Some Samsung Galaxy devices contain a file access backdoor, Replicant developers say

A software program shipped with some Samsung mobile devices allows access to the file system through the modem, the developers said

The developers of Replicant, a mobile OS based on Android, claim to have found a backdoor vulnerability in a software component shipped with some Samsung Galaxy devices that potentially provides remote access to users' private files through the device modem.

The problem is located in the proprietary library that handles communications between the Android OS and the firmware running on the modem chipset, also known as the baseband or radio processor.

"This program is shipped with the Samsung Galaxy devices and makes it possible for the modem to read, write, and delete files on the phone's storage," said Replicant developer Paul Kocialkowski Wednesday in a blog post on the website of the Free Software Foundation. "On several phone models, this program runs with sufficient rights to access and modify the user's personal data."

According to a more detailed analysis of the issue on the Replicant wiki site, a proprietary Samsung library called libsec-ril.so that uses the Samsung IPC protocol to communicate with the modem, implements a series of commands that allow the modem to perform operations on the file system.

The program automatically appends a specific path to the commands, probably in an attempt to restrict the file operations to a certain area of the file system, but according to the Replicant developers, escaping the appended path is fairly easy.

Which files can be accessed depends on the privileges of the user account under which the software component runs, according to the Replicant developers. On some devices that account is root -- the highest privileged account -- giving the modem access to the entire file system.

"In other cases, it runs as an unprivileged user that can still access the user's personal data (/sdcard)," the developers said. "Finally, some devices may implement SELinux, which considerably restricts the scope of possible files that the modem can access, including the user's personal data (/sdcard/)."

The devices identified so far by the Replicant developers as being affected are Nexus S (I902x), Galaxy S (I9000), Galaxy S2 (I9100), Galaxy Note (N7000), Galaxy Nexus (I9250), Galaxy Tab 2 7.0 (P31xx), Galaxy Tab 2 10.1 (P51xx), Galaxy S3 (I9300) and Galaxy Note 2 (N7100). However, others might also use the vulnerable component.

The Replicant developers were not specific about how this backdoor can be remotely exploited, but noted that in general, baseband firmware can have vulnerabilities and can provide access to other hardware components, including the applications processor used by the main operating system -- in this case Android. Other security researchers have also warned in the past that potential baseband vulnerabilities can undermine the application-layer security features of the OS.

"It is possible to build a device that isolates the modem from the rest of the phone, so it can't mess with the main processor or access other components such as the camera or the GPS," Kocialkowski said. "Very few devices offer such guarantees. In most devices, for all we know, the modem may have total control over the applications processor and the system, but that's nothing new."

The goal of the Replicant project is to create an Android-based OS that doesn't contain any proprietary software components. This requires replacing components like libsec-ril.so with open-source and non-proprietary programs that implement the same functionality.

"Our free replacement for that non-free program does not implement this backdoor," Kocialkowski said. "If the modem asks to read or write files, Replicant does not cooperate with it."

However, not all baseband security risks can be mitigated in this manner and ultimately it depends on how the device is designed. "If the modem can take control of the main processor and rewrite the software in the latter, there is no way for a main processor system such as Replicant to stop it," Kocialkowski said.

Samsung Electronics did not immediately respond to a request for comment.

Join the PC World newsletter!

Error: Please check your email address.

Tags securityAndroidAccess control and authenticationFree Software FoundationSamsung Electronicssmartphonesmobile securityExploits / vulnerabilitiesprivacyAndroid OSconsumer electronics

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service

Most Popular Reviews

Follow Us

Best Deals on GoodGearGuide

Shopping.com

Latest News Articles

Resources

GGG Evaluation Team

Kathy Cassidy

STYLISTIC Q702

First impression on unpacking the Q702 test unit was the solid feel and clean, minimalist styling.

Anthony Grifoni

STYLISTIC Q572

For work use, Microsoft Word and Excel programs pre-installed on the device are adequate for preparing short documents.

Steph Mundell

LIFEBOOK UH574

The Fujitsu LifeBook UH574 allowed for great mobility without being obnoxiously heavy or clunky. Its twelve hours of battery life did not disappoint.

Andrew Mitsi

STYLISTIC Q702

The screen was particularly good. It is bright and visible from most angles, however heat is an issue, particularly around the Windows button on the front, and on the back where the battery housing is located.

Simon Harriott

STYLISTIC Q702

My first impression after unboxing the Q702 is that it is a nice looking unit. Styling is somewhat minimalist but very effective. The tablet part, once detached, has a nice weight, and no buttons or switches are located in awkward or intrusive positions.

Latest Jobs

Shopping.com

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?