Security News Critical MediaTek Vulnerability Lets Attackers Steal Android Phone PINs in 45 Seconds

[Parkinsond]

Content source

https://cybersecuritynews.com/mediatek-vulnerability-android-phone/

A critical vulnerability in the MediaTek Dimensity 7300 chipset allows a physical attacker to extract device PINs, decrypt on-device storage, and steal cryptocurrency wallet seed phrases in approximately 45 seconds, raising serious alarms for the roughly 25% of Android users whose devices rely on the affected chip.

Because Boot ROM is permanently hard-coded into the processor’s silicon, the core hardware flaw cannot be eliminated through software patches.

Critical MediaTek Vulnerability Lets Attackers Steal Android Phone PINs in 45 Seconds

A critical vulnerability in the MediaTek Dimensity 7300 chipset allows a physical attacker to extract device PINs, decrypt on-device storage, and steal cryptocurrency wallet seed phrases in approximately 45 seconds, raising serious alarms for the roughly 25% of Android users whose devices rely...

cybersecuritynews.com

 

[Divergent]

Executive Summary

Confirmed Facts
A critical physical vulnerability exists in the permanently hard-coded Boot ROM of the "MediaTek Dimensity 7300" (also known as "MT6878") chipset, allowing attackers to achieve arbitrary code execution at the highest privilege level (EL3) before the Android OS loads. By utilizing a USB connection and precisely timed Electromagnetic Fault Injection (EMFI) pulses during device boot cycles, attackers can extract device PINs, decrypt storage, and steal software cryptocurrency wallet seed phrases in approximately 45 seconds.

Assessment
Because this flaw is etched directly into the processor's silicon, standard software updates cannot entirely eliminate the vulnerability. This renders affected smartphones fundamentally unsuited for acting as secure vaults for highly sensitive data, such as unbacked digital assets.

Technical Analysis & Remediation

MITRE ATT&CK Mapping

T1462
(Abuse of Physical Access)

T1200
(Hardware Additions)

CVE Profile
[NVD Score: N/A - Hardware EMFI considered Out of Scope by Vendor]
[CISA KEV Status: Inactive]

Telemetry

Target Hardware
"MediaTek Dimensity 7300" / "MT6878"

Target Environment
"Trustonic Trusted Execution Environment (TEE)"

Test Case Device
"Nothing CMF Phone 1"

Constraint
Network IOCs, IPs, and payload hashes are completely absent. The structure indicates a purely localized attack relying on hardware corruption (EMFI) to force a logic bypass during initial cryptographic bootloader integrity checks.

Remediation - THE ENTERPRISE TRACK (NIST SP 800-61r3 / CSF 2.0)

GOVERN (GV) – Crisis Management & Oversight

Command
Conduct an immediate MDM hardware inventory to identify deployed corporate assets utilizing the MT6878 chipset (budget/mid-range devices from Motorola, Oppo, Vivo, Nothing, Tecno, Realme).

Command
Update Mobile Device Policies to explicitly forbid the storage of Tier 1 authentication seeds or sensitive cryptographic keys on affected mobile devices.

DETECT (DE) – Monitoring & Analysis

Command
Configure MDM solutions to alert on anomalous, rapid, and repetitive boot cycles, which suggests an ongoing EMFI fault-injection attempt.

RESPOND (RS) – Mitigation & Containment

Command
Initiate remote wipe protocols instantly upon the report of a lost or stolen device matching the vulnerable hardware profile.

RECOVER (RC) – Restoration & Trust

Command
Transition high-risk targets (executives, crypto-asset managers) to mobile devices equipped with unaffected silicon and dedicated secure enclaves.

IDENTIFY & PROTECT (ID/PR) – The Feedback Loop

Command
Deploy the January 2026 MediaTek software patch to all affected endpoints.

Note
This mitigates secondary software exploitation pathways but does not fix the underlying silicon flaw.

Remediation - THE HOME USER TRACK (Safety Focus)

Priority 1: Safety

Command
Maintain strict physical control of your device at all times. This attack cannot be performed remotely over the internet; the attacker must physically possess the phone and connect it via USB.

Command
Install the latest manufacturer security updates to ensure software-level mitigations are in place.

Priority 2: Identity

Command
Do not store cryptocurrency seed phrases, master passwords, or private keys in software wallets (e.g., Trust Wallet, Phantom) on affected devices.

Command
Migrate all critical digital assets to a dedicated, offline hardware wallet with certified physical security features.

Priority 3: Persistence

Command
If a device featuring the "MediaTek Dimensity 7300" is stolen, consider all local data (including PINs and biometric barriers) entirely compromised within 45 seconds. Reset all associated accounts from a known clean device immediately.

Hardening & References

Baseline
CIS Mobile Benchmarks (Ensure USB debugging is disabled and enforce aggressive auto-lock policies to minimize attack windows before a device is powered off).

Framework
NIST CSF 2.0 / SP 800-61r3.

Vendor Statement
MediaTek has publicly stated that EMFI hardware attacks are considered out of scope for the chipset's intended consumer use case.

Source

CyberSecurityNews