A vulnerability in Samsung’s Android keyboard installed on over 600m devices worldwide could allow hackers to take full control of the smartphone or tablet.
The security bug revolves around the update mechanism of the built-in keyboard, which looks for language updates for trending phrases either daily or weekly.
“The keyboard was signed with Samsung’s private signing key and runs in one of the most privileged contexts on the device, system user, which is a notch short of being root,” said researcher Ryan Welton from security company NowSecure who discovered the hole.
The problem was discovered last year. NowSecure told Samsung about the bug in December. Samsung asked NowSecure to keep the discovery under wraps until it could patch the problem. Google’s Android security team was also notified.
However, six months on it is unclear whether the patch is out. Samsung started that process in early 2015, but unlike Apple’s direct model of software updates, is beholden to mobile phone providers to push out updates to their users.
It is unclear whether that has happened and on what scale users have updated their devices.
Users stuck even if they install another keyboard
“Unfortunately, the flawed keyboard app can’t be uninstalled or disabled,” said Welton. “It isn’t easy for the Samsung mobile device user to tell if the carrier has patched the problem with a software update.”
The problem surrounds Samsung’s integration of Swiftkey’s underlying keyboard engine into its own keyboard software. Swiftkey essentially provides the brains for detecting what a user is trying to type and Samsung does the rest producing the completed keyboard and pre-installing it on its devices.
The Guardian understands that the fault lies within Samsung’s code. SwiftKey-based keyboards on other Android devices from other manufacturers, and SwiftKey’s apps from the Google Play Store or for the iPhone are unaffected.
If the Samsung Android device is connected to a malicious Wi-Fi network when the keyboard attempts to update its trending phrases and language pack, a hacker could substitute the update for a backdoor into the phone giving a hacker almost complete access to the phone.
According to NowSecure a hacker could remotely access a smartphone’s sensors, such as GPS, the camera or microphone, eavesdrop on calls or attack sensitive personal data.
“Unfortunately, we were only made aware of the issue on Tuesday,” said Joe Braid, chief marketing officer of SwiftKey. “We are working as hard as possible to support Samsung and help it fix the issue.”
Simply installing another third-party keyboard, including SwiftKey’s full keyboard does not fix the issue, as the Samsung keyboard continues to run in the background.
“There isn’t a whole lot you can do except try to steer clear of networks you don’t trust, where a crook might try to intercept and hack your traffic,” said Paul Ducklin from security company Sophos. “The silver lining, if that’s not too strong a way to describe it, is that a crook can’t exploit this hole just whenever he likes: you have to be on his dodgy network when a [keyboard] update happens, and he has to notice in time to jump in as a man-in-the-middle.”
The number of Samsung devices affected is extensive, but includes the latest Samsung Galaxy S models, including the Galaxy S6, S5 and S4.
A Samsung spokesperson told the Guardian: “Samsung takes emerging security threats very seriously. We are aware of the recent issue reported by several media outlets and are committed to providing the latest in mobile security.”
“It is important to note that the phone’s core functions (kernel) were not affected by the reported issue due to the protection of the Samsung Knox platform in all S4 models and above.”
“Samsung Knox also has the capability to update the security policy of the phones, over-the-air, to invalidate any remaining potential vulnerabilities caused by this issue. The security policy updates will begin rolling out in a few days.”
Comments (…)
Sign in or create your Guardian account to join the discussion