#Oma client provisioning android

LG released their fix in July (LVE-SMP-190006). Samsung included a fix addressing this phishing flow in their Security Maintenance Release for May (SVE-2019-14073). We disclosed our findings to the affected vendors in March. Samsung phones compound this by allowing unauthenticated OMA CP messages as well.

#Oma client provisioning android

We found that phones manufactured by Samsung, Huawei, LG and Sony (corresponding to over 50% of all Android phones, according to market share data from 2018: ) allow users to receive malicious settings via such weakly-authenticated provisioning messages. The industry standard for OTA provisioning, Open Mobile Alliance Client Provisioning (OMA CP), includes rather limited authentication methods a recipient cannot verify whether the suggested settings originate from his network operator or from an imposter. However, as we show, anyone can send OTA provisioning messages.

This attack vector relies on a process called over-the-air (OTA) provisioning, which is normally used by cellular network operators to deploy network-specific settings to a new phone joining their network.

In these attacks, a remote agent can trick users into accepting new phone settings that, for example, route all their Internet traffic through a proxy controlled by the attacker. Research By: Artyom Skrobov, Slava Makkaveev IntroductionД¬heck Point Researchers have identified a susceptibility to advanced phishing attacks in certain modern Android-based phones, including models by Samsung, Huawei, LG and Sony. Advanced SMS Phishing Attacks Against Modern Android-based Smartphones