Slashdot Mirror

← Back to Stories (view on slashdot.org)

Samsung Left Millions Vulnerable To Hackers Because It Forgot To Renew a Domain (vice.com)

Posted by msmash on from the security-woes dept.

An anonymous reader writes: Samsung cellphones used to have a stock app called S Suggest. The company apparently discontinued the app recently, and then forgot to renew a domain that was used to control it. This snafu left millions of smartphone users vulnerable to hackers who could've registered the domain and installed malicious apps on the phones.

54 comments

  1. It's all so fragile. by Anonymous Coward · · Score: 0

    This is just more proof that tech as we know it today is way too fradgile for critical functions. Cell phones getting screwed up is bad but think forward a few years, automated cars, drones, computerized ATC. Oh the humanity if one of those systems fails this way.

    1. Re: It's all so fragile. by Anonymous Coward · · Score: 0

      Root, install firewall and deny any app that doesn't need 24/7 access permission from using the internet until you give it permission.

      A great example is games. Tons of them ask for ridiculous permissions so they can send the data home but 99% of them don't require an internet connection so I don't mind granting those permissions.

      This Samsung app is one I would have granted access only when I was actively using it and when it couldn't connect properly I would have denied it access for a few days, checked again then uninstalled it all while keeping a detailed log of what the app was doing.

      I don't trust any apps. Verizon has pre installed apps that I outright uninstall with titanium backup.

    2. Re: It's all so fragile. by Anonymous Coward · · Score: 0

      correction: it's all so fragile when a manufacturer don't care enough, to do due diligence.

  2. what happens if a company goes under by redback · · Score: 3, Interesting

    What would have happened with something like this if a company goes under?

    We almost need a charity foundation of some sort to maintain domains like this in that situation.

    1. Re:what happens if a company goes under by DickBreath · · Score: 2

      Maybe there needs to be a mechanism to disable the app. Or updates to the app. Or further downloads. Etc.

      Then there needs to be an officer in the company who is responsible to activate this mechanism in the event that the company ceases operations. Prior to that happening, the product manager of the affected product would be responsible to use this mechanism to disable further updates to the app when it is being discontinued.

      --

      I'll see your senator, and I'll raise you two judges.
    2. Re:what happens if a company goes under by iggymanz · · Score: 1

      ah, script kiddies newest target, that mechanism. render massive slice of a market unable to use their internet dependent product.

    3. Re:what happens if a company goes under by OrangeTide · · Score: 1

      You can disable any app in Android. Instead of "uninstall" you'll see a button to uninstall updates, then if you uninstall updates you'll see a button to disable the app.

      --
      “Common sense is not so common.” — Voltaire
    4. Re:what happens if a company goes under by Anonymous Coward · · Score: 0

      It would be better if it would be illegal for a company to make themselves admin on your devices without your input ...

    5. Re: what happens if a company goes under by Anonymous Coward · · Score: 0

      You license the device firmware. Ergo you be fucked if they wanna have root access. Tough cookies.

    6. Re:what happens if a company goes under by vlad30 · · Score: 1

      It should also be much more difficult to register a domain especially a domain that has been used before. That registration fee should entail some actual work on the part of the domain registrar to fact check the applicant and potential use and removal if the use is nefarious. imagine how many fewer scam and spam website would exist if they actually did this

      --
      Your'e all thinking it, I just said it for you
    7. Re:what happens if a company goes under by The+MAZZTer · · Score: 1

      The app can use certificate pinning. If someone else puts a new server up on the domain name the certificate will not match the expected one from the old site and the app will refuse to connect to it.

    8. Re:what happens if a company goes under by Anonymous Coward · · Score: 0

      Certificate pinning can be defeated especially if the phone is also rooted.

    9. Re:what happens if a company goes under by phantomfive · · Score: 1

      What would have happened with something like this if a company goes under?

      For one thing, you should have some kind of authentication. Basing security entirely around domain name is a known security flaw, since at least the 90s. Two to one odds says that they also programmed the app to communicate over HTTP instead of HTTPS.

      --
      "First they came for the slanderers and i said nothing."
    10. Re:what happens if a company goes under by by+(1706743) · · Score: 1

      Well it's fine if the end-user (the one who presumably rooted the phone) wants to defeat some certificate checking. And if you're suggesting that a third party rooted the phone, well...you have bigger problems.

    11. Re:what happens if a company goes under by Obfuscant · · Score: 1

      You can disable any app in Android. Instead of "uninstall" you'll see a button to uninstall updates,

      Most user loaded apps do not have a "disable" feature. It's either let it run as it wants or uninstall it lock, stock and barrel.

      I wish they all had "disable", since there are apps (like Nook with at least 5, FileManager+ with one, Accuweather with 3 or 4) that run multiple services all the time, even when you haven't used the app for a month. And some of them simply won't go away when you kill them (Google Location Services service, I'm pointing at you.) It's a pain to have to uninstall apps and then reinstall them for just the amount of time you want to actually use them.

      Those that do have "disable" can hide it behind a "uninstall updates", so if you want to disable it you have to uninstall the update. When you want to run it again, you have to enable and then often reload the update.

      It's all designed to make it impossible, or as hard as possible, to stop whatever from gathering information about you and your files.

    12. Re:what happens if a company goes under by OrangeTide · · Score: 1

      You can disable any app in Android. Instead of "uninstall" you'll see a button to uninstall updates,

      Most user loaded apps do not have a "disable" feature. It's either let it run as it wants or uninstall it lock, stock and barrel.

      Like I said, if you've been paying attention, " Instead of 'uninstall' you'll see a button to uninstall updates".
      If a user installed it, you'll just see "uninstall". If it's a factor app you'll get the "uninstall updates" -> "disable".
      Of course Android is different with every OEM, but I haven't run into any that totally prevented me from disabling an OEM app. Samsung's definitely gives you scary warnings if you attempt it but it lets you.

      --
      “Common sense is not so common.” — Voltaire
    13. Re:what happens if a company goes under by Obfuscant · · Score: 1

      Like I said, if you've been paying attention, " Instead of 'uninstall' you'll see a button to uninstall updates".

      And like I said, if you had been paying attention, is that most USER LOADED apps do not have a disable feature. Many system apps do, but user installed do not. It would be a good feature for the user to have to be able to disable instead of uninstall those apps.

      If it's a factor app you'll get the "uninstall updates" -> "disable".

      Which does not contradict in any way what I said about user-installed apps, so keep your insults to yourself.

      Of course Android is different with every OEM, but I haven't run into any that totally prevented me from disabling an OEM app.

      For just one example, I have a factory test app that becomes active every time I reboot one of my Samsung tablets. I can kill it and it will stay dead -- until the next boot -- but it cannot be disabled. It is not the only OEM app that behaves that way. I just did a quick survey of the tablet here and it's less than 50% of OEM apps that can be disabled, so I'd have to say many can but most cannot. And if you pay attention, that DOES contradict your experience.

    14. Re:what happens if a company goes under by Obfuscant · · Score: 1

      And one bit more -- you said you can disable "any app". You cannot disable user-loaded apps. You can only uninstall them. Uninstall is not the same as disable.

    15. Re:what happens if a company goes under by Anonymous Coward · · Score: 0

      We need to repeal the DMCA!

    16. Re:what happens if a company goes under by OrangeTide · · Score: 1

      And like I said, if you had been paying attention, is that most USER LOADED apps do not have a disable feature. Many system apps do, but user installed do not. It would be a good feature for the user to have to be able to disable instead of uninstall those apps.

      Yes, you'd uninstall those, not disable them. Fucking idiots these days.

      --
      “Common sense is not so common.” — Voltaire
    17. Re:what happens if a company goes under by OrangeTide · · Score: 1

      Oh you really zinged me. Yes I said "any app". I should have said something like "any app that the article was talking about"

      I don't care what you think you want to do. Android lets you disable factor apps, except in the rare cases the vendor hacks that feature out. Users can either have additional apps installed or if they don't want to use them, not have them installed. That's the model, we all understand that you don't like that model, but that's how it works today. The functionality is effectively equivalent, even if you can't wrap your head around it.

      --
      “Common sense is not so common.” — Voltaire
    18. Re:what happens if a company goes under by Obfuscant · · Score: 1

      Yes, you'd uninstall those, not disable them. Fucking idiots these days.

      You clearly do not understand the difference between disabling an app and uninstalling them. As I said a couple of times now, it would be nice if we could disable any app LIKE YOU SAID WE CAN, but which in truth cannot be done. You are not in a good position to be using insult to make your point.

    19. Re:what happens if a company goes under by Obfuscant · · Score: 1

      I don't care what you think you want to do.

      Thanks.

      Android lets you disable factor apps, except in the rare cases the vendor hacks that feature out.

      As I pointed out already, the survey of "factor" apps I made on my Samsung device showed less than 50% of them could be disabled. It isn't rare if more than 50% of the apps cannot be disabled.

      Users can either have additional apps installed or if they don't want to use them, not have them installed.

      Of course. But that means that any app that a user needs only occasionally must be reinstalled from scratch before it can be used for a short period of time, and then re-uninstalled. That's a lot more work that simply disabling/enabling/disabling an app. This difference seems to be lost on you. For example, the Nook app that wants to have five services running at all times so it can keep in constant contact with home base and monitor all usage has a huge amount of data installed in the form of content (or it can, depending on the user. Mine has.) To reinstall all that content is quite a bit of work and requires the internet. To disable the app means it won't run, but to get access to the content again requires no internet connection to redownload the content after reenabling it. It's just an on/off switch.

      but that's how it works today.

      Which is why I said it would be nice if we could do it, unlike those who have said that you can disable any app.

      The functionality is effectively equivalent,

      Except for the differences, yes, totally equivalent. The difference makes the difference.

      even if you can't wrap your head around it.

      I don't seem to be the one who cannot "wrap my head around" the differences, so why don't you just stop trying to be insulting? You do it so poorly.

    20. Re:what happens if a company goes under by LordWabbit2 · · Score: 1

      And how much more would it cost to register a domain? All that paper work and vetting is going to seriously increase the price of registering a domain. Heard of net neutrality? Same thing applies here. You raise the bar for something as simple as registering a domain and you start cutting out the smaller players, and then only the big boys can play, and we all know what happens then.

      --
      There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
    21. Re:what happens if a company goes under by AmiMoJo · · Score: 1

      Neither of those things will help, unfortunately.

      Normal people don't install updates unless forced to. If it isn't 100% automatic it isn't happening. And anyway, how would they even know to disable the app? Most don't read security advisory mailing lists.

      Giving someone the job of handing over company assets for free to a charity at the precise moment that the company is being broken up for scrap isn't likely to fly either. They would just get blamed for giving away something that the bankruptcy team could have sold to some malware outfit for a few hundred bucks.

      --
      const int one = 65536; (Silvermoon, Texture.cs)
      SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
  3. Also by thundercattt · · Score: 1

    Left vulnerable by NEVER updating the operating systems on phones other than Flagship. I remember stage fright, they promised a security release. Still waiting on my 4.4.1.

    1. Re:Also by Ksevio · · Score: 1

      See if you can update it yourself: https://www.lineageos.org/

    2. Re: Also by thundercattt · · Score: 1

      Thanks for the link. It's not on there, wasn't a hugely popular model being a rugged phone.

  4. Bloatware that can't be removed by Anonymous Coward · · Score: 0

    That's what you get when you have software that cannot be uninstalled, but has root permissions. Once the company in charge no longer gives a fuck, you are screwed if you keep using it. But Hey, I thought all of those digital signatures that we cannot legally override, and told we HAD to use, were supposed to keep us safe? Guess I was wrong..... *eyeroll*

  5. This is why I only roll with Apple gear by Anonymous Coward · · Score: 0

    They keep their shit wired tight

    You can bitch about the walled garden, but it works

    1. Re:This is why I only roll with Apple gear by Anonymous Coward · · Score: 0
      then your a fucktard because even major companies have let domains expire. There's this and its not the only one but im too lazy to look the rest up.

      But if you think that apple is special you go ahead and think that.

  6. Zero risk if done right by OrangeTide · · Score: 2

    It doesn't matter who controls or hijacks your domain because DNS is not an authoritative source of information. You go through numerous unsigned caches before you get queries through.
    If you write software without your head up your ass you'd use a certificate on the app to check every interaction with the server before you trust it.
     

    --
    “Common sense is not so common.” — Voltaire
    1. Re:Zero risk if done right by CanadianMacFan · · Score: 1

      Yes but these are the same type of programmers that think that doing the error checking in Javascript is good enough.

  7. You Fail It by Anonymous Coward · · Score: 1

    I hope our goatse guy gets his domain renewed soon. I'd hate to see him fall victim to the same problem!

  8. Why did they even need a separate domain for this? by ZorinLynx · · Score: 5, Insightful

    You'd think they could have instead used "ssuggest.samsung.com" or similar, rather than registering an entirely separate domain for what is essentially a minor feature on a phone.

    The nice thing about DNS is that it was designed PRECISELY TO BE USED THIS WAY, being able to establish a hierarchy so that an entity can organize all their hostnames/services in one hierarchy.

  9. But "Touchwiz isn't so bad..." by surfdaddy · · Score: 1

    Plus all of those Samsung crap apps.

    That's why I use stock Android on my Nexus, and my next phone will be a Pixel. It's a shame because the Samsung hardware is really nice (except the Galaxy S7 of course).

    1. Re:But "Touchwiz isn't so bad..." by LordWabbit2 · · Score: 1

      Or just get a knock off Chinese phone, the only problem with those is that what you get on the phone will be all you get on the phone. No updates. You will have to manage that yourself.

      --
      There are three kinds of falsehood: the first is a 'fib,' the second is a downright lie, and the third is statistics.
  10. Key employee lost? by Anonymous Coward · · Score: 0

    I'm guessing the root cause goes deeper, and a key employee who handled these 'minor details' left, or was terminated.

    The organization also lacked the depth and institutional knowledge.

  11. Lucky for us, though by Anonymous Coward · · Score: 0

    It's only "hackers" we have to be afraid about. That's just a few CYBER ne'er-do-wells, right?

    The point? No, it isn't that "hackers" used to mean something different, that's just ironic gravy. Withering irony, going right over most people's heads. But we'll let that slide for now.

    The point is very much that the term now means exactly nothing and is used to hide ignorance and incompetence. For verily, "hackers" are the great unknown and thus it's Not Our Fault!!1! because IT WAS HACKERS! WE REALLY COULDN'T HELP IT! BECAUSE HACKERRRRRS! -- No you little shits, it's you that did done fsck up. Even if it looks like the great cyber bogeyman from cyberspace did. He didn't, you did. "Hackers" didn't do, you failed.

    This is why the tech as we know it today is not fit for purpose, but crumbly and flakey and generally brittle. Don't breathe too loudly or it'll come crashing down, and let some thief in to empty your coffers, or just fail entirely on its own for no reason.

    Very related to this is the late and great E.W. Dijkstra's lament that we talk about "bugs" like they have a mind of their own, when the proper term would be "defects", as that would immediately make clear what's what. It would be a call to arms to make our tech less defective. Sounds quite different from making it "less buggy", doesn't it? Same with blaming "hackers" for anything and everything.

    "But!" you say, "every news outlet and every computer security company in the world blames 'hackers', why shouldn't we?" Why, of course, that would be because they're either ignorant or assuming you are, or both. Want to keep on playing the game of "we can't do it, cap'n" sheer incompetence? Go right on. Blame "hackers", I dare you.

    No, you don't need "more power" to fix it, you need a clue. And now you have one: Now you know you are being stupid when you do that, just like all those other little shits who predictably haven't managed to punch a hole in the problem for the last thirty or forty years already. Deliberately, because being part of the problem is good money, just like that demotivator. You like failing that hard? You like easy money and "heroically" failing at changing the world for the better? Forge right ahead. There's a whole industry waiting for you to "help" them sell more imperial textile, of the "blame it on the hackers" brand.

  12. Re:Why did they even need a separate domain for th by mccalli · · Score: 1

    It's almost certainly an internal corporate division problem. I'll bet internal processes and/or corporate divisions meant that it was easier for one department to create an entirely new website with their own servers etc. than it was to get Samsung's corporate website, or more accurately the DNS for such, altered by the other project team.

  13. Could have? by Anonymous Coward · · Score: 0

    Did they though? did it all get sorted out properly in the end? Because Donald Trump could have nuked Canada, but he didn't. What other things might of happened that didn't and are worth reporting on today? I didn't murder anyone today, but i saw a lot of people who left them selves vulnerable to being murdered. I also didn't abduct any children, but i did find some children that i probably could have abducted.

  14. The problem is simple by Anonymous Coward · · Score: 0

    The people doing the registering lack the basic clue that the DNS was anything beyond "that thing that makes www.ssuggest.com work", as in, "www dot myname dot extension". No you little shits, it's not an "extension", you have it exactly backwards. The entire thing is a distributed database that allows you to register a domain and you have full dominion inside that domain. That idea means nothing to most people, even many developers don't get this at all. And, of course, registrars encourage the folly so they'll sell more "web names" under various "extensions".

    In a way the failure to understand this discerns the boys from the men... but at the same time, it marks a failure of the men to teach the boys. How would you explain "SOA record" to the average marketeer, or even the average "app dev"? Because let's be frank, it's not the brightest minds that do this sort of thing. Recall the sony rootkit girl? She's not an outlier, she's an example of the species that writes big corporate software, "code grinders", typically fresh graduates with nary a clue because they don't teach that in college any longer.

    And, of course, their "apps" get deployed with the tried-and-true, best current industry practice, "throw it over the fence" method, with no thought for long-term viability and where to fit the abortion into the whole administrative framework. Which stands to reason because most of the time there is no such thing at all.

    Worse, in this case the gimmick had run its projected run and so it got killed. That there were still quite a few devices depending on it still being available... "eh, they're consumers, they're supposed to buy new things, not cling to old crap!"

  15. The cloud is great... by Gravis+Zero · · Score: 1

    at fucking you over. ;)

    --
    Anons need not reply. Questions end with a question mark.
  16. Nope. by Anonymous Coward · · Score: 0

    That is an utterly unhelpful and nasty website. Apart from the stupid tabletised layout that is painful to use on the desktop*, try for example the "about" tab. Popping in to see what it's all about, all I got was an acute sense of wasting my time.

    I thought I'd drop the guys a note on IRC but all that happened was getting shunted to some channel where no talking was allowed. In my mind, this thing is now firmly marked as too self-centered hipsterific to possibly be useful and thereby written off.

    * I'm not using the phone because even booting that, nevermind using its shitty slow browser, is too painful to contemplate. That's with cyanogenmod installed. The first thing I'd want to know after "just what is it and what does it do?" is "is this thing any faster than stock or cyanogen?" but the signs all point to "nope".

    1. Re: Nope. by Anonymous Coward · · Score: 0

      Watch out! We got a badass over here!

  17. signed updates? by Anonymous Coward · · Score: 0

    So the phones will install any received update without checking digital signatures, as long as it appears to be coming from the correct domain? Then it was already a major problem while they did control the domain name.

  18. My bet: "didn't even try" by Anonymous Coward · · Score: 0

    I would bet the root cause of that would be "didn't even try". It could be that they did try and found the internal road wanting, but as an admin even in a small company I've too often been blind-sided by people not even asking, sometimes not even using my services at all but expecting, say, corporate email to suddenly work on domains I didn't even know existed, n'mind registered, n'mind have any administrative access to.

    Yes, this effectively added "be telepathic" to my job requirements, and of course the way they do that is by expecting telepathy to work. Obviously. This is how "lusers" well and truly earn their name, and why bitterness is never wanting among admins.

    1. Re:My bet: "didn't even try" by Gr8Apes · · Score: 1

      Your bitterness is misplaced in this case. The proper response is "Of course we can handle 'yourdomain.com'. You filled out this form and had the company (me) add the domain to our list of supported names (and added the appropriate SMTP clauses to our DNS servers) so we register correctly with the blacklisting services?" as a start. Putting the situation into a "we have these processes and abilities to support you, let's confirm you followed the steps" scenario without being defensive from the start, if done correctly, will put you on a road to being seen as hero instead of the BOFH. And you still get to snicker to yourself, because your status with those present will increase because you were helpful and used an external 3rd party, the blacklisting services which is something most will understand as a negative just from the name, as the target of why this had to happen to bear the negativity of your position.

      Knowing your job is one thing, being able to properly communicate to non-technical people in terms they understand is a job requirement for those that wish to not be the admin that's ignored because they're never seen or worse, worked around because they're perceived as being too painful to work with.

      --
      The cesspool just got a check and balance.
  19. FUD: Could have, DID NOT. by Anonymous Coward · · Score: 0

    Enough time wasted. It is even disputed that this was true.

  20. Proprietary SW is the bug. SW freedom is the fix. by jbn-o · · Score: 1

    What users need is software freedom (the freedom to run, edit, and share the complete corresponding source code to the software) so they can alter the software as they wish, point the device to whatever site they want for updates, and genuinely own their computers. There's no good reason to keep a domain going and address this in a monopoly-sustaining surface level way. Keeping a domain going is not really the issue nor is that a thorough solution to the underlying problem.

    --
    Digital Citizen
  21. I quit using the "smart" features by sentiblue · · Score: 1

    Bought two Samsung TVs with all these networked smart features... Over six months, I see on the screen announcements of discontinued features.... I unplugged my TVs from the wifi connection and only watched TV on them.

  22. Yeah, BUT.... by JustAnotherOldGuy · · Score: 1

    Yeah, but they saved $9.99 by not renewing the domain so it was a huge win for Samsung.

    --
    Just cruising through this digital world at 33 1/3 rpm...
  23. It couldn't happen: it's a Samsung phone. by ctrl-alt-canc · · Score: 1

    It self destroys by design, hackers don't have enough time to compromise the phone.

  24. Re:Proprietary SW is the bug. SW freedom is the fi by Gr8Apes · · Score: 1

    What users need is software freedom (the freedom to run, edit, and share the complete corresponding source code to the software) so they can alter the software as they wish, point the device to whatever site they want for updates, and genuinely own their computers.

    You already can. Just buy the appropriate hardware for whatever software you have rights to and want to install on it. Enjoy.

    --
    The cesspool just got a check and balance.