Connect with us

Hi, what are you looking for?

Tech

Security flaws found in Samsung’s stock mobile apps

A mobile security startup has found seven security flaws in Samsung’s pre-installed mobile apps, which it says if abused could have allowed attackers broad access to a victim’s personal data.

Oversecured said the vulnerabilities were found in several apps and components bundled with Samsung phones and tablets. Oversecured founder Sergey Toshin told TechCrunch that the vulnerabilities were verified on a Samsung Galaxy S10+ but that all Samsung devices could be potentially affected because the baked-in apps are responsible for system functionality.

Toshin said the vulnerabilities could have allowed a malicious app on the same device to steal a victim’s photos, videos, contacts, call records and messages, and change settings “without any user consent or notice” by hijacking the permissions from Samsung’s stock apps.

One of the flaws could have allowed the theft of data by exploiting a vulnerability in Samsung’s Secure Folder app, which has a “large set” of rights across the device. In a proof-of-concept, Toshin showed the bug could be used to steal contacts data. Another bug in Samsung’s Knox security software could have been abused to install other malicious apps, while a bug in Samsung Dex could have been used to scrape data from user notifications from apps, email inboxes, and messages.

Oversecured published technical details of the vulnerabilities in a blog post, and said it reported the bugs to Samsung, which fixed the flaws.

Samsung confirmed the flaws affected “selected” Galaxy devices but would not provide a list of specific devices. “There have been no known reported issues globally and users should be assured that their sensitive information was not at risk,” but provided no evidence for this claim. “We addressed the potential vulnerability by developing and issuing security patches via software update in April and May, 2021 as soon as we identified this issue.”

The startup, which launched earlier this year after self-funding $1 million in bug bounty payouts, uses automation to search for vulnerabilities in Android code. Toshin has found similar security flaws in TikTok, and Android’s Google Play app.

Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

You May Also Like

World News

Insomnia is the most common sleep disorder in the global population. Therefore, it is a problem that many people suffer or have suffered...

World News

George Soros and Bill Gates are part of a consortium acquiring a British developer of rapid-testing technology, including for Covid-19 and tropical diseases,...

Tech

If you parked your car in one of the thousands of parking spots across Calgary, there’s a good chance you paid the Calgary Parking...

Investing

ForexMay 27, 2021 02:04AM ET (C) Reuters. By Peter Nurse Investing.com — The dollar edged higher in early European trade Thursday, finding support from...

Disclaimer: Yourmorningvoice.com it's managers and its employees (collectively "The Company") do not make any guarantee or warranty about what is advertised or above. Information provided by this website is for research purposes only and should not be considered as personalized financial advice. Copyright © 2021 Your Morning Voice. All Rights Reserved