A hidden hacker recently published on his Blogspot an article on how to hack BPhone. With some technical operations, the man can crack the anti-theft feature on newly launched BPhone models.

According to the hacker, the vulnerability was discovered four years ago but it still can be exploited. To prove his finding, the hacker described in detail the flaw that he discovered.

The man discovered that the security app has the function of sending requests to BKAV’s server to check the status of the device and lock the device if necessary.

According to the hacker, BPhone communicates with a server by sending SMS messages. This is why BPhones are introduced as having anti-theft function even when there is no internet connection.

Communications are conducted every time when BPhone owners turn on the phones or change SIM. A message with encrypted information such as Chip ID, IMEI, etc will be sent to one of the telephone numbers of BKAV.

BKAV’s server, after receiving information, will check if the owners of BPhones report the loss of their devices. If the loss is confirmed, a server will send an SMS message to conduct the operation to lock the devices.

The security hole of BKAV Mobile Security occurs because it doesn’t verify the name of senders. Regardless of the sender, the system will handle messages, no matter who the senders are, if the messages follow the syntax rule.

With some technical operations, the hacker found the message structure (encrypted) that the server sends to the phone.

The hacker said he found the fixed key that BKAV uses to encrypt and decrypt data.

Thanks to finding a security hole that doesn’t verify senders, and finding the fixed key, the hacker can forge SMS messages from the server to phones to unlock devices with any passcode. This is how the hacker neutralized BPhone’s anti-theft feature.

This is the second security accident related to BKAV over the last month. In December 2021, the technology firm ran into trouble when users’ information was leaked, affecting 200 users of BKAV’s products.

BKAV’s representative, who VietNamNet contacted, said the firm still has no official response about the case.

Meanwhile, some experts said that even when scammers fool BKAV Mobile Security with forged messages, they still won’t be able to use the devices. Once the phone has a connection, it will be automatically locked as it receives a command to lock the device sent from the server periodically.

Trong Dat

BKAV introduces low-cost Bphone A40, A50 and A60

The three products are priced between VND4.5 million and VND6.5 million, affordable for most consumers.