Top Stories
​

An analysis of pre-installed apps on Samsung devices has revealed multiple security bugs which could have been exploited by attackers to spy on users and steal their data.
The vulnerabilities were uncovered by mobile security company Oversecured and first reported by Hacker News.
Oversecured spent two weeks looking for gaps in the security of these apps and discovered seven dangerous vulnerabilities.
The bugs could have resulted in significant privacy violations, with hackers able to access sensitive communication on the users’ devices.
“The impact of these bugs could have allowed an attacker to access and edit the victims contacts, calls, SMS/MMS, install arbitrary apps with device administrator rights, or read and write arbitrary files on behalf of a system user which could change the devices settings,” Oversecured said.
The table below shows the apps in which the vulnerabilities were discovered as well as a description of what kind of attack they allowed.

Vulnerabilities in Samsung pre-installed apps
CVE SVE Affected app Description
CVE-2021-25388 SVE-2021-20636 Knox Core Installation of arbitrary apps and device-wide theft of arbitrary files.
CVE-2021-25356 SVE-2021-20733 Managed Provisioning Installing third-party apps and granting them Device Admin permissions.
CVE-2021-25391 SVE-2021-20500 Secure Folder Gaining access to arbitrary content providers.
CVE-2021-25393 SVE-2021-20731 SecSettings Gaining access to arbitrary content providers leads to read/write access to arbitrary files as system user (UID 1000).
CVE-2021-25392 SVE-2021-20690 Samsung DeX System UI Ability to steal notification policy configuration.
CVE-2021-25397 SVE-2021-20716 TelephonyUI (Over-) writing arbitrary files as UID 1001.
CVE-2021-25390 SVE-2021-20724 PhotoTable Intent redirection leads to gaining access to arbitrary content providers.

A detailed explanation of how Oversecured was able to exploit each of the vulnerabilities on a testing device can be found on its website.
Samsung rolls out fixes
Oversecured reported the vulnerabilities to Samsung before revealing them to the public.
Samsung labelled the severity of the vulnerabilities from moderate to high and included fixes for them in its April and May firmware updates.
It also rewarded the company more than $20,500 for disclosing the bugs.
It is recommended that Samsung device owners install the latest firmware updates to prevent falling victim to hackers looking to exploit these bugs.

On By marabye

You may also like

Simon Bridges' book might not be an insider’s tell-all, but it reveals what is inside the mind of a politician.

Lets just get the obvious question out of the way. Nationals support has collapsed. The partys leader Judith Collins is...

One Hospital Command personnel's services cover medical concerns that are not only related to COVID-19.

One Hospital Command personnel’s services cover medical concerns that are not only related to COVID-19. At the Laging Handa briefing...

Federal health officials have said about 3 percent of U.S. adults are immunocompromised.

Making such patients eligible for an extra shot, doctors say, is preferable to having worried patients seek out additional inoculations...

Unbeatable Football is what they’re calling it at SuperSport and it’s easy to see why with the new season laced with rivalries, tension, tradition and more storylines than your favourite Hollywood thriller.

{“slug”:”football”,”name”:”Football”,”menu”:[],”topics”:[{“group_name”:”South Africa”,”topics”:[{“name”:”MTN8″,”slug”:”mtn8″,”parent_slug”:”mtn8″,”uri”:null,”hidden_tabs”:[“logs”]},{“name”:”DStv Premiership”,”slug”:”dstv-premiership”,”parent_slug”:”dstv-premiership”,”uri”:null,”hidden_tabs”:[]},{“name”:”GladAfrica Championship”,”slug”:”national-first-division”,”parent_slug”:”national-first-division”,”uri”:null,”hidden_tabs”:[“scorers”]},{“name”:”Bafana”,”slug”:”bafana”,”parent_slug”:”bafana”,”uri”:null,”hidden_tabs”:[“logs”,”top-scorers”]},{“name”:”DStv Diski Challenge Rewired”,”slug”:”dstv-diski-challenge”,”parent_slug”:”dstv-diski-challenge”,”uri”:null,”hidden_tabs”:[“top-scorers”]},{“name”:”Nedbank Cup”,”slug”:”nedbank-cup”,”parent_slug”:”nedbank-cup”,”uri”:null,”hidden_tabs”:[“logs”]},{“name”:”Carling Black Label Cup”,”slug”:”carling-black-label-cup”,”parent_slug”:”carling-black-label-cup”,”uri”:null,”hidden_tabs”:[“logs”,”top-scorers”]}]},{“group_name”:”Europe”,”topics”:[{“name”:”English Community Shield”,”slug”:”community-shield”,”parent_slug”:”community-shield”,”uri”:null,”hidden_tabs”:[“logs”,”top-scorers”]},{“name”:”UEFA Super Cup”,”slug”:”uefa-super-cup”,”parent_slug”:”uefa-super-cup”,”uri”:null,”hidden_tabs”:[“top-scorers”,”logs”]},{“name”:”English Championship”,”slug”:”english-championship”,”parent_slug”:”english-championship”,”uri”:null,”hidden_tabs”:[“top-scorers”]},{“name”:”Premier League”,”slug”:”premier-league”,”parent_slug”:”premier-league”,”uri”:null,”hidden_tabs”:[]},{“name”:”French Ligue 1″,”slug”:”france”,”parent_slug”:”france”,”uri”:null,”hidden_tabs”:[]},{“name”:”Italy Serie...