Slashdot Mirror
Huge Security Hole In Recent Samsung Devices
An anonymous reader writes "A huge security hole has been discovered in recent Samsung devices including phones like the Galaxy S2 and S3. It is possible for every user to obtain root due to a custom faulty memory device created by Samsung." The problem affects phones with the Exynos System-on-Chip.
That phone has been rootable for ages. It runs Ice Cream Sandwich and even Jellybean quite smoothly with the proper ROM/kernel.
Installing anything with Kies is just torturing yourself. A Galaxy S1 runs Jelly Bean quite nicely, and it runs faster than stock 2.1 I find. The next phone I buy will be checked for Cyanogen support before I buy it.
This only effects the international S3, the US LTE version uses a Snapdragon CPU.
I consider someone *else* running as root a security hole. As long as you need physical access, this is a feature. A phone that will not let you install what you want is broken.
Google, this is an easy thing to do. I can't guarantee this site but: https://gurde.com/2012/08/how-to-android-jelly-bean-4-1-1-on-galaxy-s-i9000/ is the first result I got.
Slashdot: providing anti-social weirdos a soapbox, since 1997.
Instead of considering that "security hole" a "security hole", consider it as a "feature".
Just root the damn thing and unlock it !!
Muchas Gracias, Señor Edward Snowden !
The Google ad on the page for TFA states "Root Any Android Device In 1 Touch! Easy To Use Automatic Root Software". Talk about context-sensitive ads!!
> It's just one more exposure. The real problem is in actually being able to tell what -any- app is currently doing
> on your device. And that kind of monitoring is no-where in sight.
Wrong, and wrong. With this, you can access all the memory on your phone. Clearly with this you CAN tell what's running, You can stop what's running. You can patch what's running. You can do whever you like, This is about as different to the average piece of malware as is possible to get.
Strangely, TFA makes no mention of an app built to actually use this exploit to install SuperSU (root access management app): http://forum.xda-developers.com/showthread.php?t=2050297 - i.e. what most users consider getting rooted.
Of course, this exploit can be used by any app, and a user can use the core exploit manually to install SuperSU (or Superuser) to let Play apps that need root (but don't contain this exploit ;)), but the linked method does all the work for you already.
Haven't you heard about Samsung's new strategy?
1.) Become the go to name in customized faulty memory devices
2.) ?????
3.) Profit
You should be able to put it into a raw download (hold Vol up + Vol down in off state while plugging uSB into it) mode and use Heimdall, where you can flash a complete image over of it. Poke around for it, it's a fairly easy phone to root, and You'll be much happier with JB on it.
I want to like my iPhone, but Android is just SO OPEN.
Galaxy S1 is easy to root! You have to be careful and follow instructions, but it's easy. http://wiki.cyanogenmod.org/wiki/Samsung_Galaxy_S
Also Samsung has it's own update process called Kies, but it won't give you root: http://pages.samsung.com/ca/androidupgrade/English/
I love my Samsung Galaxy S
other than stuff befalling jailbroken devices
This is the important part. Walled gardens are inherently more secure, it has nothing to do with Apple's competence.
AccountKiller
Damn that was vague.
If by 'vague', you mean 'detailed', then yes, it was. 8^)
Could you maybe explain what kind of bad things they can do without permission?
The most damning bit of code is this:
#ifdef CONFIG_EXYNOS_MEM [14] = {"exynos-mem", S_IRUSR | S_IWUSR | S_IRGRP | S_IWGRP | S_IROTH | S_IWOTH, &exynos_mem_fops}, #endif
Basically, it says, "Aw heck, write whatever you like to any memory address anywhere. I mean, we're all friends here. Right?"
Effectively, any installed app can ignore pretty much every single security setting on the phone and do whatever it likes to the running system. Worse, this could be coupled with a vulnerability in an otherwise well-intentioned app to create a remote root exploit.
On the WTF scale, this ranks with the 2008 Debian SSL hole in terms of rank stupidity.
Crumb's Corollary: Never bring a knife to a bun fight.
Kies is the biggest pile of bloated crapware since Norton.
"Wait. Something's happening. It's opening up! My God, it's full of apricots!"
Tim Cook needs to sue them for that one.
Err, because any app you download can p0wn your phone?
Because some random app could subvert the permissions it was granted at install and do whatever the hell it wants?
The absolute worst-case would be to use the elevated access to leverage the superbrick bug (another hole out in the wild on the majority of exynos based phones) and permanently damage the emmc chip, which requires a system-board replacement to revive the phone.
It's a considerable "security issue" because it may provide a vector through which you could install any app, ringtone, mp3, wallpaper, etc., that you did not buy from the manufacturer (thinking of currently un-rootable devices here). You could disable un-installable apps you mfger wants you to have. You could inspect and monitor your phone's memory and data transactions in such detail as to learn what information your mfgr, or installed apps, harvests from your activity. Heavens, you could finally back up and restore your phonebook from a device with a disabled data port. Enable wifi without a $15/mo service plan! Download your cameraphone pics and videos without using up some of your data ration! Or install a cut-and-paste extension! Freedom is dangerous! Samsung cannot ensure the 'highest customer experience' if the customer can shop around! Or some hog-swill like that.
Disclosure: worked for Samsung Wireless. They're evil.
This is not a hardware design flaw. Whatever makes you think that ? The reason it affects so many Exynos4 devices is because the exploitable code is present in the main code they base most Exynos4 Android firmwares on. It's certainly fixable by Samsung.
The SGS is pretty much brick proof, even if you screw up the simple root instructions.
Currently running over clocked (Semaphore) CM 10 JVT with no problems.
Brick proof until the USB connector dies part way through an update. Jjust had that happen, brand new SGS, started to root it, failed, couldn't connect on USB again. Took it back and got a replacement though. I did read somewhere that the USB connectors on these can be dodgy.
In the free world the media isn't government run; the government is media run.