CHICAGO — Millions of Samsung Galaxy phones are likely <a href=”https://www.nowsecure.com/keyboard-vulnerability/”; target=”_blank”>impacted by a security flaw</a> that could allow attackers to install malware or eavesdrop on calls — and there’s not much users can do about it.
<a href=”https://www.nowsecure.com/keyboard-vulnerability/”; target=”_blank”>Security firm NowSecure</a> said a bug in the pre-installed Swift keyboard software installed on more than 600 million Samsung devices could allow a hacker “execute code as a privileged user” to gain access to the device and the user’s network.
If the flaw in the keyboard is exploited, the attacker could access the phone’s GPS, camera, microphone, install malicious apps, eavesdrop on calls, and access photos and messages. The keyboard cannot be disabled or uninstalled. Even when it’s not being used, the security flaw can still be exploited.
The list of devices includes the Galaxy S6, Galaxy S5, Galaxy S4, and Galaxy S4 Mini. Verizon, AT&T, Sprint, and T-Mobile customers are all impacted.
The flaw was discovered by Ryan Welton, a researcher at NowSecure. The firm notified Samsung and the Google Android security team in December.
<blockquote>”While Samsung began providing a patch to mobile network operators in early 2015, it is unknown if the carriers have provided the patch to the devices on their network. In addition, it is difficult to determine how many mobile device users remain vulnerable, given the devices models and number of network operators globally.”</blockquote>
While the vulnerability impacts millions of phones, it’s still considered to be “low risk” by many experts because the user must be connected to a compromised Wi-Fi network and is conducting a language update at that specific time.
Samsung has not publicly commented on the security flaw.
<a href=”http://techcrunch.com/2015/06/17/no-its-samsung-not-swiftkey-that-is-to-blame-for-this-keyboard-security-scare/”>According to TechCrunch</a>, Swiftkey supplies Samsung with the core technology that powers the word predictions in the keyboard. However, it’s the way the keyboard was integrated on Samsung devices that introduced the security vulnerability. Swiftkey apps in the app store have nothing to do with the security vulnerability.
According to TechCrunch, several sources have said that Samsung <a href=”https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/”; target=”_blank”>”screwed up”</a> when it came to implementing Swiftkey’s keyboard and responding after they were notified of the security vulnerability three months ago.
SwiftKey released a statement <a href=”http://swiftkey.com/en/blog/samsung-keyboard-security-vulnerability-swiftkey/”>in a blog post:</a>
<blockquote>”We supply Samsung with the core technology that powers the word predictions in their keyboard. It appears that the way this technology was integrated on Samsung devices introduced the security vulnerability. We are doing everything we can to support our long-time partner Samsung in their efforts to resolve this obscure but important security issue.
The vulnerability in question poses a low risk: a user must be connected to a compromised network (such as a spoofed public Wi-Fi network), where a hacker with the right tools has specifically intended to gain access to their device. This access is then only possible if the user’s keyboard is conducting a language update at that specific time, while connected to the compromised network.”</blockquote>
