Zero-Day Drama: Cellebrite’s Exploit Unleashes Chaos on Android Devices
A Serbian activist’s Android phone fell victim to a zero-day exploit by Cellebrite, targeting USB drivers. The vulnerability, CVE-2024-53104, was patched in the Linux kernel but not yet in Android. Amnesty International revealed authorities attempted to install unknown software, hinting at potential NoviSpy spyware attacks.
Hot Take:
In a plot twist that no one asked for, it turns out that Android phones are more like onions than you thought: layers of security peeled away by the mighty hands of Cellebrite’s zero-day exploit! Who knew “peeling an onion” involved USB drivers?
Key Points:
- A Serbian youth activist’s Android device was hacked using a zero-day exploit developed by Cellebrite.
- The exploit targeted CVE-2024-53104, a privilege escalation vulnerability in the Android USB driver.
- The exploit used two additional flaws, CVE-2024-53197 and CVE-2024-50302, not yet patched in Android.
- The activist’s phone was confiscated during a protest, and an unknown app was installed.
- Cellebrite halts use of its tools in Serbia following the incident.
Already a member? Log in here