Flaw gives backdoor access to some Samsung Galaxy devices
Software on with some Samsung mobile devices allows access to the file system through the modem, Replicant developers say
IDG News Service - The developers of Replicant, a mobile OS based on Android, claim to have found a backdoor vulnerability in a software component shipped with some Samsung Galaxy devices that potentially provides remote access to users' private files through the device modem.
The problem is located in the proprietary library that handles communications between the Android OS and the firmware running on the modem chipset, also known as the baseband or radio processor.
"This program is shipped with the Samsung Galaxy devices and makes it possible for the modem to read, write, and delete files on the phone's storage," said Replicant developer Paul Kocialkowski Wednesday in a blog post on the website of the Free Software Foundation. "On several phone models, this program runs with sufficient rights to access and modify the user's personal data."
According to a more detailed analysis of the issue on the Replicant wiki site, a proprietary Samsung library called libsec-ril.so that uses the Samsung IPC protocol to communicate with the modem, implements a series of commands that allow the modem to perform operations on the file system.
The program automatically appends a specific path to the commands, probably in an attempt to restrict the file operations to a certain area of the file system, but according to the Replicant developers, escaping the appended path is fairly easy.
Which files can be accessed depends on the privileges of the user account under which the software component runs, according to the Replicant developers. On some devices that account is root -- the highest privileged account -- giving the modem access to the entire file system.
"In other cases, it runs as an unprivileged user that can still access the user's personal data (/sdcard)," the developers said. "Finally, some devices may implement SELinux, which considerably restricts the scope of possible files that the modem can access, including the user's personal data (/sdcard/)."
The devices identified so far by the Replicant developers as being affected are Nexus S (I902x), Galaxy S (I9000), Galaxy S2 (I9100), Galaxy Note (N7000), Galaxy Nexus (I9250), Galaxy Tab 2 7.0 (P31xx), Galaxy Tab 2 10.1 (P51xx), Galaxy S3 (I9300) and Galaxy Note 2 (N7100). However, others might also use the vulnerable component.
The Replicant developers were not specific about how this backdoor can be remotely exploited, but noted that in general, baseband firmware can have vulnerabilities and can provide access to other hardware components, including the applications processor used by the main operating system -- in this case Android. Other security researchers have also warned in the past that potential baseband vulnerabilities can undermine the application-layer security features of the OS.
- Fight Malware, Malfeasance and Malingering Every year brings more extreme sets of threats than the last. The good news is that there are a range of mitigation options....
- Comprehensive Advanced Threat Defense The hot topic in the information security industry these days is "Advanced Threat Defense" (ATD). This paper describes a comprehensive, network-based approach to...
- Advanced Threat Defense: A Comprehensive Approach In this interview, Peter George, president, General Dynamics Fidelis Cybersecurity Solutions, explains why we need more than anti-malware, and what constitutes a comprehensive...
- Who's Spying on You? You're aware of the threats of malware to your business but what about the ever-changing ground rules? Cybercriminals today are launching attacks against...
- NSS Labs & Cisco Present: Evaluating Leading Breach Detection Systems Today's constantly evolving advanced malware and APTs can evade point-in-time defenses to penetrate networks. Security professionals must evolve their strategy in lockstep to...
- Will the Real Endpoint Threat Detection and Response Please Stand Up? This webinar explores new technologies & process for protecting endpoints from advanced attackers as well as the innovations that are pushing the envelope... All Malware and Vulnerabilities White Papers | Webcasts