Samsung's Tizen is riddled with security flaws, amateurishly written

https://arstechnica.com/gadgets/2017/04/samsungs-tizen-is-riddled-with-security-flaws-amateurishly-written/

by curt15 • 9 years ago

130 63 9 years ago

arstechnica.com

ArtDev• 9 years ago

Samsung should have used Intel Appup instead.

astrodust2• 9 years ago

Symbian! PonyOS! TempleOS! MS-DOS!

Sunset• 9 years ago

TempleOS would be an improvement.

widforss• 9 years ago

Meego Harmattan :'(

59nadir• 9 years ago

Maybe Samsung has a running bet with Huawei over how much crappy code you can push to how many devices. Huawei is still very likely winning, as they had that period when they had to rewrite most of their router software after being outed as having stolen Cisco's code. They just plain wrote the same shit, but replaced everything good with about 2 bad things instead.

jolux2• 9 years ago

Is anyone the least surprised by this?

astrodust2• 9 years ago

Samsung and security problems go together like peanut-butter and jelly or PHP and MySQL.

danso• 9 years ago

...Yes? I mean, Samsung is a big enough company with big enough profits to attract talented candidates and also be selective:

https://www.quora.com/How-would-you-prepare-for-the-Samsung-...

Furthermore, their mobile business is mature and well-known enough that even if they were staffed with complete amateurs whose legacy code was awful, Samsung has been a prominent player for a long time in terms of tech-biz-years. The chances are significant that they have among their ranks a wise-enough manager to realize that it's time to tackle technical debt. Or, in lieu of that, that Samsung would've by now had a come-to-Security-Jesus security fuckup traumatic enough to force a thorough audit and revamp.

Clearly that hasn't happened here so I'm interested in learning the details as they come out.

khedoros12• 9 years ago

I interviewed for a position with one of their Smart TV software development teams. They gave me a simple-ish problem to solve. It needed to be C++ code, it needed to contain no mistakes (although they wouldn't give me a list of what they'd consider "mistakes"), and it had to be done in a plain text editor while talking to the interviewer on the phone.

I took from their "perfect on the first try" requirement for interviewing that their strategy for handling technical debt was supposed to be "don't create technical debt".

djfumberger• 9 years ago

Maybe then security is less to do with individuals and more so company culture ?

thomask0• 9 years ago

Should not come as a surprise...

https://what.thedailywtf.com/topic/15687/code-review-maledic...

https://what.thedailywtf.com/topic/15001/enlightened

coldtea5• 9 years ago

https://what.thedailywtf.com/topic/15001/enlightened

Actually it's the author of the rant that comes of as totally uninformed and with unwarranted snark to boot.

https://what.thedailywtf.com/topic/15001/enlightened/242

phpnode4• 9 years ago

The responses in that thread give me a headache, has the daily wtf forum always been such a wasteland? One of the replies is "someone posted your software to the daily wtf so there MUST be a problem with your software, you should just accept it and here's how you should respond". Maddening

graton• 9 years ago

Not when I read the replies to that reply.

  @Carsten_Haitzler said:

  as for the "you bitch" comment. that does not appear anywhere inside efl at asll. i can only assume you are full of bullshit here as with a lot of the prior "facts" you have disclosed, as a grep through our codebase for efl and elementary shows no such string:

  core/efl.git - EFL core libraries
  evas - change error out from bitch to complain - cosmetic changeHEADmaster
  committer Carsten Haitzler (Rasterman) raster@rasterman.com	2015-03-11 12:59:01 (GMT)

  F#*k off.

phlakaton5• 9 years ago

As bad as the author comes off in that exchange, Mr. Haitzler comes off worse. Nobody should respond to their customers like that, least of all in a public forum, regardless of the provocation.

int_19h5• 9 years ago

That response has plenty of WTFs of its own, e.g.:

efl checks object validity by looking at the first 4 bytes of the memory of the object. in here is a "magic number" that indicates both type and that the object isn't freed or garbage memory.

arrakeen• 9 years ago

thankfully, due to the Wayland protocol, an attacker will not be able to take a screenshot of the device without direct user input.

iamacynic• 9 years ago

everything i've ever purchased from samsung has broken. i just don't even consider their gear now.

stuaxo• 9 years ago

They have always had nice hardware and terrible, terrible software - way back in the J2ME days Samsung were the bain of my life.

Neliquat• 9 years ago

Exactly. I love my galaxy but rooted and flashed it immediately. The bloatware was uncomfortably pervasive, specifically on my carrier. I have other samsung devices, and have had few non firmware issues.

khedoros12• 9 years ago

I've got a TV from them, 8 years old now. The connection from the component cables is slightly "iffy", but everything else has been solid as a rock. I've had 2 Samsung bluray players. The first was a refurb and still works 90% of the time, but the 10% instances are read errors from the disk drive. After 7 years of use, I was happy with it for the price I paid. The replacement player seems OK so far, although there were a lot of "features" to disable. My Galaxy Nexus is still my favorite phone. I'd pay a lot for that phone, but with upgraded guts.

Jabbles• 9 years ago

Theory: Samsung is just funding Tizen development to gain leverage over Android

saagarjha• 9 years ago

Wasn't the main reason why they wrote Tizen? Because Google was pushing them around too much?

throw810012• 9 years ago

Tizen was/is mostly built out of a Samsung subsidiary in Warsaw, Poland. (Several thousand software engineers in total.) I worked with Polish software engineers for a western company that used the same outsourcing method during the same time that Tizen was being built. We had hires from Samsung and they had hires from us.

I think that what I witnessed at our company (which I won't name) is representative for what Samsung saw.

The stereotypical development model was one where individual developers were perceived as lego blocks that could be moved from one area to another about as the project(s) progressed without any regard for the individual contributors accumulated knowledge. Large volumes of contributors ("bug resolvers") were valued over smaller, coherent teams with smarter contributors.

There was also a disturbing amount of machoismo surrounding everything - nothing could be questioned; everything was a of sense pride to someone.

(What I heard from the local engineering managers supports the above.)

throw810012• 9 years ago

My assessment after having a few years perspective:

- There's quite a big span between the average level to high level to top level when it comes to polish devs. Specifically, it goes a lot lever than what I'm used to. It goes high too, though, but those individuals are not necessarily cheaper than a western european employee of the same calibre (probably similar).

- (Engineering) Management culture is totally whacko and quite a bit behind the western world. I blame the machoismo.

dgregd• 9 years ago

There are a lot of good software engineers in Warsaw, working at various companies. However most of companies here doesn't care that much about top talent. They just want to pay an average salary and that's all.

It is very rare that Warsaw devs that write good quality code are compensated appropriately.

demarq2• 9 years ago

Is it that big industrial corporations are bad at creating code? Toyota, samsung, synaptic.

I'm really beggining to think that code should be left to smaller and medium sized outfits. i.e samsung should buy or hire a small startup to independently develop and grow their next ecosystem. Large enterprises just seem too clumsy pull pull it off unless they wholly dedicate themselves to developing that one piece of technology.

itcmcgrath• 9 years ago

The counter arguments include Google, Apple, Microsoft, etc.

I think the big vs small comparison is flawed. I've seen some atrocious code produced by small/medium sized outfits. My fondest memory including auditing code from a 3 person outfit who's code quite literally setup an RPC on the server that executed any string it was sent, verbatim, against a database that handled money.

demarq2• 9 years ago

Those counter examples were all software startups. And have very very different cultures to other corporations their size due to their roots.

ungzd• 9 years ago

Samsung is primarily home appliances corporation. Maybe their management treats TVs as "devices that display TV broadcasts" and phones as "devices for talking over distance". In this worldview there are no things like "bugs", "vulnerabilities", "software updates". Software inside these devices is at the same concern as prints on cardboard box. These devices, including phones, are sold at home appliance stores where "shop assistants" say you things like "That's Ultra Mega HD Super", "8 Cores and water resistant case" and once appliance is sold it is sold and no more problem of company. If it turns on and display pictures then it works.

Sharlin• 9 years ago

Hardware manufacturers have always been bad at writing software. Especially in certain Far East cultures where software engineering is traditionally not even considered "real engineering".

contingencies• 9 years ago

In Samsung HQ in Suwon, Korea, back in 2010 in the leadup to the launch of the Galaxy device series, each individual OS had its own literal skyscraper in the HQ campus. One for BadaOS, one for Android, one for Windows Mobile. I don't think they communicated at all, as a general rule. Even in the Android one where I was working, the whole floor was nominal software guys but only one knew how to compile the firmware everyone was working on! They actually had to fly in a team of low-level programmers from Samsung India to get the device firmware up to speed in time for the hardware launch. It was an extremely interesting organization to spend a few days in from an anthropological perspective, but I left swearing that if the experience was a vision of the future I wanted no part of it.

mihaela• 9 years ago

I was hoping Samsung would do something with Tizen as opposed to Android. Sorry to hear this.

alimbada2• 9 years ago

I'm very tempted to buy a Samsung TV (primarily for the the low input lag times which makes them good for gaming) and I plan to keep it offline (no WiFi or Ethernet connection), using a Chromecast and a HTPC+Kodi instead for streaming. With that in mind, should I be worried about security flaws?

MatthaeusHarris• 9 years ago

Depends on your threat model.

From TFA: Another attack on Samsung Smart TVs was published last week that used malicious commands embedded in broadcast TV signals.

So, even if it's airgapped, a tv that's been compromised in this way is effectively a hostile general-purpose computer with a wifi card running inside your house.

If this is something you would do for a Klondike bar, then go ahead. I'll keep my dumb TV and my Kodi box, though.

scorpioxy• 9 years ago

Agreed. These "smart" TVs mostly run outdated and buggy software which are difficult if not impossible to update either because of technical limitations or because the manufacturer doesn't care enough after getting your money.

So why bother with a "smart" TV if you're going to be using an external computer anyway. Saving a few hundred dollars to spend on that external computer seems like a better investment. I run a "dumb" big LG TV hooked up to a raspberry pi running Kodi via LibreElec. I'm very happy with the set up in terms of functionality and price.

Edit: the attack via signal is linked from the article, reading now.

danpalmer• 9 years ago

This doesn't surprise me. A company I used to work for fielded a team at most Pwn2Own competitions, and it was widely regarded as "not good sport" to take on a Samsung phone because they were so bad.

newsat132• 9 years ago

I can't believe there are still string overflow bugs. Might be a good idea to invest sometime in Rust. On a side note, I have been looking for a good doc on how I can slowly migrate my existing code base step-by-step to Rust. A total rewrite is out of question, we would rather ship our product step by step. Does anyone know of such a doc?

steveklabnik• 9 years ago

https://github.com/carols10cents/rust-out-your-c-talk

http://blog.adamperry.me/rust/2016/06/11/baby-steps-porting-...

newsat132• 9 years ago

Thanks!

Samsung's Tizen is riddled with security flaws, amateurishly written

Related Stories