Android Full Disk Encryption flaw could affect millions of phones

His blog post also highlights how in Apple’s case it is nearly impossible to apply brute force to crack this disk level encryption.  The Israeli researcher has explained how it is possible to extract the security crypto keys for the Qualcomm Android devices, thus compromising their security.

[related-post]

The privacy flaw has also caught the attention of Qualcomm which issued a statement in this regard stating, they are working with “Gal Beniamini to identify and address potential security vulnerabilities,” and they had discovered the patches internally as well. Google said it has rolled out updates for some of the flaws mentioned in the blogpost.

According to Beniamini’s post, while Apple binds the encryption key to device’s hardware making it impossible for brute-force attackers to break the FDE, in Android devices the cryptographic keys are run in a separate module called Trusted Execution Environment (TEE).

The post describes that in any Android 5.0 or later device using the full disk encryption is vulnerable to kernel flaws and Qualcomm’s security measures, which can enable a hacker to get the encryption key.