Will Verduzco · Mar 13, 2014 at 06:00 am

Replicant Devs Discover Backdoor in Samsung Android Devices

You may recall that about five months ago, we touched upon a study demonstrating how OEM modifications are the primary cause for most “Android” security issues. Unfortunately, we offer yet another example of OEM-caused security issues—but this time, it’s not because of an OEM skin or bloatware. Rather, this is a potential vulnerability at a far deeper level: proprietary modem software.

The OEM in question is none other than Samsung, the Android ecosystem’s largest and most successful device manufacturer, and the backdoor itself comes as proprietary radio software. This software is responsible for communicating with the modem hardware, and is capable of implementing RFS commands. These RFS commands are then able to perform I/O operations on the device’s storage.

No big deal, right? I’ll just load CyanogenMod and be done with it. Wrong.

Since the cause is a proprietary radio software, changing to an aftermarket ROM will not solve anything, so long as the ROM uses Samsung’s proprietary blobs. In fact, the Replicant team used Galaxy Note II and Galaxy S III devices running CM10.1 to demonstrate how this was ROM-agnostic.

Currently the list of known affected devices includes the Galaxy S, Galaxy S II, Galaxy Note, Galaxy Tab 2, Galaxy S III, and Galaxy Note II, but it’s highly likely that many other Samsung devices are vulnerable. Furthermore, this also seems to affect the Samsung-built Google Nexus S and Galaxy Nexus, as this is a back door at the radio software level, rather than as a part of an OEM skin. Whatsmore, on certain devices, this incriminated process runs as root.

While it is entirely possible that there is a legitimate reason for this backdoor, it’s hard to envision a scenario where one would be necessary. As such, it would be great to hear Samsung’s official statement on the matter. Until then, perhaps it would be a good idea to look into fully open source projects like Replicant, or at the very least, building an aftermarket kernel capable of blocking (and logging) RFS command requests.

You can learn more by heading over to the source link below.

[Source: Replicant Project | Thanks to Ruelle for the tip!]


_________
Want something on the XDA Portal? Send us a tip!

Will Verduzco

willverduzco is an editor on XDA-Developers, the largest community for Android users. Will Verduzco is the Portal Administrator for the XDA-Developers Portal. He has been addicted to mobile technology since the HTC Wizard. But starting with the Nexus One, his gadget love affair shifted to Google's little green robot. He is also a Johns Hopkins University graduate in neuroscience and is now currently studying to become a physician. View willverduzco's posts and articles here.
Aamir Siddiqui · Jul 28, 2015 at 12:56 pm · no comments

Galaxy Unpacked: What is Samsung Going to Unveil?

Amidst all the hype of the OnePlus 2 and the rain of Moto 2015 news, Samsung tried stealing the limelight back to itself by announcing their next "Galaxy Unpacked" event, which will be held on August 13th 2015. Samsung took to Twitter to reveal a very cryptic gif associated with the event, which probably has some clue on the device(s) to be launched. The hashtag "#TheNextGalaxy" does indeed point that the event will be the launchpad for a Galaxy device,...

XDA NEWS
Mario Tomás Serrafero · Jul 28, 2015 at 12:26 pm · 1 comment

Arrow Launcher: Good Effort Without Direction

Microsoft’s Android expansion has been well received on the productivity front, but not so much in terms of original applications. While their Office suite managed to bring some of the document-editing excellence to mobile, attempts at entering one’s interface through apps like Picturesque proved to be pointless failures. But even then, some apps like Hyperlapse redeem the computing giant through great quality. Microsoft seems to be approaching Android with brute, misdirected development and plenty of unorganized output, and if they want...

XDA NEWS
Mario Tomás Serrafero · Jul 28, 2015 at 10:07 am · 4 comments

Two New Moto X and New Moto G – Specs & Details

Today’s Moto event just ended and now we have a clear look at all of Motorola’s upcoming phones, including not one but two refreshed versions of their Moto X line. So how do these phones stack up against the competition? Motorola promises no compromises for affordable prices in every bracket, and this is what they have to offer:     Motorola wanted to focus on 5 aspects: meaningful exchanges, making and sharing memories, Self Expression, being always there for you...

XDA NEWS