Backdoor found in Samsung Galaxy Devices, allows Hackers to remotely access/modify Data

<script async src="//pagead2.googlesyndication.com/pagead/js/adsbygoogle.js"></script><br /><!-- Samuel Kibet --><br /><ins class="adsbygoogle" style="display:block" data-ad-client="ca-pub-7318175651372377" data-ad-slot="7296074448" data-ad-format="auto"></ins><br /><script>(adsbygoogle = window.adsbygoogle || []).push({}); </script><br /><script> (function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){ (i[r].q=i[r].q||[]).push(arguments)},i[r].l=1*new Date();a=s.createElement(o), m=s.getElementsByTagName(o)[0];a.async=1;a.src=g;m.parentNode.insertBefore(a,m) })(window,document,'script','//www.google-analytics.com/analytics.js','ga'); ga('create', 'UA-49093820-1', 'ulemsee.blogspot.com'); ga('send', 'pageview'); </script> <div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH2-LAQ5y-W9bUf4wgvHElTKh45amNp2CgIp-hF9XtGU_wD2zll6TvUzj_uUd9KE0m4WqFOONv78eLvsHAbgw-pk5FWv7DtXbHjgJ3YI7N9irjtdM_6AofQLuB_Vp_TwJftaM8VpYUZTYF/s1600/samsung-galaxy-note-2-hands-on-01.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="240" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH2-LAQ5y-W9bUf4wgvHElTKh45amNp2CgIp-hF9XtGU_wD2zll6TvUzj_uUd9KE0m4WqFOONv78eLvsHAbgw-pk5FWv7DtXbHjgJ3YI7N9irjtdM_6AofQLuB_Vp_TwJftaM8VpYUZTYF/s1600/samsung-galaxy-note-2-hands-on-01.jpg" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH2-LAQ5y-W9bUf4wgvHElTKh45amNp2CgIp-hF9XtGU_wD2zll6TvUzj_uUd9KE0m4WqFOONv78eLvsHAbgw-pk5FWv7DtXbHjgJ3YI7N9irjtdM_6AofQLuB_Vp_TwJftaM8VpYUZTYF/s1600/samsung-galaxy-note-2-hands-on-01.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><br /></a></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"> </span></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;">Google’s Android operating system may be open source, but the version of Android that runs on most phones, tablets, and other devices includes proprietary, closed-source components.</span></div><span style="font-family: Arial,Helvetica,sans-serif;"> </span><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"><br /></span></div><span style="font-family: Arial,Helvetica,sans-serif;"> </span><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"> Phone makers, including Samsung ships its Smartphones with a modified version of Android, with some pre-installed proprietary software and because of lack in independent code review of those closed-source apps, it is complex to authenticate its integrity and to identify the existence of <span class="GINGER_SOFTWARE_mark" id="d9c0c466-8d35-4757-b95f-977d01e01722">backdoors</span>.</span></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"> </span></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"><span class="main-article-info"><div style="text-align: justify;"><i>Paul Kocialkowski</i>, the developers of the <b>Replicant OS</b> has uncovered a backdoor pre-installed on Samsung Galaxy devices and the Nexus S, that provides remote access to all the data in the device.</div></span></span><span style="font-family: Arial,Helvetica,sans-serif;"><b><span class="GINGER_SOFTWARE_mark" id="22761714-2480-45eb-b302-bbb4a85c6988"><span class="GINGER_SOFTWARE_mark" id="84dd394f-43fd-4206-a185-5761ce2f9cda"> </span></span></b></span></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"><b><span class="GINGER_SOFTWARE_mark" id="22761714-2480-45eb-b302-bbb4a85c6988"><span class="GINGER_SOFTWARE_mark" id="84dd394f-43fd-4206-a185-5761ce2f9cda">"Replicant</span></span> OS</b> is an open source operating system based on the Android mobile platform, which aims to replace all proprietary Android components with their free software counterparts.<span class="main-article-info"></span><b>"</b></span></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"><br /></span></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"><span class="main-article-info"><div style="text-align: justify;">In a <a href="http://www.fsf.org/blogs/community/replicant-developers-find-and-close-samsung-galaxy-backdoor" rel="nofollow" target="_blank">blog post</a>, He explained that Samrtphones come with two separate processors, one for general-purpose applications processor that runs Android OS and the other one known as the <b>Modem</b>, responsible for communications with the mobile telephony network.</div><div style="text-align: justify;"></div><div style="text-align: justify;">The Researcher found that a <b>Samsung's IPC protocol</b> runs in the background, which is bound to the communications processor, and allows the modem to remotely read, write, and delete files on the user's phone storage. Samsung IPC protocol, implements a class of requests, known as <b>RFS commands</b>, that allows the modem to perform remote I/O operations on the phone’s storage.</div></span></span><span style="font-family: Arial,Helvetica,sans-serif;"><i> </i></span></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"><i>"The spying can involve activating the device's microphone, but it could also use the precise GPS location of the device and access the camera, as well as the user data stored on the phone. Moreover, modems are connected most of the time to the operator's network, making the backdoor nearly always accessible."</i><span class="main-article-info"><div style="text-align: justify;"> </div><div style="text-align: justify;">This backdoor might have been placed there accidentally, but remote ability of modifications to the user’s personal data without user knowledge poses a serious threat.</div></span></span><span style="font-family: Arial,Helvetica,sans-serif;"><i> </i></span></div><div style="text-align: justify;"><span style="font-family: Arial,Helvetica,sans-serif;"><i>"It is possible to build a device that isolates the modem from the rest of the phone, so it can't mess with the main processor or access other components such as the camera or the GPS."</i><span class="main-article-info"> <div style="text-align: justify;"><i>"The incriminated RFS messages of the Samsung IPC protocol were not found to have any particular legitimacy nor relevant use-case. However, it is possible that these were added for legitimate purposes, without the intent of doing harm by providing a backdoor." </i>he said.</div><div style="text-align: justify;"></div><div style="text-align: justify;"><i>"However, some RFS messages of the Samsung IPC protocol are legitimate (IPC_RFS_NV_READ_ITEM and IPC_RFS_NV_WRITE_ITEM) as they target a very precise file, known as the modem's NV data."</i> he added.</div><div style="text-align: justify;"><br />The researcher identified multiple Samsung devices affected by this vulnerability, including; <b><i>Nexus S, Galaxy S, Galaxy S2, Galaxy Note, Galaxy Tab 2, Galaxy S 3, and Galaxy Note 2</i></b>.</div><div style="text-align: justify;"> </div><div style="text-align: justify;"><span style="font-size: xx-small;">ref: fsf.org, hackernews.com</span></div><div style="text-align: justify;"> </div></span></span></div></div>

and Galaxy Note 2. Galaxy Note Galaxy S Galaxy S 3 Galaxy S2 Galaxy Tab 2 Nexus S Backdoor found in Samsung Galaxy Devices, allows Hackers to remotely access/modify Data

  Google’s Android operating system may be open source, but the version of Android that runs on most phones, tablets, and other devices i...

Plus d'infos »