FallenWriter · Sep 30, 2012 at 05:00 am

What Can We Learn from the Galaxy S III NFC Hack?

NFC technology is poised to become the core of the mobile payment world. Nearly every cutting edge smartphone released in the next year will feature some form of NFC and mobile payments. Every major player from Verizon to Google, from MasterCard to American Express is in some way attempting to enter the market and gain a foothold in the thriving industry. Yet this is not without cost: Near-Field Communication technology is new and relatively untested. By linking it with our smartphones, a device we use for nearly every aspect of our lives, we’ve created the most potent bait an identify thief or malicious life hacker could desire.

Yet until recently, few cared to think about the malicious possibilities that NFC posed to the user. Just over a week ago at Mobile Pwn2Own, this changed when MWR Labs demonstrated that NFC users (and vendors) have a whole lot more to think about. While the exact details of the exploit are still withheld, using the Samsung Galaxy S3’s NFC chip, a file is downloaded and automatically opened. Next, the file was able to elevate its privileges and thereby gain control over every aspect of the device. As explained on the team’s blog:

The first vulnerability was a memory corruption that allowed us to gain limited control over the phone. We triggered this vulnerability 185 times in our exploit code in order to overcome some of the limitations placed on us by the vulnerability.

We used the second vulnerability to escalate our privileges on the device and undermine the application sandbox model. We used this to install a customised version of Mercury, our Android assessment framework. We could then use Mercury’s capabilities to exfiltrate user data from the device to a remote listener, including dumping SMS and contact databases, or initiating a call to a premium rate number.

While this type of attack may seem complicated and far fetched, the reality is that criminals will go to great lengths to formulate a method by which to steal your information and money. The more reliant on mobile technology we become, the more vigilant we must be in safeguarding our information. Having NFC enabled 24/7 is like having your credit card, phone number, address, name, and Social Security Number dangling from your belt loop. So while the exploit will undoubtedly be patched quickly, just remember: You never know who may be watching.


_________
Want something on the XDA Portal? Send us a tip!

FallenWriter

FallenWriter is an editor on XDA-Developers, the largest community for Android users. I am the Fallen Writer of XDA. I was a News Writer who was cast into exile for my sins. Now I have returned to haunt the forums of XDA with my writings. View FallenWriter's posts and articles here.
Emil Kako · May 22, 2015 at 10:35 pm · 4 comments

Other than XDA (of Course), What’s Your Favorite Site That Covers Android?

There is a number of other great sites that cover Android, so we're wondering which other sites our community likes to frequent. Tell us your favorite Android website and what about the site that makes it your favorite.

DISCUSS
Mathew Brack · May 22, 2015 at 02:30 pm · 4 comments

Introducing Voices of XDA: Have Your Ideas Heard

By far the greatest assets we have at XDA-Developers are you, the developers, the eager to learn and the bold. Everyday we see innovation and brilliant ideas across the site, from this we know that many of you have great insight in to your respective fields. That is why today, I am honored to announce a new project that will allow us to work with you directly to have your views and thoughts expressed clearer than ever. Introducing:    ...

XDA NEWS
Jimmy McGee · May 22, 2015 at 12:10 pm · 4 comments

YotaPhone 2 Pre-Order, Xperia Z1 Price Cut – XDA TV

Android Wear 5.1.1 OTA downloads are now available. That and much more news is covered by Jordan when he reviews all the important stories from this week. Included in this week's news is the announcement of Sony cutting the price of the Xperia Z1 and be sure to check out the article talking about the YotaPhone 2 Indiegogo pre-order. That's not all that's covered in today's video! Jordan talks about the other videos released this week on XDA TV. XDA...

XDA NEWS
Share This