Backdoor in Samsung Galaxy devices discovered
Posted on 13 March 2014.
The developers of Replicant, a "fully free/libre version of Android", have discovered a backdoor in a number of Samsung Galaxy devices that could allow attackers to gain remote access to them and their contents.

"Today's phones come with two separate processors: one is a general-purpose applications processor that runs the main operating system, e.g. Android; the other, known as the modem, baseband, or radio, is in charge of communications with the mobile telephony network. This processor always runs a proprietary operating system, and these systems are known to have backdoors that make it possible to remotely convert the modem into a remote spying device," one of the developers explained in a post on the Free Software Foundation blog.

"The spying can involve activating the device's microphone, but it could also use the precise GPS location of the device and access the camera, as well as the user data stored on the phone. Moreover, modems are connected most of the time to the operator's network, making the backdoors nearly always accessible."

In their work, they analyzed this proprietary program shipped and running on Samsung devices, and they discovered that it allows the modem to read, write, and delete files on the phone's storage, and also to access and modify the user's personal data on several of the devices.

"Provided that the modem runs proprietary software and can be remotely controlled, that backdoor provides remote access to the phone's data, even in the case where the modem is isolated and cannot access the storage directly," Paul Kocialkowski pointed out.

But there is a solution for this problem: exchange this OS for a free one - Replicant, for example.

"If the modem asks to read or write files, Replicant does not cooperate with it," says Kocialkowski, but adds a caveat: "Replicant does not cooperate with backdoors, but if the modem can take control of the main processor and rewrite the software in the latter, there is no way for a main processor system such as Replicant to stop it. But at least we know we have closed one specific backdoor."

More technical details about the backdoor and a list of affected devices can be picked up here.


Critical bug found in Cisco ASA products, attackers are scanning for affected devices

Several Cisco ASA products - appliances, firewalls, switches, routers, and security modules - have been found sporting a flaw that can ultimately lead to remote code execution by attackers.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Fri, Feb 12th