Samsung promises fix for vulnerability in Android devices

Samsung said Wednesday it is working on an update for a software flaw that could allow attackers to siphon personal data from a phone.

The vulnerability affects Samsung’s S2 and S3 phones and several models of its Galaxy line, including the Note, Note II, Note Plus and Note 10.1, all of which use the Korean company’s Exynos 4210 and 4412 model processors.

The flaw and an exploit was disclosed on Sunday on XDA Developers, a forum for mobile developers. Samsung’s engineers apparently made a poor configuration mistake involving the Android kernel and failed to restrict kernel address space mapped to userspace via the /dev/exynos-mem device driver.

An application incorporating the exploit was created by a developer nicknamed Chainfire on the forum.

Chainfire’s application allows users to modify the phone to make the exploit ineffective, but the fix also disables a device’s camera in some instances depending on the device’s firmware version.

Chainfire warned that other application-based fixes that have been developed are seriously flawed, so users should not depend on those to provide protection until Samsung issues an update.

“The only true solution is a kernel fix that simply removes the exploitable memory device, but that requires a non-universal device update,” Chainfire wrote.

Samsung downplayed the seriousness of the issue, saying in a statement that “the issue may arise only when a malicious application is operated on the affected devices; however, this does not affect most devices operating credible and authenticated applications.”

Samsung’s devices can be updated over the air by operators, or users can do it with a desktop computer using the company’s Kies software, according to a spokesman.

Android applications submitted to Google’s Play store are checked for malicious behavior, but there are many websites around the Internet offering Android applications, many of which purport to be a legitimate but are actually malicious software and could incorporate this exploit.

Since an exploit has been published, Trend Micro said on Wednesday that it is only a matter of time before hackers begin to use it. Samsung said it “will continue to closely monitor the situation until the software fix has been made available to all affected mobile devices.” It did not specify when the fix would be available.

Send news tips and comments to jeremy_kirk@idg.com. Follow me on Twitter: @jeremy_kirk