[lulagain]

Serbian authorities have reportedly used an Android zero-day exploit chain developed by Cellebrite to unlock the device of a student activist in the country and attempt to install spyware.

Cellebrite is an Israeli digital forensics company that develops tools used by law enforcement, intelligence agencies, and private companies to extract data from smartphones and other digital devices.

Companies like Cellebrite commonly utilize zero-day exploits to access and extract data usually protected on locked phones.

The use of this Android exploit was found by Amnesty International's Security Lab in mid-2024 during forensic research on the logs of the impacted device.

The organization previously reported on cases of privacy rights abuse in Serbia in December 2024. In response to the revelations, Cellebrite announced it blocked access to its tools for the country's security services (BIA) earlier this week.

After Amnesty shared its findings with Google's Threat Analysis Group (TAG), Google's researchers were able to pinpoint three vulnerabilities in the Linux kernel USB drivers, also used in Android, that were exploited as zero-days.

The three flaws are:

CVE-2024-53104 (USB Video Class exploit)

CVE-2024-53197 (ALSA USB-sound driver exploit)

CVE-2024-50302 (USB HID device exploit)

The first flaw was patched in Google's February 2025 Android security updates, marked as "under limited, targeted exploitation."

The other two flaws have not been announced as fixed in any Android security update bulletins yet, and depending on the device model and how often manufacturers update its kernel, it might take a while.

Head of Security Lab at Amnesty, Donncha O'Cearbhaill, told BleepingComputer that patching CVE-2024-53104 might be enough to disrupt the whole exploitation chain, although they cannot be certain about it yet.

GrapheneOS told BleepingComputer that their Android distribution already has patches for CVE-2024-53197 and CVE-2024-50302 because they regularly update the latest Linux kernel.

[johnwick9837]

thats really scary

This forum account is currently banned. Ban Length: (Permanent)
Ban Reason: Leeching | http://breached26tezcofqla4adzyn22notfqw...an-Appeals if you feel this is incorrect.

[Plantern]

Can they do that to iphones?

[RedBlock]

I bet all of the agencies are using 0days
earth is doomed

[lulagain]

I bet all of the agencies are using 0days
earth is doomed

yes we are cooookedddddddddddddd