Menu
Some Samsung Galaxy devices contain a file access backdoor, Replicant developers say

Some Samsung Galaxy devices contain a file access backdoor, Replicant developers say

A software program shipped with some Samsung mobile devices allows access to the file system through the modem, the developers said

The developers of Replicant, a mobile OS based on Android, claim to have found a backdoor vulnerability in a software component shipped with some Samsung Galaxy devices that potentially provides remote access to users' private files through the device modem.

The problem is located in the proprietary library that handles communications between the Android OS and the firmware running on the modem chipset, also known as the baseband or radio processor.

"This program is shipped with the Samsung Galaxy devices and makes it possible for the modem to read, write, and delete files on the phone's storage," said Replicant developer Paul Kocialkowski Wednesday in a blog post on the website of the Free Software Foundation. "On several phone models, this program runs with sufficient rights to access and modify the user's personal data."

According to a more detailed analysis of the issue on the Replicant wiki site, a proprietary Samsung library called libsec-ril.so that uses the Samsung IPC protocol to communicate with the modem, implements a series of commands that allow the modem to perform operations on the file system.

The program automatically appends a specific path to the commands, probably in an attempt to restrict the file operations to a certain area of the file system, but according to the Replicant developers, escaping the appended path is fairly easy.

Which files can be accessed depends on the privileges of the user account under which the software component runs, according to the Replicant developers. On some devices that account is root -- the highest privileged account -- giving the modem access to the entire file system.

"In other cases, it runs as an unprivileged user that can still access the user's personal data (/sdcard)," the developers said. "Finally, some devices may implement SELinux, which considerably restricts the scope of possible files that the modem can access, including the user's personal data (/sdcard/)."

The devices identified so far by the Replicant developers as being affected are Nexus S (I902x), Galaxy S (I9000), Galaxy S2 (I9100), Galaxy Note (N7000), Galaxy Nexus (I9250), Galaxy Tab 2 7.0 (P31xx), Galaxy Tab 2 10.1 (P51xx), Galaxy S3 (I9300) and Galaxy Note 2 (N7100). However, others might also use the vulnerable component.

The Replicant developers were not specific about how this backdoor can be remotely exploited, but noted that in general, baseband firmware can have vulnerabilities and can provide access to other hardware components, including the applications processor used by the main operating system -- in this case Android. Other security researchers have also warned in the past that potential baseband vulnerabilities can undermine the application-layer security features of the OS.

"It is possible to build a device that isolates the modem from the rest of the phone, so it can't mess with the main processor or access other components such as the camera or the GPS," Kocialkowski said. "Very few devices offer such guarantees. In most devices, for all we know, the modem may have total control over the applications processor and the system, but that's nothing new."

The goal of the Replicant project is to create an Android-based OS that doesn't contain any proprietary software components. This requires replacing components like libsec-ril.so with open-source and non-proprietary programs that implement the same functionality.

"Our free replacement for that non-free program does not implement this backdoor," Kocialkowski said. "If the modem asks to read or write files, Replicant does not cooperate with it."

However, not all baseband security risks can be mitigated in this manner and ultimately it depends on how the device is designed. "If the modem can take control of the main processor and rewrite the software in the latter, there is no way for a main processor system such as Replicant to stop it," Kocialkowski said.

Samsung Electronics did not immediately respond to a request for comment.


Follow Us

Join the New Zealand Reseller News newsletter!

Error: Please check your email address.

Tags securitymobile securitysmartphonesSamsung ElectronicsFree Software FoundationAccess control and authenticationAndroidExploits / vulnerabilitiesprivacyAndroid OSconsumer electronics

Featured

Slideshows

Kiwi channel comes together for another round of After Hours

Kiwi channel comes together for another round of After Hours

The channel came together for another round of After Hours, with a bumper crowd of distributors, vendors and partners descending on The Jefferson in Auckland. Photos by Maria Stefina.​

Kiwi channel comes together for another round of After Hours
Consegna comes to town with AWS cloud offerings launch in Auckland

Consegna comes to town with AWS cloud offerings launch in Auckland

Emerging start-up Consegna has officially launched its cloud offerings in the New Zealand market, through a kick-off event held at Seafarers Building in Auckland.​ Founded in June 2016, the Auckland-based business is backed by AWS and supported by a global team of cloud specialists, leveraging global managed services partnerships with Rackspace locally.

Consegna comes to town with AWS cloud offerings launch in Auckland
Veritas honours top performing trans-Tasman partners

Veritas honours top performing trans-Tasman partners

Veritas honoured its top performing partners across the channel in Australia and New Zealand, recognising innovation and excellence on both sides of the Tasman. Revealed under the Vivid lights in Sydney, Intalock claimed the coveted Partner of the Year 2017 (Pacific) award, with Data#3 acknowledged for 12 months of strong growth across the market. Meanwhile, Datacom took home the New Zealand honours, with Global Storage and Insentra winning service provider and consulting awards respectively. Dicker Data was recognised as the standout distributor of the year, while Hitachi Data Systems claimed the alliance partner award. Photos by Bob Seary.

Veritas honours top performing trans-Tasman partners
Show Comments