Google Pixel phones sold with security vulnerability, report finds

Most Google Pixel phones sold since September 2017 included bundle that could beryllium utilized to surveil oregon remotely power users’ phones, according to a caller report from the cybersecurity institution iVerify.

The vulnerability was discovered aft iVerify’s endpoint detection and effect (EDR) scanner flagged an insecure Android instrumentality astatine Palantir Technologies, an iVerify client. After launching a associated investigation, iVerify, Palantir, and Trail of Bits discovered a hidden Android bundle bundle — Showcase.apk — crossed Google Pixel devices. The data-mining steadfast Palantir, which sells its surveillance products to governments and backstage companies, banned Android devices crossed the institution successful response.

“This was precise deleterious of trust, to person third-party, unvetted insecure bundle connected it,” Dane Stuckey, Palantir’s Chief Information Security Officer, told The Washington Post. “We person nary thought however it got there, truthful we made the determination to efficaciously prohibition Androids internally.”

According to iVerify’s report, the bundle was developed by a institution called Smith Micro Software and appears to person been created for Verizon for in-store demos. The app was inactive by default and had to beryllium manually enabled, the iVerify study found. “When enabled, Showcase.apk makes the operating strategy accessible to hackers and ripe for man-in-the-middle attacks, codification injection, and spyware,” the study reads. “The interaction of this vulnerability is important and could effect successful information nonaccomplishment breaches totaling billions of dollars.”

In a connection to the Post, Google spokesperson Ed Fernandez said the bundle was made “for Verizon in-store demo devices and is nary longer being used.” Google did not instantly respond to The Verge’s petition for comment.

iVerify told Google astir its study successful aboriginal May, according to Wired. The institution had not publically disclosed the vulnerability, nor has it released a bundle update to region the problem. Fernandez, the Google spokesperson, told Wired Android would region the app from each Pixel devices “in the coming weeks,” adding that Google hasn’t seen grounds of progressive exploitation of the software.

“It’s truly rather troubling. Pixels are meant to beryllium clean,” Stuckey, of Palantir, told the Post. “There is simply a clump of defence worldly built connected Pixel phones.”