<story><title>Private Key Extraction from Qualcomm Hardware-Backed Keystores</title><url>https://www.nccgroup.trust/us/our-research/private-key-extraction-qualcomm-keystore/?research=Technical+advisories</url></story><parent_chain></parent_chain><comment><author>AdmiralAsshat</author><text>&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.qualcomm.com&amp;#x2F;company&amp;#x2F;product-security&amp;#x2F;bulletins#_CVE-2018-11976&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.qualcomm.com&amp;#x2F;company&amp;#x2F;product-security&amp;#x2F;bulletins#...&lt;/a&gt;&lt;p&gt;That&amp;#x27;s pretty much all the snapdragons in modern Android phones (page is not letting me copy+paste them here).&lt;p&gt;Has QC put out a patch yet?&lt;p&gt;EDIT: The April security patch looks like it took care of it:&lt;p&gt;&lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;source.android.com&amp;#x2F;security&amp;#x2F;bulletin&amp;#x2F;2019-04-01&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;source.android.com&amp;#x2F;security&amp;#x2F;bulletin&amp;#x2F;2019-04-01&lt;/a&gt;&lt;p&gt;EDIT 2: And of course, my Samsung Galaxy S8+, despite having received an update &lt;i&gt;in April&lt;/i&gt;, is only at the March 1st security patch level. So I&amp;#x27;m likely vulnerable until Samsung&amp;#x27;s next update.</text></comment>
<story><title>Private Key Extraction from Qualcomm Hardware-Backed Keystores</title><url>https://www.nccgroup.trust/us/our-research/private-key-extraction-qualcomm-keystore/?research=Technical+advisories</url></story><parent_chain></parent_chain><comment><author>dlgeek</author><text>Not the best response from the vendor:&lt;p&gt;&amp;gt; March 19, 2018: Contact Qualcomm Product Security with issue; receive confirmation of receipt&lt;p&gt;&amp;gt; April, 2018: Request update on analysis of issue&lt;p&gt;&amp;gt; May, 2018: Qualcomm confirms the issue and begins working on a fix</text></comment>