azrienoch · Nov 15, 2011 at 12:00 am

Location Security Exploit on Samsung Devices

XDA Recognized Developer pedrodh recently identified an exploit in Samsung devices running AccuWeather, and developed an app for demonstration.  The app can poll your location without granting any permissions–not even Superuser permissions–using two lines of code.

As a system app, AccuWeather is automatically granted access to your GPS settings.  There are two ways to avoid giving away your location.  Under the AccuWeather settings you can set your location manually.  The developer recommends some remote village in China.  Unless, of course, you live in a remote Chinese village.  The second way is to gain root access to your Samsung device and remove the widget entirely.

The developer provides those two lines of code if you want to create your own app, or you can use his.  Hopefully this demonstration is enough to alert less enthusiastic Samsung users to where they are vulnerable.

Originally posted by pedrodh
The problem is even more serious than I first though, because you only need to have the widget on the launcher once, and that info will remain in the system informations when you remote it from the launcher, even across reboots or even if you clear the widget’s data and cache (pretty scary :S). Sometimes (I don’t know why exactly yet) the info goes away for good, but only if you don’t have this widget on your launcher!

Please see the development thread for more information.


_________
Want something on the XDA Portal? Send us a tip!

azrienoch

azrienoch is an editor on XDA-Developers, the largest community for Android users. View azrienoch's posts and articles here.
Jimmy McGee · May 27, 2015 at 06:00 am · 2 comments

Vinsic Doosl FM Transmitter Review – Accessory Review

A lot of vehicles come with stereos featuring Bluetooth connectivity. This allows you to play music from your mobile device in your car. Recently, XDA TV Producer TK reviewed a Bluetooth adapter that plugged into your car's AUX input and connected to your phone with Bluetooth. However, that it not the only option if your car doesn't support Bluetooth. In this episode of XDA TV, Producer rirozizo reviews the Vinsic Doosl Fm Transmitter. This device connects to your headphone jack...

XDA NEWS
Mario Tomás Serrafero · May 26, 2015 at 05:42 pm · 2 comments

Nexus & Cookies: A More Focused Direction?

It is that time of the year again, and we are approaching the day where Android fans all over the world gather to watch the livestream of Google’s I/O conference. Among the expected announcements lay wearables, Android Auto, hints at VR and  the Internet of Things and, of course, a new version of Android. An early glimpse of a supposed “Android M” was caught on the official website before being nuked out of existence, and thus the speculation began.  ...

XDA NEWS
Faiz Malkani · May 26, 2015 at 03:32 pm · 3 comments

LG G4 US Carrier Release Dates

The LG G4 was announced on April 29th with its Snapdragon 808 SoC, a welcomed change from its higher-end cousin, the overheating 810. Packing 3GB of RAM, 32GB of storage, a 3000mAh battery, and an impressive 16MP camera, the G4 is widely considered to be one of the best flagships of 2015. After almost a month of release speculation, the major US carriers have finally released some information regarding the device's availability, and here's what we know so far:  ...

XDA NEWS
Share This