Slashdot Mirror
Security Researcher Says Samsung's Tizen OS Is The Worst Code He's Ever Seen (vice.com)
Samsung has been working on its Tizen operating system for several years now, implementing it into its various televisions and smartwatches. According to a report from Motherboard, the OS isn't receiving a lot of praise in the security department. Israeli researcher Amihai Neiderman has found 40 unknown zero-day vulnerabilities in Tizen, adding that it may be the worst code he's ever seen. From the report: "It may be the worst code I've ever seen," he told Motherboard in advance of a talk about his research that he is scheduled to deliver at Kaspersky Lab's Security Analyst Summit on the island of St. Maarten on Monday. "Everything you can do wrong there, they do it. You can see that nobody with any understanding of security looked at this code or wrote it. It's like taking an undergraduate and letting him program your software." All of the vulnerabilities would allow hackers to take control of a Samsung device from afar, in what's called remote-code execution. But one security hole Neiderman uncovered was particularly critical. It involves Samsung's TizenStore app -- Samsung's version of Google Play Store -- which delivers apps and software updates to Tizen devices. Neiderman says a flaw in its design allowed him to hijack the software to deliver malicious code to his Samsung TV. Because the TizenStore software operates with the highest privileges you can get on a device, it's the Holy Grail for a hacker who can abuse it. Although TizenStore does use authentication to make sure only authorized Samsung software gets installed on a device, Neiderman found a heap-overflow vulnerability that gave him control before that authentication function kicked in. Although researchers have uncovered problems with other Samsung devices in the past, Tizen has escaped extensive scrutiny from the security community, probably because it's not widely used on phones yet.
This just means Tizen is the appiest apperating app! Only LUDDITES would hate app-day apps!
Apps!
Asian corporate culture seems to get in the way of cranking-out good code; I wonder of that's because their management fails to realize that programming is as much an art as a science...
We now know where Samsung falls on the H-1B question.
#DeleteChrome
A major multinational corporation is pushing cut-rate garbage?
Maybe if the outcry is loud enough, Samsung will either fix it or abandon it.
They built the crap in the first place, so it's clear they won't bother without some outside pressure.
---
According to the latest ruleset, this post should be modded as Vorpal Flamebait +5.
Oh wait there's an 8 point check for that...probably same check for the software. Print out code, drop printout on ground, soak with water, dry printout, sit on paper, flip paper in air, hit paper with hand, transcribe paper back to code...yep still works...we're good...ship it.
As opposed to known zero-day vulnerabilities?
I was once asked by my boss to tinker with Tizen, see if it was usable, since a client was soliciting bids for an app they wanted to run on Samsung's smartwatch.
After a few day's experimentation, I reported that the Tizen SDK was basically unusable to write any app except the ones Samsung already wrote, and that the specific app the client was hoping for was literally impossible. The SDK itself was one of the worst programs I've used in many years - horrendously slow, crash-prone and cluttered in the way typical of early-00s Windows apps.
Needless to say, I am not surprised on multiple levels. First, that Tizen is insecure in addition to being slow and useless. Second, that nobody's taken a serious look at its security, since most people stop looking at it far before security starts to matter.
Tizen has escaped extensive scrutiny from the security community, probably because it's not widely used on phones yet.
"Yet" - and now "never will be" - we hope.
Knowledge is how to play a game, intelligence is how to win, wisdom is knowing what game to play.
Funny coincidence, I work in embedded in my spare time and am a security researcher by trade, so I think I can say with some confidence that they don't mix well. For many reasons.
First of all, there is no history of security in embedded. Because until very recently, there was absolutely no reason or need to even consider security an issue. You were dealing with closed, if not hermetically sealed systems. They could more often than not not even receive updates, let alone communicate with other embedded devices. Even "sophisticated" devices like TVs, not even talking about the "dumb" ones like washing machines or dishwashers. It's been only about a decade that TVs have a connection that's bidirectional. And "real" internet on TVs only arrived a generation of TVs ago.
And for all the other embedded gadgets, that whole "connectivity" thing is still very much bleeding edge.
And all that in devices for which until very recently, again, every byte mattered. Computer programmers are used to Mega- and Gigabytes of ram at their disposal, with embedded, you're in some areas still talking KB. Especially when it comes to low-cost devices where you can't just stuff in more ram and faster ICs because they'd simply cost too much. Yes, a part costing maybe a buck or two is "too expensive" here.
Put that together and add exactly ZERO experience with security among embedded developers (for all the reasons above) and you most likely understand why this is a HUGE problem that will bite us in the rear. Actually, it's already biting.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
The Boondocks / Pulp Fiction has the answer
Going way to this site's "nerd" days, people should be familiar with the window-manager-then-a-desktop-environment-under-development-for-a-decade-and-a-half called Enlightenment. It's main developer - Rasterman - worked at Samsung and had a lot to do with this OS. I don't know if he's still involved or not but I haven't heard anything about this OS since he mentioned it years ago.
"Challenge accepted!" - Microsoft, Mozilla, tons of app store (cr)apps, several bloated antivirus companies ...
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
dunno why but that made me lol ;)
Similar experience, I thought maybe I'd look up at Tizen apps "for fun" and after about a day or so I was certain it was not going to be any sort of fun! Well, unless S&M is your thing... And here is an educational article about the EFL libraries you get to use when designing native Tizen apps.
Violence is the last refuge of the incompetent. Polar Scope Align for iOS
No one could be that incompetent, I figure such vulnerabilities are baked-in from the outset under the direction of the state security apparatus.
we already knew that. the manufacturers know that too, but the masses that buy them, don't. they will just keep pumping out the future zombies because people keep buying them. profit today with the hope that the (too-short) warranties expire before the code gets blown to bits.
Re: "Tizen has escaped extensive scrutiny from the security community, probably because it's not widely used on phones yet."
Because of the customer cost point for a Tizen phone, it is incredibly popular in india/SE Asia/Asia. Please define "not widely used".
Having done some development for Tizen phones: SMACK is annoying to developers; I have not looked at it from a security perspective to see if it is effective.
Recall that Samsung is a HARDWARE DEVICE vendor. Their focus is on selling huge volumes of low-cost widgets. Ranging from Washer/Dryer machine, to Galaxy phones, etc. Software security is not a relative priority for them.
https://what.thedailywtf.com/t...
Mod parent up. I too had a short-liven interest in Tizen development....until I read the above article. Not to mention that the SDK was unstable, with limited instructions, and didn't work well on a RPi either.
Well, looks like a lot of wheels have been reinvented really badly here. The sign of utterly incompetent engineering and utterly incompetent management that does not know how to identify and hire good engineers and then let them work.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
Watch Samsung sue said researcher.. Gotta keep those liars err lawyers busy ya know...
THANK YOU, Edward Snowden!! Americans owe you a debt of gratitude (whether they know it or not..)
And of course we are all going to take the word of an isreali working for a Russian "security" company..
Well no wonder the number of third party apps has been so lackluster on Tizen. Looks like I bought the wrong watch...
A single unknown security researcher uncovers 40 critical security holes... it's not remotely possible, and seems more like an attempt at throwing dirt at Samsung and making their products seem unreliable and dangerous to use. Is his work being paid by Big Electronics in the west, perhaps?
That describes Samsung to a tee , when I worked with them . Apparently "innovate" got translated to "cut corners, pirate software, and copy the superficiality of others good ideas" when translated into Korean
One can only wonder if there are large reveneus in selling separate, compiled accesses to China, USA, Russia and Israel, among others.
Urgh. My condolences and congratulations for getting out.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
TBH, only like three devices come with Tizen. Two phones released in India, and a few smartwatches.
Samsung isn't exactly pushing it. How do you expect developers to follow?
The Ravenous Bugblatter Beast of Tizen is a mind-bogglingly stupid codebase. It has almost no capacity for Enlightenment and is therefore surprised by virtually everything that happens to it. Here is an example of how stupid it is: it thinks that if you can't see its pointer types, it can't see you.
Its behaviour would be quite endearing if it wasn't spoilt by this one thing: it is the most violently crappy codebase in the Galaxy. A void*, a void*, a void*.
#naabhaprzrag, #sverubfr-000, #agi-fcbafberq, negvpyr[pynff*=' negvpyr-ary-'] { qvfcynl: abar !vzcbegnag; }
It's like taking an undergraduate and letting him program your software
What he described was an issue of critical thinking, not knowledge, experience, or education. Quality of code design has virtually no correlation with education or experience. One software architect went so far as to say he would rather have someone who uses nothing but anti-patterns and has never programmed before but has has strong reasoning skills designing his software than someone who only uses patterns perfectly and is highly experienced.
How can he say such rubbish as a scientist. Has he seen all code of everything? What are his metrics? Don't get me wrong. The Tizen code could be one of the worst code there is. This is a fair hypothesis, but then you have to provide proof. At least some metrics on implementation errors, complexity, patterns etc.
When it comes to making it explosive, one way or another, you can rely on Samsung.
it's basic object type is a typedef to void*
Indeed just quote whatever you read on the internet. It has to be true. Did you actually check to see if such crazy claims are correct? In further news I read an article that says your mother is a Walrus and the British eat their first born. I read it on the internet. It has to be true!
Which of course will accept any kind of pointer, no matter where it came from
Which would be correct if the first statement were true. But hey. I guess we all know how much you bother to fact check before spouting whatever you feel like - seemingly about as much as Trump does.
https://what.thedailywtf.com/t...
Yeah, the first thing I though when reading the story was:
"SPANK SPANK SPANK! Naughty programmer!"
(a Tizen error code)
For some reason the CIA zeroed in on Samsung devices in particular...
The sign of utterly incompetent engineering and utterly incompetent management that does not know how to identify and hire good engineers and then let them work.
Doesn't this describe most tech companies these days? The open-plan office is proof of incompetent management.