Hardware optimize

Samsung: Exynos 4 processors are vulnerable to serious attack

Gina Smith reports on the recent vulnerability of Exynos 4 processors, found in Samsung smartphones.

[Update 12/17/12: The vulnerability was found with Exynos 4 processors, not Exynos 5 processors as stated in the original post.]

Got a Samsung S II or S III, Galaxy Note or Note II, or the Galaxy Tab 2.8 or Galaxy 10.1 among your users in the enterprise? Get ready for a rough day.

Before you have coffee -- or during -- find out who's got these devices in your biz, who has rooted them and who hasn't, and remove all company data from them. Stat. Here's why. According to XDA Developers news that bubbled up to boiling point over the last several hours, Samsung devices powered by the Exynos 4 processors are vulnerable to serious attack -- some of which will access any data you've got stored in RAM and, no one yet seems quite sure, EEPROM.

Happy Monday, IT pros. Don't shoot the messenger.

XDA Developers claims that the problem isn't limited only to Samsung.

If you've been saving pennies or going rogue and buying instead from mass makers like Lenovo or lesser knowns like Meizu, your data is potentially compromised too. Many of these also have Exynos 4 processors. Note that it won't take long to have your device(s) compromised. I already found one video on YouTube that explains how to do it, and as of this writing, YouTube had not removed it.

Your users -- even the sneakiest, smartest, and savviest -- likely won't even know it's happening. There's no message that pops up saying something to the effect of: We are stealing your data now. Hang tight.

One user on the XDA Developers site wrote over the weekend, "The good news is we can easily obtain root on these devices. And the bad is there is no control over it."

What's the best option, short of ripping away Samsung and other Exynos 4-based smartphones and tablets from users? Root it. An XDA Developer who goes by the name of "chainfire" has released a kit for savvy users and IT pros that will root the device and, essentially, patch over the vulnerability.

Of course, there's a catch. If you root your phone, you void the warranty. But what would you rather have voided -- the security of your enterprise or the warranties of a few phones with warranties you'll likely never take advantage of anyway?

XDA Developers says it has notified Samsung, and so have I. This isn't the first time security problems have plagued Samsung Android phones. So, keep an eye on TechRepublic and/or aNewDomain.net -- when we hear of a permanent fix, we'll make every effort to have you be first to know. In the meantime, you should also check out the XDA Developers forum.

About

Gina Smith is a NYT best-selling author of iWOZ, the biography of Steve Wozniak. She is a vet tech journalist and chief of the geek tech site, aNewDomain.net.

17 comments
jjlipka
jjlipka

The Galaxy S 3 doesn't have the Quad 4 processor. There were going to but switched to the Qualcomm X2 1.5 GHz MSM8960

Slayer_
Slayer_

How do they get your data, do they need physical access to the device? Is the Google Nexus vulnerable? All it grabs is RAM data, what use is that? Without context is would be gibberish.

Sonja Thompson
Sonja Thompson

An update has been made to this post, including verbiage about how the vulnerability was indeed found in Exynos 4 processors, not Exynos 5 processors as Gina originally stated. Thanks to Michael Kassner for pinging me and bringing this correction to my attention.

jim.page
jim.page

According to the XDA Developers and other blogs relating to this vulnerability, the Exynos 4 processors (specifically the 4210 and 4412 processors) are vulnerable, NOT the Exynos 5 processors!

GSG
GSG

Is it through bluetooth, NFC, website, link, download, etc? I use my Galaxy S3 for email and calendar, and so am set up with encryption and can easily do a remote wipe. Also, NFC is disabled, and I keep bluetooth turned off except when I'm in my car. I use secure encrypted networks, and never jump on unsecured, public wifi.

Gerbilferrit
Gerbilferrit

any more info on what's being leaked or potentially being leaked from these phones?

Michael Kassner
Michael Kassner

Although vulnerability is serious, other brands have experienced this as well. And as far as it stands now, it is only a local attack -- not remote. I do not plan to stop using my S3.

fishystory
fishystory

The Samsung Galaxy S III i9305 and i9300 are affected. Both of these international models use the Exynos 4412 Quad processor. The Samsung Galaxy S III T999, I747 and CDMA US-based models, with the Qualcomm MSM8960 Snapdragon processor and also the Galaxy S III Mini are unaffected by this vulnerability. Sources: http://forum.xda-developers.com/showthread.php?t=2048511 http://www.gsmarena.com/samsung_i9300_galaxy_s_iii-4238.php http://www.gsmarena.com/samsung_i9305_galaxy_s_iii-5001.php

HAL 9000
HAL 9000

[i]indeed found in [b]Exynos 4 processors[/b], not [b]Exynos 4 processors[/i][/b] Aren't those the same Processors? So how can then be a fault but not a fault? Did you make a Typo and should have had Exynos 5 for the second mention? Col

Michael Kassner
Michael Kassner

I agree Jim and was going to mention it to my editor, but wanted to double check first.

Michael Kassner
Michael Kassner

The developers released information about potential issues. My guess is that the nefarious types will try to create an app.

DWFields
DWFields

I haven't read anything that says the attacker has to be in close proximity to the device, which implies that any malware--even a drive-by web page--may be all it takes. I'll admit I simply do not know and since the smartphone I use does not use an Exynos 5 processor (but rather an Samsung-burned A5 Apple-designed processor) I believe I'm safe from this particular attack. As far as "other brands have experienced this as well," well even the article stated that, pointing out that the Exynos 5 processor is used in a number of different brands, though the user may not be aware of that fact.

GSG
GSG

I followed some of the links in the article and didn't find any mention of exploits, so I wondered if it just hasn't gotten out there yet.

Michael Kassner
Michael Kassner

As for other brands, I meant that other processor developers (Not Samsung) have dealt with this or similar mistakes in permissions.