Some Android smartphones have been found to contain a hidden security vulnerability that could allow remote access to user data, alarming cybersecurity experts and leading to a halt in the use of these devices by a major intelligence contractor, The Washington Post reports.
The vulnerability, identified by the security firm iVerify, involves a pre-installed application known as Showcase.apk, which, though dormant by default, can be activated to potentially allow unauthorized remote access to the devices. The Showcase.apk application was discovered within certain models of Android phones, including Google Pixel devices.
According to iVerify, the application appears to have been designed for use in retail environments, allowing employees to demonstrate the device’s features to customers. However, researchers found that when activated, the application could connect to a server via an unsecured “http” connection, making it vulnerable to interception by cybercriminals. This flaw could enable attackers to execute code remotely, potentially injecting malicious code or spyware and gaining access to sensitive data stored on the device.
Read more at MacRumors.com