Menu
Some Samsung Galaxy devices contain a file access backdoor, Replicant developers say

Some Samsung Galaxy devices contain a file access backdoor, Replicant developers say

A software program shipped with some Samsung mobile devices allows access to the file system through the modem, the developers said

The developers of Replicant, a mobile OS based on Android, claim to have found a backdoor vulnerability in a software component shipped with some Samsung Galaxy devices that potentially provides remote access to users' private files through the device modem.

The problem is located in the proprietary library that handles communications between the Android OS and the firmware running on the modem chipset, also known as the baseband or radio processor.

"This program is shipped with the Samsung Galaxy devices and makes it possible for the modem to read, write, and delete files on the phone's storage," said Replicant developer Paul Kocialkowski Wednesday in a blog post on the website of the Free Software Foundation. "On several phone models, this program runs with sufficient rights to access and modify the user's personal data."

According to a more detailed analysis of the issue on the Replicant wiki site, a proprietary Samsung library called libsec-ril.so that uses the Samsung IPC protocol to communicate with the modem, implements a series of commands that allow the modem to perform operations on the file system.

The program automatically appends a specific path to the commands, probably in an attempt to restrict the file operations to a certain area of the file system, but according to the Replicant developers, escaping the appended path is fairly easy.

Which files can be accessed depends on the privileges of the user account under which the software component runs, according to the Replicant developers. On some devices that account is root -- the highest privileged account -- giving the modem access to the entire file system.

"In other cases, it runs as an unprivileged user that can still access the user's personal data (/sdcard)," the developers said. "Finally, some devices may implement SELinux, which considerably restricts the scope of possible files that the modem can access, including the user's personal data (/sdcard/)."

The devices identified so far by the Replicant developers as being affected are Nexus S (I902x), Galaxy S (I9000), Galaxy S2 (I9100), Galaxy Note (N7000), Galaxy Nexus (I9250), Galaxy Tab 2 7.0 (P31xx), Galaxy Tab 2 10.1 (P51xx), Galaxy S3 (I9300) and Galaxy Note 2 (N7100). However, others might also use the vulnerable component.

The Replicant developers were not specific about how this backdoor can be remotely exploited, but noted that in general, baseband firmware can have vulnerabilities and can provide access to other hardware components, including the applications processor used by the main operating system -- in this case Android. Other security researchers have also warned in the past that potential baseband vulnerabilities can undermine the application-layer security features of the OS.

"It is possible to build a device that isolates the modem from the rest of the phone, so it can't mess with the main processor or access other components such as the camera or the GPS," Kocialkowski said. "Very few devices offer such guarantees. In most devices, for all we know, the modem may have total control over the applications processor and the system, but that's nothing new."

The goal of the Replicant project is to create an Android-based OS that doesn't contain any proprietary software components. This requires replacing components like libsec-ril.so with open-source and non-proprietary programs that implement the same functionality.

"Our free replacement for that non-free program does not implement this backdoor," Kocialkowski said. "If the modem asks to read or write files, Replicant does not cooperate with it."

However, not all baseband security risks can be mitigated in this manner and ultimately it depends on how the device is designed. "If the modem can take control of the main processor and rewrite the software in the latter, there is no way for a main processor system such as Replicant to stop it," Kocialkowski said.

Samsung Electronics did not immediately respond to a request for comment.

Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securitymobile securitysmartphonesSamsung ElectronicsFree Software FoundationAccess control and authenticationAndroidExploits / vulnerabilitiesprivacyAndroid OSconsumer electronics

Slideshows

Top 50 defining moments of the New Zealand channel in 2016

Top 50 defining moments of the New Zealand channel in 2016

Reseller News looks back on a tumultuous 12 months for the New Zealand channel, assessing the fallout from a year of sizeable industry change. Whether it be local or global mergers and acquisitions, distribution deals or job changes, the channel that started the year differs somewhat to the one set to finish it - Reseller News assesses the key moments that made 2016.​

Top 50 defining moments of the New Zealand channel in 2016
​Hewlett Packard Enterprise honours high achieving NZ channel

​Hewlett Packard Enterprise honours high achieving NZ channel

Hewlett Packard Enterprise honoured its top performing Kiwi partners at the second running of its HPE Partner Awards in New Zealand, held at a glitzy ceremony in Auckland. Recognising excellence across eight categories - from distributors to resellers - the tech giant celebrated its first year as a standalone company, following its official split from HP in 2015.

​Hewlett Packard Enterprise honours high achieving NZ channel
Nutanix treats channel partners to Christmas cruise

Nutanix treats channel partners to Christmas cruise

Nutanix recently took to the seas for a Christmas Cruise around Sydney Harbour with its Australia and New Zealand staff, customers and partners to celebrate a stellar year for the vendor. With the sun out, they were all smiles and mingled over drinks and food.

Nutanix treats channel partners to Christmas cruise
Show Comments