Samsung Plugs Remote Wipe Flaw, Urges Galaxy SIII Owners To Update

http://techcrunch.com/2012/09/26/samsung-speedily-plugs-remote-wipe-flaw-urges-galaxy-siii-owners-to-update/

by EwanToo • 14 years ago

30 18 14 years ago

ryanmacg2• 14 years ago

The article is kind of misleading, the exploit was part of Android rather than anything to do with Samsung and was patched in AOSP as of 4.1.1(?). This meansn it was an issue on any phone that dialled automatically and doesn't run a build with the patch applied. Also the patch from Samsung was part of an OTA update from at least a week ago in the US, I know it pinged up just after I booted the S3 I bought on Saturday in the UK.

estel• 14 years ago

In what way was the exploit a part of Android? I thought it was a touchwiz dialer issue that it automatically dialled USSD numbers without secondary confirmation from the user?

dylancarruthers• 14 years ago

I'm not arguing either way but why would this be resetting via an USSD be a useful feature?

jrabone2• 14 years ago

No, I've confirmed that a random sample of HTC & Huawei phones around my office are also vulnerable. Nothing specific to TouchWiz. The thing that MIGHT be specific to Samsung is the actual remote wipe code, but relying on that is simply security-by-obscurity. I'd bet ALL phones have got some USSD code you'd rather not be instantly triggerable by a web page.

bmunro• 14 years ago

My Galaxy Nexus fails the test at http://dylanreeve.com/phone.php

Apparently the bug is fixed in 4.1 (I'm still on 4.0.4). I installed a temporary fix - TelStop. It just handles telephone Intents so that you get a popup asking you to choose an application.

ryanmacg2• 14 years ago

See this commit https://android.googlesource.com/platform/packages/apps/Cont...

it was an issue in any Android variant that featured autodial, I saw someone reporting it worked on CyanogenMod 7 for example and it also worked on some HTC devices

josephlord3• 14 years ago

Well done to Samsung for getting the update out quickly (although obviously better not to ship with the vulnerability).

Is this something the carriers get to block or is it direct over the Internet to everyone? One of my big concerns about Android is about the ability to get security fixes. The slow major updates are very public but if security fixes are better distributed much quicker that isn't so much of a worry.

In the absence of reassurance my advice to friends and family if asked would be to avoid Android (except the Nexus models which I think can always be updated).

antidoh2• 14 years ago

This (updates of any kind) is 25% of why my Galaxy is sitting in my sock drawer (75% being the cost of the data plan and "being a hotspot" fee).

I discovered that I bought a computer that cannot be updated except by the whim of an intermediary, the telco. I watched for a year while my phone languished under its originally installed version of Android, while the update rolled out around the world and my carrier (Sprint) said "no shit really, soon, real soon now." That's too much bullshit for too much money.

mrich2• 14 years ago

What is your alternative?

juliano_q• 14 years ago

Yes, it is pretty bad. But it is quite easy to update your phone using Odin. It is no excuse, obviously the right way would be to receive it on a timely manner, but if you can update yourself in like 30 minutes I see no reason to wait for a year.

millerm• 14 years ago

Wow, that was quite fast. I'm an iPhone fanboy and I have to admit I'm a bit jealous of that kind of turnaround. I'll be stuck with this for a while I bet: http://www.tuaw.com/2012/09/20/safari-exploit-used-to-gain-c...

Samsung Plugs Remote Wipe Flaw, Urges Galaxy SIII Owners To Update

Related Stories