4 ms·

Replicant developers find and close Samsung Galaxy backdoor

81 points by dn2k 12y ago

MrBuddyCasino 12y ago
2 months old, previously: https://news.ycombinator.com/item?id=7389258 https://news.ycombinator.com/item?id=7389258
- vezzy-fnord 12y ago
  /r/netsec thread is also of interest: http://www.reddit.com/r/netsec/comments/209h4d/samsung_galaxy_backdoor/ http://www.reddit.com/r/netsec/comments/209h4d/samsung_galax...
kppi 12y ago
Nope: http://arstechnica.com/security/2014/03/virtually-no-evidence-for-claim-of-remote-backdoor-in-samsung-galaxy-phones/ http://arstechnica.com/security/2014/03/virtually-no-evidenc...
- pessimizer 12y ago
  >1) There is virtually no evidence for the ability to remotely execute this functionality. The write-up states, "As the modem is running proprietary software, it is likely that it offers over-the-air remote control that could then be used to issue the incriminated RFS messages and access the phone's file system." summary: there's no evidence of how it can be used, because it's all closed source. >2) The amount of data that can be read or written to by this functionality is very limited. On all affected models except the original Galaxy S, which was released 4 years ago, the affected radio software is running under the "radio" user. As a result, this can only be used to access data specifically related to radio functionality, plus information stored on the SD card (because this is also readable by every application on the phone). summary: it can read and write to all that the radio user is allowed to access, and your entire SD card. >3) The specifics of the vulnerability suggest that it was poorly programmed legitimate functionality rather than a secret backdoor. The authors had to leverage a directory traversal flaw in the handling of modem commands in order to cause the radio software to write outside of the /efs/root directory, which contains radio-related files. This suggests that the intended purpose of this functionality was rather mundane and not at all malicious, and that it was simply poorly implemented. summary: the backdoor was poorly written, and allowed complete access when combined with a known exploit. Nope?
  - eli 12y ago
    I think the "Nope" refers to headline, which is not supported by facts. If there's no evidence that it was intentional then you can't call it a backdoor. Otherwise every security flaw (or potential security flaw) is a backdoor.
rabino 12y ago
They say it so it must be true.
- rabino 12y ago
  Not sure why I'm getting downvoted. See http://arstechnica.com/security/2014/03/virtually-no-evidence-for-claim-of-remote-backdoor-in-samsung-galaxy-phones/ http://arstechnica.com/security/2014/03/virtually-no-evidenc...
  - eli 12y ago
    Without the link in the original comment, it came off as flippant sniping.
fullofstack 12y ago
from http://www.reddit.com/r/netsec/comments/209h4d/samsung_galaxy_backdoor/cg1gy3l http://www.reddit.com/r/netsec/comments/209h4d/samsung_galax... : This is not a backdoor. It's a feature, and a reasonably common one for Qualcomm based devices. It's an interface to allow the modem access to a persistent data store (ie. eMMC modem partitions) even though only the application processor may access the MMC controller. Have a look at the rmt_storage client documentation found in a Qualcomm kernel tree. It used to be pretty common to ship a rmt_storage daemon to do the very same thing Samsung is being accused of here (hint: Nexus 5 still uses it), I don't know about other recent devices, but I'd imagine they'd employ something similar. Also, there are many more ways for the baseband to compromise the application processor, without an explicit interface.
- pessimizer 12y ago
  Can't it be a backdoor and a feature? It's certainly not a feature that helps the users of the device in any way. If it's on my phone, it's definitely only a backdoor.
- throwaway7767 12y ago
  > This is not a backdoor. It's a feature, and a reasonably common one for Qualcomm based devices Are these really mutually exclusive? I don't doubt that qualcomm had good reasons to add this interface, but clearly it can be used as a backdoor, and since the user is not made aware of it, I'd say this meets all the qualifications of a backdoor. They could have easily designed this in a way that allowed the baseband processor to only write to a designated area instead of giving it full access. You are right that that the baseband in phones usually has many other ways to directly access sensitive data from the main processor (DMA is the obvious one). But this differs from phone to phone, depending on the hardware design. There are phones where the baseband talks to the main processor through a serial interface with no access to DMA.
  - deleted 12y ago
    [deleted]
  - eli 12y ago
saykou 12y ago
this is old
RafiqM 12y ago
For a split second I thought the developers were replicants.

81 points by dn2k 12y ago

MrBuddyCasino 12y ago

2 months old, previously: https://news.ycombinator.com/item?id=7389258 https://news.ycombinator.com/item?id=7389258

vezzy-fnord 12y ago
/r/netsec thread is also of interest: http://www.reddit.com/r/netsec/comments/209h4d/samsung_galaxy_backdoor/ http://www.reddit.com/r/netsec/comments/209h4d/samsung_galax...

kppi 12y ago

Nope: http://arstechnica.com/security/2014/03/virtually-no-evidence-for-claim-of-remote-backdoor-in-samsung-galaxy-phones/ http://arstechnica.com/security/2014/03/virtually-no-evidenc...

pessimizer 12y ago
>1) There is virtually no evidence for the ability to remotely execute this functionality. The write-up states, "As the modem is running proprietary software, it is likely that it offers over-the-air remote control that could then be used to issue the incriminated RFS messages and access the phone's file system." summary: there's no evidence of how it can be used, because it's all closed source. >2) The amount of data that can be read or written to by this functionality is very limited. On all affected models except the original Galaxy S, which was released 4 years ago, the affected radio software is running under the "radio" user. As a result, this can only be used to access data specifically related to radio functionality, plus information stored on the SD card (because this is also readable by every application on the phone). summary: it can read and write to all that the radio user is allowed to access, and your entire SD card. >3) The specifics of the vulnerability suggest that it was poorly programmed legitimate functionality rather than a secret backdoor. The authors had to leverage a directory traversal flaw in the handling of modem commands in order to cause the radio software to write outside of the /efs/root directory, which contains radio-related files. This suggests that the intended purpose of this functionality was rather mundane and not at all malicious, and that it was simply poorly implemented. summary: the backdoor was poorly written, and allowed complete access when combined with a known exploit. Nope?
- eli 12y ago
  I think the "Nope" refers to headline, which is not supported by facts. If there's no evidence that it was intentional then you can't call it a backdoor. Otherwise every security flaw (or potential security flaw) is a backdoor.

rabino 12y ago

They say it so it must be true.

rabino 12y ago
Not sure why I'm getting downvoted. See http://arstechnica.com/security/2014/03/virtually-no-evidence-for-claim-of-remote-backdoor-in-samsung-galaxy-phones/ http://arstechnica.com/security/2014/03/virtually-no-evidenc...
- eli 12y ago
  Without the link in the original comment, it came off as flippant sniping.

fullofstack 12y ago

from http://www.reddit.com/r/netsec/comments/209h4d/samsung_galaxy_backdoor/cg1gy3l http://www.reddit.com/r/netsec/comments/209h4d/samsung_galax... : This is not a backdoor. It's a feature, and a reasonably common one for Qualcomm based devices. It's an interface to allow the modem access to a persistent data store (ie. eMMC modem partitions) even though only the application processor may access the MMC controller. Have a look at the rmt_storage client documentation found in a Qualcomm kernel tree. It used to be pretty common to ship a rmt_storage daemon to do the very same thing Samsung is being accused of here (hint: Nexus 5 still uses it), I don't know about other recent devices, but I'd imagine they'd employ something similar. Also, there are many more ways for the baseband to compromise the application processor, without an explicit interface.

pessimizer 12y ago
Can't it be a backdoor and a feature? It's certainly not a feature that helps the users of the device in any way. If it's on my phone, it's definitely only a backdoor.
throwaway7767 12y ago
> This is not a backdoor. It's a feature, and a reasonably common one for Qualcomm based devices Are these really mutually exclusive? I don't doubt that qualcomm had good reasons to add this interface, but clearly it can be used as a backdoor, and since the user is not made aware of it, I'd say this meets all the qualifications of a backdoor. They could have easily designed this in a way that allowed the baseband processor to only write to a designated area instead of giving it full access. You are right that that the baseband in phones usually has many other ways to directly access sensitive data from the main processor (DMA is the obvious one). But this differs from phone to phone, depending on the hardware design. There are phones where the baseband talks to the main processor through a serial interface with no access to DMA.
- deleted 12y ago
  [deleted]
- eli 12y ago

saykou 12y ago

this is old

RafiqM 12y ago

For a split second I thought the developers were replicants.