FallenWriter · Sep 30, 2012 at 05:00 am

What Can We Learn from the Galaxy S III NFC Hack?

NFC technology is poised to become the core of the mobile payment world. Nearly every cutting edge smartphone released in the next year will feature some form of NFC and mobile payments. Every major player from Verizon to Google, from MasterCard to American Express is in some way attempting to enter the market and gain a foothold in the thriving industry. Yet this is not without cost: Near-Field Communication technology is new and relatively untested. By linking it with our smartphones, a device we use for nearly every aspect of our lives, we’ve created the most potent bait an identify thief or malicious life hacker could desire.

Yet until recently, few cared to think about the malicious possibilities that NFC posed to the user. Just over a week ago at Mobile Pwn2Own, this changed when MWR Labs demonstrated that NFC users (and vendors) have a whole lot more to think about. While the exact details of the exploit are still withheld, using the Samsung Galaxy S3’s NFC chip, a file is downloaded and automatically opened. Next, the file was able to elevate its privileges and thereby gain control over every aspect of the device. As explained on the team’s blog:

The first vulnerability was a memory corruption that allowed us to gain limited control over the phone. We triggered this vulnerability 185 times in our exploit code in order to overcome some of the limitations placed on us by the vulnerability.

We used the second vulnerability to escalate our privileges on the device and undermine the application sandbox model. We used this to install a customised version of Mercury, our Android assessment framework. We could then use Mercury’s capabilities to exfiltrate user data from the device to a remote listener, including dumping SMS and contact databases, or initiating a call to a premium rate number.

While this type of attack may seem complicated and far fetched, the reality is that criminals will go to great lengths to formulate a method by which to steal your information and money. The more reliant on mobile technology we become, the more vigilant we must be in safeguarding our information. Having NFC enabled 24/7 is like having your credit card, phone number, address, name, and Social Security Number dangling from your belt loop. So while the exploit will undoubtedly be patched quickly, just remember: You never know who may be watching.


_________
Want something on the XDA Portal? Send us a tip!
Chris Gilliam · Mar 1, 2015 at 03:59 pm · no comments

Samsung Galaxy S6 Cameras

Each year, smartphone makers attempt to one-up each other in features and specs, but time and again these improvements feel incremental rather than revolutionary. Samsung hopes to break this trend with a new hardware and software design philosophy, and press details of the new-and-improved cameras shared by the S6 and S6 Edge show that they are off to a great start. Once you get past the curved displays and wraparound Gorilla Glass 4, the most striking feature on these slabs is the...

XDA NEWS
Mathew Brack · Mar 1, 2015 at 03:09 pm · no comments

The Battery Behind the Samsung S6 and S6 Edge

Samsung has stated that with the new S6 and S6 Edge you will "not have to worry about battery life again" with their new faster charging. Just ten minutes of charging will allow for four hours of basic usage and a fully charged device should last you for 13 hours of video viewing. During the unpacked event, Gregory Wade said, “we didn't want to have a built-in battery until we were absolutely sure users would be comfortable.” Well, it appears...

XDA NEWS
Mathew Brack · Mar 1, 2015 at 01:40 pm · 1 comment

Samsung S6 and S6 Edge Performance

Samsung has announced their two new flagships, the S6 and the S6 Edge. Both devices will run using Samsung's new 64 bit 14 nm Finfet processor which is a worlds first for a smart phone. It is smaller more powerful and easier on the battery. The performance is 20% faster, consumes 35% less power and sees a 30% productivity gain over the chipset in the Galaxy Note 4 which is running at 20nm. The ram is DDR4 which should boost running memory...

XDA NEWS
Share This