms from these products.”

For further inquiries or information regarding government spyware and its manufacturers, you can reach out to Lorenzo Franceschi-Bicchierai securely on Signal or via Telegram.

Stay informed about the latest developments in digital privacy and security by visiting our privacy news section.