SilentCircle, the maker of the ultra-secure Blackphone smartphone has said it has patched a hole that could potentially allow hackers to access information stored on the device.
US security firm SentinelOne discovered the vulnerability, which could potentially allow criminals to break into devices and take control of vital functions.
Silent Circle said in a statement: "Based on the research provided by SentinelOne it is safe to assume that any device using the Nvidia Icera modem would be vulnerable. Based on our knowledge we do not know of any other device that would be using this modem.
"Vulnerabilities are inevitable. It is how you react to those vulnerabilities that counts. How does Silent Circle react? We patch vulnerabilities and give credit where credit is due. Please ensure that your Blackphone is updated to version 1.1.13 RC3 or later."
The Blackphone claims to be the most secure smartphone in the world, by providing users with total control over the information shared with the outside world, including app permissions for the phone's self-branded software. These applications supposedly anonymise and encrypt communications so no one else can break into text, video or voice calls.
However, SentinelOne said a socket was left open, meaning hackers could easily break into these communications and even take over the phone if they wanted.
"There is almost no mention of this socket anywhere on the internet except for file_contexts used by SELinux on Android," Tim Strazzere, director of mobile research at SentinelOne wrote in a blog post. "It appeared to be for the Nvidia Shield tablet, which is the only other Android device that seems to be used in the wild with an Icera modem and has since been abandoned by Nvidia," he explained.
The flaw means that if a user decides they want to install a new app, they would normally be asked whether they are happy for it to access device controls, such as the ability to send and receive texts or other information. If someone doesn't want this to happen, they would normally opt not to install the app. However, the recently discovered vulnerability would not show this warning and a user would then install unknowingly.
Hackers could then run the system as a shell user and send commands to the radio or they could use another application with internet permissions to send commands to the radio.
