One of the major issues with closed source operating systems is that there is no independent code review: you can never truly tell what is happening. Backdoors that have been placed in a device, maliciously or otherwise, could allow an attacker to have the power to wreak havoc on an unsuspecting victim.
Paul Kocialkowski, a developer for a fully free/open version of Android, published a guest post on the Free Software Foundation detailing his discovery of a backdoor that has been implemented in a range of Samsung Galaxy devices. He commented on how he had found a Samsung program running in the background, binded to the communications processor, that allows the modem to remotely read, write, and delete files on the user's phone storage. Several Samsung devices give that program sufficient rights to access and modify the user's personal data.
"Provided that the modem runs proprietary software and can be remotely controlled, that backdoor provides remote access to the phone's data, even in the case where the modem is isolated and cannot access the storage directly." - Kocialkowski
As always, some backdoors might have been placed there accidently, however the Replicant developers mention on the technical description that they do not believe it to be the case. They comment that the incriminated parts "were not found to have any legitimacy nor relevant use-case." Even if it wasn't malicious in intent, the current situation is the same, and as of right now there exists a backdoor in the affected devices.
Replicant has published a patch which is a replacement for the Samsung-RIL library. You can view the full list of affected devices, technical details of the backdoor, and access the patch at the Replicant wiki.
This comes weeks after the SSL/TLS flaw discovered affecting iOS and OSX devices that resulted in the validation of invalid certificates in any program that depended on the built-in SSL libraries. Whether or not Samsung will respond to this backdoor as swiftly as Apple responded to their vulnerability, however, is yet to be seen.
Source: FSF | Image via Shutterstock
Following the lead of the FSF, Neowin would like to encourage all current and prospective Samsung Galaxy owners to appeal to Samsung for an explanation as to why such backdoor exists.
65 Comments - Add comment