Google says surveillance vendor targeted Samsung phones with zero-days

guest · Nov 12, 2022

By Zack Whittaker @zackwhittaker - November 10, 2022

Google says it has evidence that a commercial surveillance vendor was exploiting three zero-day security vulnerabilities found in newer Samsung smartphones.
Click to expand...

The vulnerabilities, discovered in Samsung’s custom-built software, were used together as part of an exploit chain to target Samsung phones running Android. The chained vulnerabilities allow an attacker to gain kernel read and write privileges as the root user, and ultimately expose a device’s data.

Google Project Zero security researcher Maddie Stone said in a blog post that the exploit chain targets Samsung phones with a Exynos chip running a specific kernel version. Samsung phones are sold with Exynos chips primarily across Europe, the Middle East, and Africa, which is likely where the targets of the surveillance are located.
Click to expand...

Stone said Samsung phones running the affected kernel at the time include the S10, A50, and A51.

The flaws, since patched, were exploited by a malicious Android app, which the user may have been tricked into installing from outside of the app store. The malicious app allows the attacker to escape the app sandbox designed to contain its activity, and access the rest of the device’s operating system. Only a component of the exploit app was obtained, Stone said, so it isn’t known what the final payload was, even if the three vulnerabilities paved the way for its eventual delivery.
Click to expand...

Google Project Zero: A Very Powerful Clipboard: Analysis of a Samsung in-the-wild exploit chain

Note: The three vulnerabilities discussed in this blog were all fixed in Samsung’s March 2021 release. They were fixed as CVE-2021-25337, CVE-2021-25369, CVE-2021-25370. To ensure your Samsung device is up-to-date under settings you can check that your device is running SMR Mar-2021 or later.
Click to expand...

While we understand that Samsung has yet to annotate any vulnerabilities as in-the-wild, going forward, Samsung has committed to publicly sharing when vulnerabilities may be under limited, targeted exploitation, as part of their release notes.

We hope that, like Samsung, others will join their industry peers in disclosing when there is evidence to suggest that a vulnerability is being exploited in-the-wild in one of their products.
Click to expand...

Log in or Sign up

Google says surveillance vendor targeted Samsung phones with zero-days

guest Guest

Log in or Sign up

Google says surveillance vendor targeted Samsung phones with zero-days

guest Guest

Useful Searches