A series of vulnerabilities found in Samsung devices allow cybercriminals to take control of a smartphone and spy on its owner.
Cybersecurity has been a hot topic in recent months, and not for exactly happy reasons. If last Wednesday was known in some countries the cyberattack against the Ministry of Labor, now we know a serious case of the security hole in one of the most used mobile brands in some countries: Samsung and its Galaxy devices.
Sergey Toshin, the founder of Oversecured, one of the reference companies focused on mobile application security, explains that a series of vulnerabilities have been discovered in Galaxy phones through the company’s pre-installed applications, which would give open access to cybercriminals from spying on their owners to taking control of these devices completely.
Specifically, Toshin explains that he has discovered it through the preinstalled applications of the Samsung Galaxy, and in total has been brought to light up to 17 security flaws that at this time the Korean firm has not yet completely solved as there are still 3 to be resolved.
Toshin, a specialist in detecting Android vulnerabilities, has been gathering information about security problems in Samsung phones since the beginning of this year. He did not want to give too many details about the cybersecurity implications of several of these vulnerabilities to avoid major problems, but he assures that, at the very least, attackers would be able to steal the victim’s SMS messages or take control of the cell phone.
Such is the severity of these flaws that in some cases the owner of the phone may suffer a cyberattack that does not require any deception or action on their part. Using these issues, the attacker could gain administrator permissions on the device and gain full access to the Android system on Galaxy phones.
Toshin analyzed the pre-installed apps on Samsung phones to dig deeper into these issues using his software capable of analyzing Android apps. He discovered that by exploiting these flaws, he was able to access system-wide administrator permissions via a simple tertiary app. If that wasn’t enough, these exploits caused an unexpected side effect: all other apps on the phone were wiped, as we see in this video.
Even the settings application suffered from a vulnerability; exploiting its security flaw, it allowed access to read and write system files to other files, again, with administrator privileges. Other issues found related to how a hacker could have accessed contact information, the SD card and caused leakage of private information such as phone number or email address.
From Samsung alone, Toshin raised nearly $30,000 since the beginning of the year for disclosing 14 issues. The other three vulnerabilities are currently waiting to be repaired, a process could take months, as Samsung must verify that a new firmware update does not cause new vulnerabilities or serious flaws in the Android system of the Samsung Galaxy.
From Samsung, users are advised to always apply the latest firmware updates from the manufacturer to avoid potential security risks. Although there are still three bugs whose scope is unknown and have not been resolved, as Toshin stresses.
Toshin, based in Moscow, is one of the eminences when it comes to detecting mobile vulnerabilities. During his career, he has reported more than 550 security holes that have earned him more than $1 million in rewards from companies.
