Some Samsung Galaxy devices contain a file access backdoor, Replicant developers say

A software program shipped with some Samsung mobile devices allows access to the file system through the modem, the developers said

The developers of Replicant, a mobile OS based on Android, claim to have found a backdoor vulnerability in a software component shipped with some Samsung Galaxy devices that potentially provides remote access to users' private files through the device modem.

The problem is located in the proprietary library that handles communications between the Android OS and the firmware running on the modem chipset, also known as the baseband or radio processor.

"This program is shipped with the Samsung Galaxy devices and makes it possible for the modem to read, write, and delete files on the phone's storage," said Replicant developer Paul Kocialkowski Wednesday in a blog post on the website of the Free Software Foundation. "On several phone models, this program runs with sufficient rights to access and modify the user's personal data."

According to a more detailed analysis of the issue on the Replicant wiki site, a proprietary Samsung library called libsec-ril.so that uses the Samsung IPC protocol to communicate with the modem, implements a series of commands that allow the modem to perform operations on the file system.

The program automatically appends a specific path to the commands, probably in an attempt to restrict the file operations to a certain area of the file system, but according to the Replicant developers, escaping the appended path is fairly easy.

Which files can be accessed depends on the privileges of the user account under which the software component runs, according to the Replicant developers. On some devices that account is root -- the highest privileged account -- giving the modem access to the entire file system.

"In other cases, it runs as an unprivileged user that can still access the user's personal data (/sdcard)," the developers said. "Finally, some devices may implement SELinux, which considerably restricts the scope of possible files that the modem can access, including the user's personal data (/sdcard/)."

The devices identified so far by the Replicant developers as being affected are Nexus S (I902x), Galaxy S (I9000), Galaxy S2 (I9100), Galaxy Note (N7000), Galaxy Nexus (I9250), Galaxy Tab 2 7.0 (P31xx), Galaxy Tab 2 10.1 (P51xx), Galaxy S3 (I9300) and Galaxy Note 2 (N7100). However, others might also use the vulnerable component.

The Replicant developers were not specific about how this backdoor can be remotely exploited, but noted that in general, baseband firmware can have vulnerabilities and can provide access to other hardware components, including the applications processor used by the main operating system -- in this case Android. Other security researchers have also warned in the past that potential baseband vulnerabilities can undermine the application-layer security features of the OS.

"It is possible to build a device that isolates the modem from the rest of the phone, so it can't mess with the main processor or access other components such as the camera or the GPS," Kocialkowski said. "Very few devices offer such guarantees. In most devices, for all we know, the modem may have total control over the applications processor and the system, but that's nothing new."

The goal of the Replicant project is to create an Android-based OS that doesn't contain any proprietary software components. This requires replacing components like libsec-ril.so with open-source and non-proprietary programs that implement the same functionality.

"Our free replacement for that non-free program does not implement this backdoor," Kocialkowski said. "If the modem asks to read or write files, Replicant does not cooperate with it."

However, not all baseband security risks can be mitigated in this manner and ultimately it depends on how the device is designed. "If the modem can take control of the main processor and rewrite the software in the latter, there is no way for a main processor system such as Replicant to stop it," Kocialkowski said.

Samsung Electronics did not immediately respond to a request for comment.

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags privacysmartphonesmobile securityAndroidconsumer electronicsFree Software FoundationSamsung ElectronicsAccess control and authenticationExploits / vulnerabilitiesAndroid OS

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Brand Post

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Luke Hill

MSI GT75 TITAN

I need power and lots of it. As a Front End Web developer anything less just won’t cut it which is why the MSI GT75 is an outstanding laptop for me. It’s a sleek and futuristic looking, high quality, beast that has a touch of sci-fi flare about it.

Emily Tyson

MSI GE63 Raider

If you’re looking to invest in your next work horse laptop for work or home use, you can’t go wrong with the MSI GE63.

Laura Johnston

MSI GS65 Stealth Thin

If you can afford the price tag, it is well worth the money. It out performs any other laptop I have tried for gaming, and the transportable design and incredible display also make it ideal for work.

Andrew Teoh

Brother MFC-L9570CDW Multifunction Printer

Touch screen visibility and operation was great and easy to navigate. Each menu and sub-menu was in an understandable order and category

Louise Coady

Brother MFC-L9570CDW Multifunction Printer

The printer was convenient, produced clear and vibrant images and was very easy to use

Edwina Hargreaves

WD My Cloud Home

I would recommend this device for families and small businesses who want one safe place to store all their important digital content and a way to easily share it with friends, family, business partners, or customers.

Featured Content

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?