Ryan Welton from NowSecure detailed his findings at the Blackhat Security Summit in London. According to Welton the exploit arises out of the pre-installed SwiftKey keyboard. The Swiftkey updates its language packs as and when they become available. However, the updates are done over unencrypted lines and via plain text making it susceptible for hackers to introduce malicious content in the updates pack from any spoofed proxy server.
In his presentation, Welton said that a hacker could scale up the attack to basically take over a vulnerable mobile device while the user remains unaware. This SwiftKey bug affects over 600 million Samsung users, including those who are using the latest Samsung Galaxy S6.
According to Welton, once the flaw is exploited, a potential hacker can remotely eavesdrop on incoming and outgoing messages or voice calls. The hacker could also access GPS sensors, cameras, and microphones as well as install malicious apps without the user’s knowledge or consent. Welton says more savvy attackers could use the exploit to access sensitive files like photos and text messages on users Samsung device.
Welton says that he discovered the bug late last year and alerted Samsung and the Google’s Android security team. Samsung took corrective action and dispatched a patch to all the mobile networks but Welton says he is not sure if the carriers have passed the patch down to all their customers’ devices on the network. Also the fate of unlocked Samsung devices owners who rely on patches and updates directly from Samsung, is not known.
According to NowSecure, “We can confirm that we have found the flaw still unpatched on the Galaxy S6 for the Verizon and Sprint networks, in off the shelf tests we did over the past couple of days.”
Visit our website daily for latest tech news. Follow Us on Instagram for awesome tech stuff. Also, Join our Telegram Group and connect directly with Admin.
