Any phone using Android 5.0 or later uses full disk encryption, the same security feature at the heart of Apple's recent fight with the FBI. Full disk encryption makes all data on a device unrecognizable without a unique key. Even though modern Android devices use this security feature, Beniamini's research found that an attacker can exploit kernel flaws and vulnerabilities in some of Qualcomm's security measures to get that encryption key. Then, all that stands between the hacker and a device's information is a password.
Since any attack on an Android device would still require brute force and additional hacking methods, this isn't an immediate security threat for a majority of users. Plus, in order for an attack to work in this case, device manufacturers themselves would have to directly modify the software, which is unlikely to happen. But, the vulnerability is notable for those who put their complete trust in full disk encryption.
We've reached out to Qualcomm for comment on the flaw and will update this story as the company responds.
Update: A Qualcomm spokesperson gave Engadget the following comment:
"Providing technologies that support robust security and privacy is a priority for Qualcomm Technologies, Inc. (QTI). QTI continues to work proactively both internally as well as with security researchers such as Gal Beniamini to identify and address potential security vulnerabilities. The two security vulnerabilities (CVE-2015-6639 and CVE-2016-2431) discussed in Beniamini's June 30 blog post were also discovered internally and patches were made available to our customers and partners. We have and will continue to work with Google and the Android ecosystem to help address security vulnerabilities and to recommend improvements to the Android ecosystem to enhance security overall."
Update 2: A Google spokesperson provided Engadget the following statement:
"We appreciate the researcher's findings and paid him for his work through our Vulnerability Rewards Program. We rolled out patches for these issues earlier this year."