Feeds

Backdoor snoops can access files on your Samsung phone via the cell network – claim

Android-replacement Replicant team discovers odd data API

Beginner's guide to SSL certificates

Updated The developers of Replicant, a pure free-software version of Android, claim to have discovered a security hole in certain Samsung Galaxy phones and tablets – one so serious that it could potentially grant an attacker remote access to the device's file system.

Among the devices said to be vulnerable are the Nexus S, Galaxy S, Galaxy S 2, Galaxy Note, Galaxy Nexus, Galaxy Tab 2, Galaxy SIII, and Galaxy Note 2 – and there may be others.

The flaw lies in the software that enables communication between the Android OS and the device's radio modem, according to the Replicant project's Paul Kocialkowski.

"This program is shipped with the Samsung Galaxy devices and makes it possible for the modem to read, write and delete files on the phone's storage," Kocialkowski wrote in a guest post to a Free Software Foundation blog. "On several phone models, this program runs with sufficient rights to access and modify the user's personal data."

Like most smartphone vendors, Samsung ships its mobes with a preinstalled version of Android that's a mix of open source and proprietary software. Generally speaking, any code that directly interfaces with the hardware is proprietary – and that includes the modem.

In the case of Galaxy devices, Android's Radio Interface Layer (RIL) communicates with the modem using a Samsung-specific protocol. According to the Replicant website, that protocol includes support for a complete set of commands for performing read/write operations on the phone's internal file system.

That's troubling, Kocialkowski says, because the modem is powered by a separate microprocessor from the CPU that runs the rest of the phone's functions. And because this processor runs a proprietary operating system – like virtually all phone modems do – it's not readily apparent what it's capable of doing.

If the modem can be controlled remotely over the cell network – which Kocialkowski believes is not just possible but likely – then it can potentially be made to issue file system commands that leak, overwrite, corrupt, or otherwise compromise the handset's data.

"It is possible to build a device that isolates the modem from the rest of the phone, so it can't mess with the main processor or access other components such as the camera or the GPS," Kocialkowski says. "Very few devices offer such guarantees. In most devices, for all we know, the modem may have total control over the applications processor and the system, but that's nothing new."

The solution, Kocialkowski says, is to replace the device's stock Android firmware with a purely free-software OS, such as Replicant. In the course of building a version of Android that can run on existing phones without relying on any proprietary components, the Replicant project has had to write its own free replacement for Samsung's proprietary RIL.

"Our free replacement for that non-free program does not implement this back-door," Kocialkowski wrote. "If the modem asks to read or write files, Replicant does not cooperate with it."

He cautioned, however, that if the modem can potentially take full control of the device's main application processor, further remote exploits may still be possible, including ones that even an OS replacement like Replicant can't block. ®

Updated to add

It's a bit late, but Samsung did eventually respond to The Reg's request for comment on the matter with the following:

Samsung takes consumer privacy and security very seriously and we’d like to assure consumers that our products are safe to use. We are able to confirm that the matter reported by the Free Software Foundation is based on an incorrect understanding of the software feature that enables communication between the modem and the AP chipset.

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.