Zero-click vulnerability found in Samsung mobile phones

guest · May 9, 2020

Zero-click vulnerability found in Samsung mobile phones
For six years Samsung smartphone users have been at risk from critical security bug
May 8, 2020
https://www.scmagazine.com/home/sec...vulnerability-found-in-samsung-mobile-phones/

A zero-click vulnerability in Samsung mobile phones if exploited could allow a malicious actor to gain access to all the permissions and privileges associated with Samsung Messenger with no interaction by the user.

The problem only exists within Samsung phones running Android version 4.4.4 or later. This version was first offered in late 2014 but is still actively developed by the vendor with the latest version being pushed out on January 10, 2020 or just before Samsung was informed of the problem on January 28.
Click to expand...

Samsung issued a patch in May. If a device is not updated an attacker could possibly remotely execute arbitrary code execution, but the patch adds the proper validation to prevent memory overwrite. A successful attack would give the threat actor the same privileges as the owner and thus access to personal user information: call logs, contacts, microphone, storage and SMS.

Noting Jurczyk’s find, Tripwire noted, “What makes such a vulnerability particularly concerning is the claim that it could be done without any user interaction, a ‘zero click’ scenario where – for instance – a vulnerable phone just generating a thumbnail preview for a notification message might actually allow an attack.”
A successful attack would not be a simple or quick task. Jurczyk estimated it would take a minimum of about 50 up to 300 MMS attacks for the vulnerability to be exploited.
Click to expand...

Today I'm happy to release new research I've been working on for a while: 0-click RCE via MMS in all modern Samsung phones (released 2015+), due to numerous bugs in a little-known custom "Qmage" image codec supported by Skia on Samsung devices. Demo: https://t.co/8KRIhy4Fpk
— j00ru//vx (@j00ru) May 6, 2020
Click to expand...

Log in or Sign up

Zero-click vulnerability found in Samsung mobile phones

guest Guest

Log in or Sign up

Zero-click vulnerability found in Samsung mobile phones

guest Guest

Useful Searches