Security flaws found in Samsung’s stock mobile apps

A mobile security startup has found seven security flaws in Samsung’s pre-installed mobile apps, which it says if abused could have allowed attackers broad access to a victim’s personal data.

Oversecured said the vulnerabilities were found in several apps and components bundled with Samsung phones and tablets. Oversecured founder Sergey Toshin told TechCrunch that the vulnerabilities were verified on a Samsung Galaxy S10+ but that all Samsung devices could be potentially affected because the baked-in apps are responsible for system functionality.

Toshin said the vulnerabilities could have allowed a malicious app on the same device to steal a victim’s photos, videos, contacts, call records and messages, and change settings “without any user consent or notice” by hijacking the permissions from Samsung’s stock apps.

One of the flaws could have allowed the theft of data by exploiting a vulnerability in Samsung’s Secure Folder app, which has a “large set” of rights across the device. In a proof-of-concept, Toshin showed the bug could be used to steal contacts data. Another bug in Samsung’s Knox security software could have been abused to install other malicious apps, while a bug in Samsung Dex could have been used to scrape data from user notifications from apps, email inboxes and messages.

Oversecured published technical details of the vulnerabilities in a blog post, and said it reported the bugs to Samsung, which fixed the flaws.

Samsung confirmed the flaws affected “selected” Galaxy devices but would not provide a list of specific devices. “There have been no known reported issues globally and users should be assured that their sensitive information was not at risk,” but provided no evidence for this claim. “We addressed the potential vulnerability by developing and issuing security patches via software update in April and May, 2021 as soon as we identified this issue.”

The startup, which launched earlier this year after self-funding $1 million in bug bounty payouts, uses automation to search for vulnerabilities in Android code. Toshin has found similar security flaws in TikTok and Android’s Google Play app.

Credit belongs to : www.techcrunch.com

You May Also Like

Vietnamese financial services app MFast gets $1.5M pre-Series A led by Do Ventures

MFast, a mobile app that lets Vietnamese users in remote areas access financial services, announced today it has raised a $1.5 million pre-Series A. The round was led by Do Ventures, with participation from JAFCO Asia.  Launched in 2019 by fintech company Digipay, MFast says it has been used by 600,000 people to date. It […]

GrowSari, a B2B platform for small stores in the Philippines, adds investors like Temasek’s Pavilion Capital and Tencent

Sari-sari stores are neighborhood stores in the Philippines that usually sell daily necessities and sometimes serve as community hubs, too. Today GrowSari, a startup that is digitizing sari-sari stores with features like pricing tools, inventory management and working capital loans, announced it has raised a Series B from several notable investors that brings its total […]
error: Content is protected !!