22/06/2020
Samsung Confirms Critical Security Issue For Millions: Every Galaxy After 2014 Affected
South Korean smartphone vendor Samsung released this week a security update to fix a critical vulnerability impacting all smartphones sold since 2014.
This critical security vulnerability can enable arbitrary remote code ex*****on (RCE) if exploited.
The security flaw resides in how the Android OS flavor running on Samsung devices handles the custom Qmage image format (.qmg), which Samsung smartphones started supporting on all devices released since late 2014.
Mateusz Jurczyk, a security researcher with Google's Project Zero bug-hunting team, discovered a way to exploit how Skia (the Android graphics library) handles Qmage images sent to a device.
BUG CAN BE EXPLOITED WITHOUT USER INTERACTION
Jurczyk says the Qmage bug can be exploited in a zero-click scenario, without any user interaction. This happens because Android redirects all images sent to a device to the Skia library for processing -- such as generating thumbnail previews -- without a user's knowledge.
The researcher developed a proof-of-concept demo exploiting the bug against the Samsung Messages app, included on all Samsung devices and responsible for handling SMS and MMS messages.
Jurczyk said he exploited the bug by sending repeated MMS (multimedia SMS) messages to a Samsung device. Each message attempted to guess the position of the Skia library in the Android phone's memory, a necessary operation to bypass Android's ASLR (Address Space Layout Randomization) protection.
Jurczyk says that once the Skia library was located in memory, a last MMS delivers the actual Qmage payload, which then executed the attacker's code on a device.
The Google researcher says the attack usually needs between 50 and 300 MMS messages to probe and bypass the ASLR, which usually takes around 100 minutes, on average.
Furthermore, Jurczyk says that while the attack might look noisy, it can also be modified to execute without alerting the user.
"I have found ways to get MMS messages fully processed without triggering a notification sound on Android, so fully stealth attacks might be possible," the Google researcher says.
In addition, Jurczyk says that while he did not test exploiting the Qmage bug through other methods outside MMS and the Samsung Messages app, exploitation is theoretically possible against any app running on a Samsung phone that can receive Qmage images from a remote attacker.
What do you need to do now to mitigate the Samsung vulnerability attack risk?
The good news is that, by the Google researchers working with Samsung and disclosing this critical vulnerability, it has now been patched. Well, a patch is included in the May 2020 security update that started circulating last week. The patch "adds the proper validation to prevent memory overwrite," according to the update notes. You are advised to apply this update as a matter of urgency now that the existence of this vulnerability is known by potential threat actors.
The bad news, if your Galaxy smartphone is old enough to be on quarterly security updates now, then will your device get this critical update? What about smartphones that have dropped off of the update cycle altogether, will they get any protection against this zero-click attack?
