Mobile Attack Taxonomy

Impact:

Remote code execution, call/SMS interception, location tracking

Examples:

• •Qualcomm CVE-2020-11292
• •MediaTek CVE-2021-0674
• •Shannon Baseband vulnerabilities

Impact:

Cryptographic key extraction, PIN/password recovery

Examples:

• •Cache timing attacks
• •Power analysis
• •Acoustic cryptanalysis

Impact:

Memory dumping, encryption key recovery, sensitive data theft

Examples:

• •FROST attack
• •RAM content recovery
• •Forensic memory acquisition

Impact:

Root/administrator access, security control bypass, malware persistence

Examples:

• •Dirty Cow (CVE-2016-5195)
• •iOS Jailbreak exploits
• •Android system service vulnerabilities

Impact:

Persistent malware installation, security bypass, device control

Examples:

• •Bootloader vulnerabilities
• •BootROM exploits (checkm8)
• •Custom ROM installation

Impact:

Cross-app data access, permission bypass, privacy violations

Examples:

• •iOS WebKit sandbox escapes
• •Android Binder vulnerabilities
• •Chrome renderer bypasses

Impact:

Data theft, credential harvesting, ad fraud, malware distribution

Examples:

• •Banking trojan repackaging
• •Game modifications with malware
• •Enterprise app certificate abuse

Impact:

JavaScript injection, same-origin policy bypass, data exfiltration

Examples:

• •addJavascriptInterface vulnerabilities
• •Universal XSS
• •Local file access

Impact:

Privacy violations, credential theft, intellectual property exposure

Examples:

• •Plaintext credential storage
• •Insecure HTTP transmissions
• •Excessive logging

Impact:

Data interception, credential theft, session hijacking

Examples:

• •Public Wi-Fi interception
• •SSL/TLS downgrade attacks
• •Proxy server exploitation

Impact:

Call/SMS interception, location tracking, downgrade attacks

Examples:

• •Stingray devices
• •2G/3G downgrade attacks
• •Silent SMS tracking

Impact:

SMS interception, call redirection, location tracking

Examples:

• •SMS interception for 2FA bypass
• •Call forwarding attacks
• •Location privacy violations

Impact:

Credential theft, account compromise, malware installation

Examples:

• •Banking credential phishing
• •COVID-19 smishing campaigns
• •Fake app installation prompts

Impact:

Phishing, malware distribution, payment fraud

Examples:

• •Malicious payment QR codes
• •QR codes leading to phishing sites
• •Automatic action QR codes

Impact:

Premium service subscription, malware installation, financial fraud

Examples:

• •Fake virus scanner ads
• •Browser lockscreen scams
• •Fake security warning notifications