Android devices contains an OS feature called full-disk encryption (FDE) that aims to increase the overall security of specific hardware. This Android encryption is applied to the entire hard disk on which it resides.

However, a security researcher just figured out a way to extract the key to that encryption from the Qualcomm chips that store it. Gal Beniamini, the Israeli security researcher in question, discussed the vulnerability on his blog, Bits, Please! His research found that a TrustZone kernel vulnerability can be both breached and manipulated on Qualcomm’s chip.

A Nagging Problem

According to Ars Technica, an estimated 37 percent of all Android devices are directly vulnerable because they have yet to apply recent patches that would mitigate the attack. The lack of over-the-air updates and carrier or manufacturer support may be to blame here.

Beniamini told Google about the situation before he posted his blog — in fact, Google already paid him for the exploit discovery through the company’s bug bounty program.

Android has historically been a latecomer to FDE and all its technicalities. Apple handled it well for iOS devices, and its approach is generally considered to be far more robust.

Bigger Implications for Android Encryption

Dan Guido, co-founder and CEO of Trail of Bits, told Ars Technica that he is also more broadly concerned about what the exploit revealed about Android. “What it means is that now you trust a second party, you trust somebody who built the software that holds the key,” he said.

“Maybe people didn’t realize that before, that it’s not just Google that can mess around with the software on your phone, but it’s also [Google partners], and it’s in a very significant way.”

He added that the FDE methods used by Android and iOS are “completely different,” with iOS considered a much more secure option. That’s a pretty clear-cut file system choice.

Apple plans to make its phones even more secure than they have been. The company is so sure that its hardening will work that the iOS kernel was intentionally left unencrypted in the upcoming full release of iOS 10, TechCrunch confirmed. That is stunning and unprecedented — and a sign that Android encryption still has a long way to go.