“If you’re rocking a Samsung smartphone, you could be vulnerable to hackers, thanks to a preinstalled keyboard on your device,” Robert Nazarian reports for Digital Trends.
“The vulnerability was discovered by Ryan Welton from mobile security specialists NowSecure. The issue is with the preinstalled Swift keyboard which looks for language pack updates over an unencrypted line,” Nazarian reports. “Welton found that a hacker could create a spoof proxy server and send a fake update to the device with malicious code. The hacker could then exploit the device by eavesdropping on incoming and outgoing messages or voice calls, access personal data such as pictures or text messages, tamper with apps, and even install other malicious apps.”
“Users can’t simply uninstall the Swift app — one of the not so joyous benefits of carrier bloatware. Users are still vulnerable even when Swift isn’t set as the default keyboard,” Nazarian reports. “What’s even scarier about this vulnerability is it even affects the Galaxy S6, which was released in April. Welton detailed this security flaw earlier today at the Blackhat Security Summit in London. He stated that he was able to hack into a Galaxy S6 running on Verizon Wireless. ‘We can confirm that we have found the flaw still unpatched on the Galaxy S6 for the Verizon and Sprint networks, in off the shelf tests we did over the past couple of days,’ a NowSecure spokesperson confirmed… NowSecure recommends staying away from public Wi-Fi networks if you have one of these Samsung devices.”
Read more in the full article here.
MacDailyNews Take: Whenever Apple has an issue, they push the fix out to virtually all iPhone users. Samsung can do no such thing. Many of those who settle for Samsung’s iPhone also-rans are simply stuck with this massive security flaw until/unless they finally wise up and get a real iPhone.
[Thanks to MacDailyNews Reader “Bill” for the heads up.]
When these sort of reports come out, the thing that the majority of users do not understand is the severity of the exploit. Is physical contact with the device necessary? Does it require a user to be fooled into installing the exploit? This sounds like neither necessary for this Vulnerability. Apple isn’t perfect and has their fair share of exploits reported, but I can’t recall ever hearing about one that didn’t involve user interaction or physical contact with the device.
Is physical contact with the device necessary? Does it require a user to be fooled into installing the exploit?
RTF article and source references. That’s why links are provided to the articles.
Though Swype cannot be uninstalled can’t it simply be disabled via the App Manager which will stop the App and its services from running and also remove it from display in the app drawer?
Samdung smartphone, now that’s security through obscurity.
Samsung “S” is for Stupid. 😀
Good luck fixing 100 million of them. The other 500 million? Just look in the back room at your local Verizon peddler.
Further joyful news since the initial reports of this security hole: Samsung is going to offer a patch, they say, to stop this security hole. Except: Samsung isn’t sure that every phone will be ABLE to install the patch, whatever that means. They’re telling customers to contact their phone contract providers and have THEM deal with the patch.
Would Apple every shove off responsibility for a software patch to ANY of the phone contract providers? Of course not. ScamScum strikes again.
The weirdest thing I’ve seen is that many Android users in tech & medical companies use Samsung and are simply oblivious to security breaches announced at least monthly.
When I try to mention the latest security fault, they don’t want to hear about it.
Bo, there are critical medical devices that run on Windows. Not kidding. Many of them have been breached and required patches. Thankfully, hackers these days are more interested in making money off their hacks than actually killing people. That’s typically not very profitable, unless of course you’re a military contractor, DARPA, ad nauseam.
That’s a pretty big thing Samsung, and it’s HERE!
I saw a crawl on a news channel today. It was a quote from someone who advised, the best thing you can do with the phone is throw it in the trash 😉
WHO was the enlightened soul who dared say that?
Stockholm syndrome? Poor people. How many times to learn…
Thanks to MacDailyNews Reader…
ME actually, which is fairly common around here. I thankfully don’t care too much about credit or complements. But I do require respect. It’s disrespectful that MDN never, ever gives me credit. So boohoo to me. Raspberries to MDN.
[You’ll find that I posted about this Samsung security hole on page 2 comments under “Major zero-day security flaws in both iOS and OS X allow theft of Keychain, app passwords” earlier today. I think the problem is that I don’t deal with Neo-Con-Jobs and the incessant damage they’ve done to the USA, my country. Whereas MDN…. And no, I don’t have great respect for the opposite end of the 1 dimensional political spectrum either. We live in a 3D world. /rant]
Yes you have been johnny on the spot and laboured tirelessly to inform users with breaking news and links to suggested remedies, as well as providing avuncular lectures about user responsibilities. Such civic-minded busy work may even have pulled you away from your own life and mailbox.
No, not exactly. But I live my life learning and sharing with other people who enjoy learning and sharing.
Could the recent security breach of federal employee data have happened through a Samsung phone?
The problem with curry is that it is hot, and if there is too much of it, uncomfortable.
Perhaps MDN has had a bit too much of Derek Currie to truly care about what Derek Currie has to say? I mean, honestly Mr Currie, you’re not the only one that sends MDN interesting stuff.
If all you care about is ‘Thanks to MDN Reader Derek Currie’ then there, there it is. Now you’ve seen it. Now stop complaining.
Oh, and thank you.
More damn dung from Samsung™.