Replicant Hackers Find and Close Samsung Galaxy Back-door

gnujoshua writes "Paul Kocialkowski (PaulK), a developer for the Replicant project, a fully free/libre version of Android, wrote a guest blog post for the Free Software Foundation announcing that whlie hacking on the Samsung Galaxy, they "discovered that the proprietary program running on the applications processor in charge of handling the communication protocol with the modem actually implements a back-door that lets the modem perform remote file I/O operations on the file system." They then replaced the proprietary program with free software.

While it may be a while before we can have a 100% free software microcode/firmware on the the cellular hardware itself, isolating that hardware from the rest of your programming and data is a seemingly important step that we can take right now. At least to the FSF anyhow. What do others think: is a 100% free software mobile device important to you?"

Comments

Who's behind that back-door ?

[Taco Cowboy]

NSA ?

GCHQ ?

Or their equivalent from South Korea ?

Re:Who's behind that back-door ?

[Gaygirlie]

When I heard this news earlier today I couldn't help but think that it's not really a back-door. Samsung has had a service on their phones for years that allows you to track your phone and remotely wipe it if someone stole it or you lost it or something. Performing file I/O on the system? Well, that sounds exactly like something you'd need to do if you were to wipe the phone clean!

Re:Who's behind that back-door ?

[jason.sweet]

NSA ?

GCHQ ?

Or their equivalent from South Korea ?

AT&T

Re:Who's behind that back-door ?

[MachineShedFred]

They shouldn't need to expose full filesystem I/O for a remote wipe. They should only need to expose a locked up command that triggers the wipe within the local OS.

Either this is a back door, or they are the worst software engineers ever.

Re:Who's behind that back-door ?

[Gaygirlie]

Either this is a back door, or they are the worst software engineers ever.

A back-door is something that was placed there with the specific intent of providing access to the system even against the system owner's wish, so that's my point: it doesn't seem like that was the intent. It just sounds like it was there for this service, but they never really fully thought out the scheme and just went with whatever they first came up with. Granted, I'm only guessing here, but for once I'm going to go with the "it's incompetence, not malicious intent" - defense.

Re:Who's behind that back-door ?

[Andy Dodd]

"Never attribute to malice that which can be attributed to stupidity."

My guess, after years of working with Samsung's poor-quality platform software and multiple runins with their utterly piss-poor configuration management processes (as in, the Korean divisions at Samsung Mobile don't seem to have any, as evidenced by numerous situations during the Superbrick fiasco):

Samsung probably put this into the RIL library to facilitate modem debugging. e.g. the modem can read/write to /efs/root/ in order to make it easier for a developer to track state changes of the modem or whatever. (Why do this instead of using whatever debugging functions are built into the modem such as maybe JTAG? This is probably for late-stage development where they wanted to test finishing touches on the modem using final hardware and the modem's debugging functions weren't physically available.)

Keep in mind that, based on the reverse engineering effort, Samsung *intended* this feature to only access files within /efs/root/ - the EFS partition is specifically reserved for device-specific state and calibration data (most notably the phone's IMEI is stored in the EFS partition, and with the exception of some miscellaneous other config data such as MAC addresses for wifi and BT, it's almost entirely for modem-related items. I may be wrong about the MAC data, I'm a bit rusty and haven't poked around at my EFS partitions in a long time.) It's only due to a screwup (lack of sanitization of escape sequences such as ../../ ) that someone can in theory access files outside of /efs/root

So at some point, Samsung probably removed the corresponding components on the baseband firmware side (no one has yet to confirm anything on the modem side that sends these commands, nor has anyone caught any of these commands being issued - the behavior of the library was verified by injecting extra commands with a kernel patch in the driver between the modem and the library), but someone forgot to remove them from the RIL library on the applications processor side. Forgetting to remove dead code and/or leaving epic security holes in place (remember that in late 2012, someone realized that Samsung left a world readable/writable device node that effectively mapped all system memory to that device file - allowing anyone to read or write any part of memory. For more, do a Google search for "exynos-abuse" ) is pretty typical for Samsung.

As to my experience here - I was one of the Cyanogenmod maintainers for the Exynos 4210 (I9100, I777, N7000) handset family, and also did some work on 4412 devices (primarily the Note 10.1 - GT-N8013) throughout 2012 and the first half of 2013. I'm 90% retired from working with Haxxinos these days and was (along with the majority of the rest of the Exynos maintainers) one of the people who left the project to start Omni after the Focal relicensing attempt fiasco.

An interesting question is - what architecture is the XMM626x's baseband processor? Is it custom or an ARM variant making it easier to analyze the baseband firmware itself? More than two years of working with that family of devices and I never personally looked in detail at what was running on the baseband side.

Re:Who's behind that back-door ?

[dos1]

That "obscure alternative" is one of the only ones consisting of entirely free software. Instead of whining that something doesn't work you should rather help implementing what's missing, either by direct contributions, money donations or even just a good word to the developers. Otherwise the rarity of free mobile systems like SHR, QtMoko or Replicant will become even more rare and none of them will be ever usable for anyone else than hardcore geeks.

Dupe

[Desler]

Yeah we know.

http://mobile.slashdot.org/sto...

Re:Dupe

[wonkey_monkey]

Replicant OS Developers Find Backdoor In Samsung Galaxy Devices
Replicant Hackers Find and Close Samsung Galaxy Back-door

Totally different story.

Re:Dupe

[cant_get_a_good_nick]

This story is a replicant...

Wow! Two backdoors in one day?

[Anonymous Coward]

Wow! Two backdoors in one day? The Replicant team is really on a roll! And both of the backdoors in the exact same place! Impressive.

Slashdot editors

[coofercat]

Slashdot editors fail to spot dupe, and fail to fix it - even though it's on the frikkin' home page. Wow, that really is news ;-)

Timothy, you've surpassed yourself. Tonight, when you go home to your SO and they ask you "how was your day, dear", you can proudly say "I really rocked today - I did some awesome stuff, I really moved the needle, I pushed the envelope, I really excelled!".

Replicants?

[rossdee]

Someone call Harrison Ford

Wow

[Charliemopps]

I'm used to the dupes being weeks or months old... maybe Days for really bad ones. But this was like 12hrs ago? Do the editors even read slashdot anymore?

Does Deckard Know this?

[goombah99]

I'm sure Samsung is sending in the blade runner for these replicants hackers