FallenWriter · Sep 30, 2012 at 05:00 am

What Can We Learn from the Galaxy S III NFC Hack?

NFC technology is poised to become the core of the mobile payment world. Nearly every cutting edge smartphone released in the next year will feature some form of NFC and mobile payments. Every major player from Verizon to Google, from MasterCard to American Express is in some way attempting to enter the market and gain a foothold in the thriving industry. Yet this is not without cost: Near-Field Communication technology is new and relatively untested. By linking it with our smartphones, a device we use for nearly every aspect of our lives, we’ve created the most potent bait an identify thief or malicious life hacker could desire.

Yet until recently, few cared to think about the malicious possibilities that NFC posed to the user. Just over a week ago at Mobile Pwn2Own, this changed when MWR Labs demonstrated that NFC users (and vendors) have a whole lot more to think about. While the exact details of the exploit are still withheld, using the Samsung Galaxy S3’s NFC chip, a file is downloaded and automatically opened. Next, the file was able to elevate its privileges and thereby gain control over every aspect of the device. As explained on the team’s blog:

The first vulnerability was a memory corruption that allowed us to gain limited control over the phone. We triggered this vulnerability 185 times in our exploit code in order to overcome some of the limitations placed on us by the vulnerability.

We used the second vulnerability to escalate our privileges on the device and undermine the application sandbox model. We used this to install a customised version of Mercury, our Android assessment framework. We could then use Mercury’s capabilities to exfiltrate user data from the device to a remote listener, including dumping SMS and contact databases, or initiating a call to a premium rate number.

While this type of attack may seem complicated and far fetched, the reality is that criminals will go to great lengths to formulate a method by which to steal your information and money. The more reliant on mobile technology we become, the more vigilant we must be in safeguarding our information. Having NFC enabled 24/7 is like having your credit card, phone number, address, name, and Social Security Number dangling from your belt loop. So while the exploit will undoubtedly be patched quickly, just remember: You never know who may be watching.


_________
Want something on the XDA Portal? Send us a tip!

FallenWriter

FallenWriter is an editor on XDA-Developers, the largest community for Android users. I am the Fallen Writer of XDA. I was a News Writer who was cast into exile for my sins. Now I have returned to haunt the forums of XDA with my writings.
Emil Kako · Mar 28, 2015 at 11:01 pm · 4 comments

Best Alarm App for Android?

There are tons of choices to choose from when looking for a great alarm app for Android. While the stock Clock app for AOSP does the job, it may lack some of the more advanced features from competitors. Let us know what your favorite alarm clock app is for Android and why.

DISCUSS
Chris Gilliam · Mar 28, 2015 at 12:45 pm · 1 comment

Pinsy Brings Social Sketching To Your Watch & Phone

Did you watch Apple's VP draw on his wrist during the Apple Watch announcement and wonder "why can't my Wear watch do that?" In typical XDA fashion, one enterprising forum member has brought similar functionality to Android Wear with a twist; it works on phones and watches alike, with other platforms on the way! The app is called Pinsy, and its release debut is a strong proof of concept with plenty of room to grow. You may remember the developer behind this project, XDA...

XDA NEWS
Mario Tomás Serrafero · Mar 27, 2015 at 04:13 pm · 2 comments

Should You Get Wear? Wearer’s Practical Observations

Wear is said to not offer enough for mass adoption, even though its been in the market for over 9 months. I personally have a Gear Live which I purchased 8 months ago, and my experience with it has had its ups and downs throughout my time with it. For the longest time, I was not able to recommend the platform to anyone. Since then, a lot of updates have hit Wear watches, some improving battery life, others changing the...

XDA NEWS
Share This