Researcher uses exploits to extract disk encryption keys from Android devices with Qualcomm chips; publicly-available attack code works on unpatched devices
Unlike Apple's iOS, Android is vulnerable to several key-extraction techniques. — Privacy advocates take note …
Context & Ripple Effects
This 2016 disclosure put a working key-extraction attack into the wild for Android devices built on Qualcomm silicon, exploiting the gap between disk encryption as designed and the chip-level code that guards it. Ars framed it against Apple's iOS, which was not vulnerable to these techniques at the time — making Qualcomm's chips the weak link in the Android security story.
The arc that followed confirms the finding was structural rather than one-off: Qualcomm went on to patch a critical flaw across 46 of its chipsets that could leak private data and encryption keys, researchers later pulled a master update-signing key from Intel CPUs in Intel's Goldmont architecture, and the same Qualcomm/MediaTek Android stack resurfaced in the 2022 ALAC codec RCE disclosures. Silicon-adjacent key material keeps proving to be extractable.
First-order effects
- Owners of unpatched Android devices with Qualcomm chips face live risk: the attack code is publicly available, so any attacker can extract disk encryption keys without waiting on a vendor fix.
- Google and its OEM partners are immediately on the hook to distribute patches through carrier-slowed Android update channels, where most affected devices sit.
Second-order effects
- Apple gains a concrete security differentiator it can point to against Android, since the article notes iOS was not exposed to these key-extraction techniques.
- Qualcomm's chipset customers — Samsung, LG, Motorola and other Android OEMs — inherit the reputational cost, pressuring them to demand faster firmware patching and better-isolated key storage from their silicon supplier.
Third-order effects
- If the pattern holds — Qualcomm's 46-chipset patch, Intel's extracted update key, the codec bugs — the industry shifts toward treating on-chip key protection as a first-class attack surface, with hardware roots of trust audited as aggressively as OS software.
- Encryption-on-by-default only holds if the keys stay put; repeated extraction attacks push regulators and enterprise buyers to weigh chip provenance and patch cadence, not just the presence of encryption, when assessing platform security.
The trend: Platform security is migrating below the operating system: as disk encryption becomes standard, the decisive battleground is whether the silicon holding the keys can keep them.