Up to 600 Million Samsung Phones Exposed to Attack, Control by Hackers

    A Samsung Galaxy Note 3. (Karlis Dambrans / CC BY 2.0)

A software vulnerability on hundreds of millions of Samsung Galaxy phones allows hackers—civilian or government—to “look through the phones’ camera, listen to the microphone, read incoming and outgoing texts and install apps,” according to researchers cited in The Independent.

Until Samsung fixes the problem, there is little that owners can do beyond keeping their phones off unsecured wireless Internet networks.

The Independent reports:

The hack works by exploiting a problem with the Samsung IME keyboard, a re-packaged version of SwiftKey that the company puts in Samsung Galaxy keyboards. That software periodically asks a server whether it needs updating — but hackers can easily get in the way of that request, pretend to be the server, and send malicious code to the phone.

It doesn’t matter if Samsung users are using the keyboard or not, because it is still making the requests. But users of SwiftKey on other Android phones seem to be safe, because the problem appears to be isolated to Samsung’s version of the software.

There are usually protections in place that stop hackers from performing what is called a “man in the middle attack”, by encrypting communication with the server, as well as ones to stop any malicious code from getting too deep into the phone. But Samsung has given its version of the software special permissions, which means that hackers can get through the protections in Android that stop third-party apps from tampering with other bits of the device.

Though staying away from unsecured wifi networks will make users less likely to be hit by the problem, it doesn’t mean that they’re safe. Hackers could still get in the way of the messages during the course of normal browsing.

Read more here.

— Posted by Alexander Reed Kelly.