Follow Us

We use cookies to provide you with a better experience. If you continue to use this site, we'll assume you're happy with this. Alternatively, click here to find out how to manage these cookies

hide cookie message

Samsung promises fix for vulnerability in Android Galaxy devices

The vulnerability, which could allow access to the entire memory of a device, affects a range of Samsung devices

Article comments

Samsung is working on an update for a software flaw that could allow attackers to siphon personal data from some of its Galaxy series smartphones.

The vulnerability affects Samsung's Galaxy S II and S III phones and several models of its Galaxy line, including the Note, Note II, Note Plus and Note 10.1, all of which use the Korean company's Exynos 4210 and 4412 model processors.

The flaw and an exploit was disclosed on Sunday on XDA Developers, a forum for mobile developers. Samsung's engineers apparently made a poor configuration mistake involving the Android kernel and failed to restrict kernel address space mapped to userspace via the /dev/exynos-mem device driver.

An application incorporating the exploit was created by a developer nicknamed Chainfire on the forum.

Chainfire's application allows users to modify the phone to make the exploit ineffective, but the fix also disables a device's camera in some instances depending on the device's firmware version.

Chainfire warned that other application-based fixes that have been developed are seriously flawed, so users should not depend on those to provide protection until Samsung issues an update.

"The only true solution is a kernel fix that simply removes the exploitable memory device, but that requires a non-universal device update," Chainfire said.

Samsung played down the seriousness of the issue, saying that "the issue may arise only when a malicious application is operated on the affected devices; however, this does not affect most devices operating credible and authenticated applications."

Samsung's devices can be updated over the air by operators, or users can do it with a desktop computer using the company's Kies software, according to a spokesman.

Android applications submitted to Google's Play store are checked for malicious behaviour, but there are many websites around the internet offering Android applications, many of which purport to be a legitimate but are actually malicious software and could incorporate this exploit.

Since an exploit has been published, Trend Micro said on Wednesday that it is only a matter of time before hackers begin to use it. Samsung said it "will continue to closely monitor the situation until the software fix has been made available to all affected mobile devices." It did not specify when the fix would be available.



Share:

More from Techworld

More relevant IT news

Comments



Send to a friend

Email this article to a friend or colleague:

PLEASE NOTE: Your name is used only to let the recipient know who sent the story, and in case of transmission error. Both your name and the recipient's name and address will not be used for any other purpose.

Techworld White Papers

Choose – and Choose Wisely – the Right MSP for Your SMB

End users need a technology partner that provides transparency, enables productivity, delivers...

Download Whitepaper

10 Effective Habits of Indispensable IT Departments

It’s no secret that responsibilities are growing while budgets continue to shrink. Download this...

Download Whitepaper

Gartner Magic Quadrant for Enterprise Information Archiving

Enterprise information archiving is contributing to organisational needs for e-discovery and...

Download Whitepaper

Advancing the state of virtualised backups

Dell Software’s vRanger is a veteran of the virtualisation specific backup market. It was the...

Download Whitepaper

Techworld UK - Technology - Business

Innovation, productivity, agility and profit

Watch this on demand webinar which explores IT innovation, managed print services and business agility.

Techworld Mobile Site

Access Techworld's content on the move

Get the latest news, product reviews and downloads on your mobile device with Techworld's mobile site.

Find out more...

From Wow to How : Making mobile and cloud work for you

On demand Biztech Briefing - Learn how to effectively deliver mobile work styles and cloud services together.

Watch now...

Site Map

* *