FSF: Replicant developers find and close Samsung Galaxy back-door [LWN.net]

The Free Software Foundation has put out a release claiming that developers working on the Replicant fork of Android have found a backdoor on Samsung Galaxy handsets. "While working on Replicant, a fully free/libre version of Android, we discovered that the proprietary program running on the applications processor in charge of handling the communication protocol with the modem actually implements a back-door that lets the modem perform remote file I/O operations on the file system. This program is shipped with the Samsung Galaxy devices and makes it possible for the modem to read, write and delete files on the phone's storage. On several phone models, this program runs with sufficient rights to access and modify the user's personal data."

to post comments

FSF: Replicant developers find and close Samsung Galaxy back-door

Posted Mar 12, 2014 22:23 UTC (Wed) by smoogen (subscriber, #97) [Link] (4 responses)

I am glad the post goes over the things that most people don't understand about 'their' phone:

Today's phones come with two separate processors: one is a general-purpose applications processor that runs the main operating system, e.g. Android; the other, known as the modem, baseband, or radio, is in charge of communications with the mobile telephony network. This processor always runs a proprietary operating system, and these systems are known to have backdoors that make it possible to remotely convert the modem into a remote spying device. The spying can involve activating the device's microphone, but it could also use the precise GPS location of the device and access the camera, as well as the user data stored on the phone. Moreover, modems are connected most of the time to the operator's network, making the backdoors nearly always accessible.
...
Replicant does not cooperate with backdoors, but if the modem can take control of the main processor and rewrite the software in the latter, there is no way for a main processor system such as Replicant to stop it. But at least we know we have closed one specific backdoor.

-----

The gist is you could pay any sort of money for that phone and it still isn't under your control.

FSF: Replicant developers find and close Samsung Galaxy back-door

Posted Mar 13, 2014 0:33 UTC (Thu) by brugolsky (guest, #28) [Link] (2 responses)

I've yet to come across a table describing the common handsets, and the degree of isolation of the baseband processor. It's the first thing that comes to mind when I read about cell phone security, but is rarely mentioned in discussions of Blackphone. etc. If the baseband has access to peripherals, or can DMA all over application processor memory, an open source app OS is small comfort.

FSF: Replicant developers find and close Samsung Galaxy back-door

Posted Mar 13, 2014 19:09 UTC (Thu) by njwhite (guest, #51848) [Link]

Not it table form, but at least some of the "dedicated page' entries for devices on the Replicant wiki talk about it. http://redmine.replicant.us/projects/replicant/wiki

There was also a slide at a presentation GNUtoo did at FOSDEM a few years ago, but it just mentioned a few models.

> If the baseband has access to peripherals, or can DMA all over application processor memory, an open source app OS is small comfort.

That is true, but there aren't any stable and fully open source mobile operating systems around that support all the features people have on their devices - I don't think replicant supports wifi on any models, for example.

FSF: Replicant developers find and close Samsung Galaxy back-door

Posted Mar 13, 2014 19:36 UTC (Thu) by dlandau (subscriber, #94925) [Link]

It might not come up in discussions about Blackphone but it is front and center on the plans for Neo900 (http://neo900.org/). The modem in Neo900 is going to be connected through USB. Even though it will be inside the case it will be just another peripheral without the same kind of overarching access that is prevalent in the mobile phones of today.

FSF: Replicant developers find and close Samsung Galaxy back-door

Posted Mar 13, 2014 1:24 UTC (Thu) by dany (guest, #18902) [Link]

Actually master processor is processor on which radio is running. Slave processor is aplication processor on which android is running.

Even if you close this particular backdoor, there is no way to fully secure you phone.

Think of everything which is not free software running on your phone

- Master Modem processor running binary blob and sharing memory with aplication processor
- Java code running on SIM card updatable OTA from carrier
- Wifi/Bluetooth/NFC/FM/Sensors/Mic/Camera/Graphics/GPS chips possibly accesible/alterable by master processor and all running binary blobs

Not going to buy any Samsung device again.

Posted Mar 12, 2014 22:42 UTC (Wed) by d33tah (guest, #90623) [Link] (43 responses)

Okay, after this, Samsung lands on my "favorite companies" list, next to Sony. Not ever going to buy a single device from them again.

Not going to buy any Samsung device again.

Posted Mar 12, 2014 23:07 UTC (Wed) by jackb (guest, #41909) [Link] (29 responses)

Okay, after this, Samsung lands on my "favorite companies" list, next to Sony. Not ever going to buy a single device from them again

This doesn't go far enough. Samsung only shipped a feature like this because one of their employees agreed to code it for them.

Unless and until the specific people responsible come forward, you should refuse to do work with anyone who has ever coded for Samsung, in any capacity, ever.

Accountability only means something when it's attached to real people. There is no collective "Samsung" which is responsible for this.

Not going to buy any Samsung device again.

Posted Mar 12, 2014 23:43 UTC (Wed) by bloopletech (guest, #71203) [Link] (18 responses)

I agree. Though I am still in my youth, I am already tiring of those who knowingly write user-hostile code and then say 'I was just following orders'. We have a responsibility to not harm users - not because we are in a special role, but because we are human beings.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 0:09 UTC (Thu) by dlang (guest, #313) [Link] (17 responses)

and how do you know this was a user hostile piece of code rather than something intended as a last ditch "restore the phone" or "save the user's data" option?

just because a car can be used to run someone down doesn't mean that the person who designed the car intended it to be used that way.

If you want to ban every programmer who has ever written code that _could_ be used in a bad way, you will very quickly get to a very small group of programmers (and I would argue that that small group has never written anything worthwhile either)

And saying that anyone who ever worked for that company should be blacklisted is going even further into the ridiculous.

There are probably fewer people who graduated from your high school every decade than who work for Samsung. How about we treat you as being guilty for any crime anyone who graduated from your high school in the same year that you did? By limiting it to actual crimes, and only the same year, this is a much smaller impact than blacklisting anyone who works at Samsung (let alone anyone who ever worked there)

Not going to buy any Samsung device again.

Posted Mar 13, 2014 0:21 UTC (Thu) by jackb (guest, #41909) [Link] (11 responses)

And saying that anyone who ever worked for that company should be blacklisted is going even further into the ridiculous.

Do you know what else is ridiculous?

Two or three generations of programmers who saw things like this going on for years and never spoke up because their paychecks were more important to them than their integrity.

As far as I know boycotts are generally accepted as valid courses of action. If all those programmers wouldn't do the right thing for its own sake in the past, maybe they'll do it now to salvage their reputations and job prospects in the future.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 0:26 UTC (Thu) by dlang (guest, #313) [Link] (7 responses)

> Two or three generations of programmers who saw things like this going on for years

things like _what_ exactly?

What is it that you _know_ (rather than just assume) is involved here?

And if you are going to lay this on entire generations of programmers, do you really want to be held responsible for everything that your generation of programmers does?

Not going to buy any Samsung device again.

Posted Mar 13, 2014 0:34 UTC (Thu) by jackb (guest, #41909) [Link] (2 responses)

things like _what_ exactly?

What is it that you _know_ (rather than just assume) is involved here?

Yes, how could I forget that it might all just be an innocent mistake. Maybe it was just a debugging tool that was accidentally left in place instead of being removed for production. Oops.

On the other hand maybe the tech industry in general has milked plausible deniability one time too many and it doesn't matter any more.

Sustained, continuous incompetence is a fine reason for a boycott too.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 10:00 UTC (Thu) by khim (subscriber, #9252) [Link] (1 responses)

Sustained, continuous incompetence is a fine reason for a boycott too.

If your goal is to make your life miserable, then yes, it's valid course of action. If your goal is different then it's pointless.

Market rewards slight incompetence. People and companies who are doing something totally crazy and stupid are losing (see Windows Phone), but companies and people who are delivering “good enough” solution first win. This fact means that all companies which survive by necessity deliver half-broken solutions. If you'll start boycotting “continuous incompetence” then in the end you'll just boycott all companies (except for may be few military contractors who are theoretically are foced to compete on quality not price).

Not going to buy any Samsung device again.

Posted Mar 13, 2014 18:23 UTC (Thu) by dlang (guest, #313) [Link]

at that point is it 'incompetence' or 'good judgement evaluating the costs vs benefits'?

Not going to buy any Samsung device again.

Posted Mar 14, 2014 12:53 UTC (Fri) by k8to (guest, #15413) [Link] (2 responses)

This is wide of the mark. The failure is usually institutional, and we have no reason to assume the failure was not institutional in this case.

I could point to no end of poor security decisions made by my employer through a series of oversights and errors. Periodically, I deliver a list of these oversights to the security team. Periodically, I re-raise the problems. When they're small enough I just fix them myself.

But they just sit in the pile of tedious warts along with all the other tedious warts that any significant codebase acquires. There's no internal force which can really push them to high priority, and the customers don't even notice the amazingly obvious ones that THEIR security team should be easily finding and objecting to. The security issues the customers raise are almost always nonsense, equivalent to "my scanner made a red light" and don't accept a clear explanation of why it's a false positive.

I have to say, working in "enterprise software" has made me REALLY appreciate security researchers. They tend to find these problems and force us to fix them by signalling that the issue has now become a priority. And they do it for free (from our perspective). Ironically when we HIRE the security researchers the stuff they find isn't as prioritized (though much is dealt with in that case).

Is there some kind of fund I can contribute to and/or try to convince my employer to contribute to which helps fund security research work? It seems like an obvious good citizen move.

Not going to buy any Samsung device again.

Posted Mar 14, 2014 13:10 UTC (Fri) by k8to (guest, #15413) [Link] (1 responses)

I should add, dishearteningly, that what customers want, regarding CVEs and scanner red-lights, is a lot of noise and mummery.

They do not want an accurate summary of the investigation and conclusions. Given a clear writeup of why a problem is unexploitable or does not exist with additional possible mitigations available now and information about which later versions (eg already shipped) do not even have the red light, they are not happy.

What they want is a set of officious looking documents that have a lot of red-tape indicators and wax seals. They don't even care if the information in the documents is right, they just want to see the appropriate level of pomp applied to each security concern they have.

In other words, if we spend 4 days engineering time to dig through and improve the product based on their concerns, they are not happy. If we produce an officious looking pile of boiler plate from an automated nonsense engine in 5 minutes, they are satisfied.

Not going to buy any Samsung device again.

Posted Mar 14, 2014 14:40 UTC (Fri) by raven667 (subscriber, #5198) [Link]

> In other words, if we spend 4 days engineering time to dig through and improve the product based on their concerns, they are not happy. If we produce an officious looking pile of boiler plate from an automated nonsense engine in 5 minutes, they are satisfied.

I think there is some sort of interesting fundamental truth hidden under there in how we deal with bureaucracy, but I don't know what it is yet.

Like this, exactly

Posted Mar 21, 2014 2:34 UTC (Fri) by terrycloth (guest, #96095) [Link]

Decades ago, in another life, I was part of a team trying to build Microsoft Office, except we weren’t Microsoft, and Office didn’t yet exist. We (maybe half a dozen?) were just trying to paste together a word processor, a spreadsheet, maybe e-mail and a contact manager, in a way that would be useful to executives and make us filthy rich.

One of the requirements was to phone home and tell us what the user was doing with our suite, purely to find ways to improve it. (I’m not being ironic here, that was really what was intended.) We took exception to that, and a few of us were ready to quit before implementing such a thing. And management backed off.

Of course, that was in the ’80s, when any halfway decent programmer could walk out the door and get a (quite possibly better & better-paying) job by next week. As raven667 mentions below, the prospect of going hungry, or even living under a bridge, tests one’s beliefs mightily. I don’t know what I’d do in today’s economy. I know what I hope I’d do, but you can’t be sure until push comes to shove.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 16:41 UTC (Thu) by raven667 (subscriber, #5198) [Link] (2 responses)

> their paychecks were more important to them than their integrity

I'm just going to say that yes, a paycheck can be worth more than some rigid concept of integrity. You are welcome to keep your integrity and never bend your will for others, to always have things "your way", if you want to be homeless, sleeping rough and eating out of garbage cans like a raccoon. If instead you wan to live in civilization with others then you'll have to make value judgements and choices and you won't always get your way, you'll have to be able to take orders as well as give orders.

Not going to buy any Samsung device again.

Posted Mar 14, 2014 7:24 UTC (Fri) by palmer_eldritch (guest, #95160) [Link]

It's not so much about things going "your way". Unfortunately, what you describe is what's hanging over our heads if we do not do things in the way people who have power over us want to.
Now that's the reality we're confronted to but I think it's entirely understandable that some people have problems with that and wish that this would change. Some times having a little harsh words towards people who just shrug it off as something that you can't change.

Not going to buy any Samsung device again.

Posted Mar 21, 2014 19:21 UTC (Fri) by wookey (guest, #5501) [Link]

Nevertheless there are rigid limits to integrity. Some, like murder, are almost universally recognised. I don't think many people would have much trouble refusing to do that. It's not really about 'getting my way', but what's acceptable and what isn't. That can shift over time, and in a world where spying on your users (without telling them) isn't acceptable either, then you won't get sacked (and end up sleeping under bridges) for refusing to write code to do it. Programmers have significant collective power here to behave decently and help set what is and isn't beyond the pale. We have recently been called upon to have standards, and there is a lot to be said for that. 'I'm just doing what I was told, because I need the money' is not always good enough.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 14:59 UTC (Thu) by ewan (guest, #5533) [Link] (4 responses)

"and how do you know this was a user hostile piece of code rather than something intended as a last ditch "restore the phone" or "save the user's data" option?"

It's hostile because of the lack of informed consent. Let's say you're running a local fire department and you choose to offer people a service that allows them to deposit a copy of their door keys with you, so you can get in more easily in the event of an emergency, that's fine; people can take you up on it if they want.

Sneaking into people's houses in the dead of night to secretly copy their keys, even with such 'good intentions', is not fine.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 18:22 UTC (Thu) by dlang (guest, #313) [Link] (3 responses)

> It's hostile because of the lack of informed consent.

you already give your carrier rights to update the software on your phone, and their updates can give them anything they want.

besides, do you really want 100 hours of clicking through permission screens to approve every binary and script on a computer before you use it?

> Sneaking into people's houses in the dead of night to secretly copy their keys, even with such 'good intentions', is not fine.

umm, when did they do anything like this?

you do realize that your home locks have a key number associated with them, and that given that key number, any locksmith (and many others) can trivially make a new key that will fit it. In fact, there are far more locks out there then there are different keys, so there is someone else out there carrying keys to their house that will open yours.

Also, if you rent, your landlord keeps a copy of the key to your place.

But leaving aside your flawed analogy,

They didn't sneak in to anything and copy anything. This is something that was on the phone from the time it left the factory, and nobody has shown any evidence that it was used for anything other than accessing the files under /efs/root/, let alone that Samsung has done so.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 18:39 UTC (Thu) by jhoblitt (subscriber, #77733) [Link]

Not to mention that residential locks are typically single shear line and only 5 or 6 pins. They are trivial to pick and offer virtually no resistance to being drilled out. For that matter, residential external doors and frames are generally frighteningly flimsy as well.

Not going to buy any Samsung device again.

Posted Mar 14, 2014 10:51 UTC (Fri) by cesarb (subscriber, #6266) [Link]

> you already give your carrier rights to update the software on your phone

No I don't.

Only Google (via both the Google Play store and the hidden auto-update of Google Play Services) and Samsung (full Android updates, since mine is yakjuvs instead of yakju I believe it's Samsung instead of Google) can update software on my phone. Other than the auto-updating Google Play Services (com.google.android.gms) and the Google Play store itself (com.android.vending), everything asks for permission before updating, including the full Android updates. I don't even have any software from my carrier on this phone.

My carrier might be able to update the software on the SIM, but the SIM is not the phone, it's a separate (and removable) device.

The phone wasn't even bought from my carrier. The SIM has been used for three phones already, and it was bought together with a feature phone (which is the only one of the three which I bought from my carrier).

Not going to buy any Samsung device again.

Posted Mar 14, 2014 13:08 UTC (Fri) by ewan (guest, #5533) [Link]

"you already give your carrier rights to update the software on your phone"

I really don't. And the upstreams that do get to install updates have to ask each time. And I can examine the OS level updates in advance, if I choose, and application level updates are still supposed to keep within the constraints of the OS sandboxing mechanism, and if they want any extra permissions, they have to ask for them. It's not perfect, but it's a long way off the bleak scenario you outline.

"umm, when did they do anything like this?"

When they installed a backdoor without telling people. It may, as you suggest, have been done to offer useful services to their users, but then their users should have been told about it.

"Also, if you rent, your landlord keeps a copy of the key to your place."

Indeed they do. It is, however, an explicit part of the agreement that I made with them, as are the constraints and conditions under which they may use their copy of the key. As I said, the issue is not in having access, it is in not having consent.

"This is something that was on the phone from the time it left the factory"

The timing's utterly immaterial. There's really no distinction between installing a backdoor on someone's system now, and having installed it a long time ago. It was still done without the user's informed consent.

"and nobody has shown any evidence that it was used for anything other than accessing the files under /efs/root/, let alone that Samsung has done so."

You're really making the case that a backdoor doesn't matter unless there's concrete evidence of it having been used in specific incidents?

Not going to buy any Samsung device again.

Posted Mar 13, 2014 0:37 UTC (Thu) by excors (subscriber, #95769) [Link] (1 responses)

As the article says, the modem is really a whole independent CPU running its own OS and a load of software. Especially when developing and debugging that modem software, it's pretty useful to have a filesystem available to read configuration files, write logs, read test input data and save the test output, etc.

You might sensibly choose to use the standard POSIX open()/read()/write() API for that, so your code is portable to different environments. When the modem's environment is an Android device, it has no direct access to storage - the only option is to proxy the filesystem API over some IPC mechanism to Linux, which can access the real filesystem on the modem's behalf. If you're a conscientious developer, you'll probably implement the entire API - open, ftruncate, lseek, mkdir, etc - so that other developers won't trip over missing features. (The functions listed on the Replicant wiki page do look a lot like the POSIX API.)

When it's time to ship a device, you might find that some important configuration file is now being loaded using that API, not merely development/debug data, so you have to continue supporting it. Or you just don't care enough to disable the file API. After all, the modem probably has unrestricted access to the whole of RAM, so it already has to be fully trusted, and you don't lose any real security by giving it this convenient API. (Conversely, if you (as a user) *don't* trust the proprietary firmware blob running on the modem (plus the proprietary firmware blobs on several other processors, and the dozens of other proprietary libraries and applications running on the ARM to support the hardware), you're already screwed before even considering this API.)

It does look a bit sloppy from a security perspective if there is no restriction on what files it can access, but a lot of the lower levels of an Android device look sloppy from a security perspective, so that's no surprise. Device manufacturers tend to care about features and time-to-market, not about security, so that's what they get. You can certainly argue that there should be a much stronger security culture and much greater openness; but there's no reason to assume any malicious intent behind the feature here, and currently no evidence of any malicious use of it.

Not going to buy any Samsung device again.

Posted Mar 14, 2014 10:56 UTC (Fri) by cesarb (subscriber, #6266) [Link]

> It does look a bit sloppy from a security perspective if there is no restriction on what files it can access, but a lot of the lower levels of an Android device look sloppy from a security perspective, so that's no surprise.

From what I read, it does have a restriction on what files it can access (only files below /efs/root/), the problem is that the restriction is broken (as you said, sloppy...).

Not going to buy any Samsung device again.

Posted Mar 13, 2014 14:08 UTC (Thu) by rvfh (guest, #31018) [Link] (7 responses)

> Samsung only shipped a feature like this because one of their employees agreed to code it for them.

Sorry to cut the rest of your post.

The modem, to be cheap enough to sell, has no or very little flash. So indeed, we (I work for another modem making company) add remote filesystem capabilities to modems to write log files, read configuration, calibration, IMEI, these sort of things. In some cases we even use RPC to call kernel functions (guess which processor talks to the PMIC/MC/etc...) That's how nasty we are.

Do we have orders or even enough time to write malicious software? Hell no! We're busy enough implementing the latest bells and whistles that have become mandatory like 300 Mb/s download rates!!!

Believe me, Samsung are not spying on you, they have better things to do with their time!

Not going to buy any Samsung device again.

Posted Mar 13, 2014 19:03 UTC (Thu) by Darkmere (subscriber, #53695) [Link] (3 responses)

Trust is a hard thing to come by for a company that obviously cares little or nothing about the security of their customers. Or for that matter, a company where their customers are not the end users.

No, I don't trust you. I think it's actively being abused and it's implicitly allowed by Samsung and others because there is no incentive to fix it or provide security for end users except if they get accused & shamed publicly.

Expect no goodwill. Expect only hostile behaviour until goodwill has been earned.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 19:43 UTC (Thu) by dlang (guest, #313) [Link] (2 responses)

> I think it's actively being abused

It's pretty easy to make your case, show some logs that contain the abuse you are claiming is taking place.

> here is no incentive to fix it or provide security for end users except if they get accused & shamed publicly

well that has taken place, now let's see how they respond.

David Lang

Not going to buy any Samsung device again.

Posted Mar 13, 2014 22:36 UTC (Thu) by Darkmere (subscriber, #53695) [Link] (1 responses)

> It's pretty easy to make your case, show some logs that contain the abuse you are claiming is taking place.

No, I didn't claim. I said _i think_. Also, the stock firmware doesn't appear to log the rpc calls from what I find ( though a most cursory glance)

>> here is no incentive to fix it or provide security for end users except if they get accused & shamed publicly

> well that has taken place, now let's see how they respond.

Based on previous responses and lack of support for devices (Galaxy S2 is one of those exposed) I'd say slim to none.

Not going to buy any Samsung device again.

Posted Mar 14, 2014 11:01 UTC (Fri) by cesarb (subscriber, #6266) [Link]

> Also, the stock firmware doesn't appear to log the rpc calls from what I find ( though a most cursory glance)

It does seem to log at least the open() calls, see https://lwn.net/Articles/590470/

What they're doing with their time doesn't count

Posted Mar 21, 2014 3:10 UTC (Fri) by Max.Hyre (subscriber, #1054) [Link] (2 responses)

I once read a book about spying—factual analysis rather than John le Carré. One of the points that stuck with me was that spying on other countries is based on capability, not intention. If your best-friend country has nukes, you keep pretty much the same undercover eye on them as you do on your known adversary. Anything less would be irresponsible. (And the shock expressed about Angela Merkel and Victoria Nuland is purely show for the groundlings. They all know they're all doing it.)

The point is in any sort of security analysis, what the other party can do is what you have to defend against, not what they're doing now, or what they say or you hope they're doing. The fact that the capability is a leftover from debugging, or intended solely to update radio-related files is irrelevant.

What they're doing with their time doesn't count

Posted Mar 21, 2014 3:48 UTC (Fri) by raven667 (subscriber, #5198) [Link]

You have to be careful about going too far down that road, worrying about capability instead of intention, the fact is in human society that everyone has the capability to pick up a knife and murder their neighbor but most don't have the intention to do so, so we don't all wake up dead tomorrow morning. I think this is one reason that all the spying is so ineffective, because they are more concerned about their fantasies about what could happen that they don't see what actually is happening.

In computer security you will go crazy if you try to defend against all possible vectors of attack, you have to prioritize on factors a flimsy as what attack is popular at any time, and build threat models to see what parts of the security are actually important to your personal operations because not all vulnerabilities are equal.

Knowing what is likely is a better analysis than just what is possible.

What they're doing with their time doesn't count

Posted Mar 21, 2014 4:55 UTC (Fri) by dlang (guest, #313) [Link]

In that case, let me pose a question for you.

which is worse a phone carrier that doesn't upgrade their users and leaves them running old, vulnerable software, or a phone carrier that does upgrade their users, but because they can upgrade the core software on the device, could use that upgrade process to do something evil in the future?

If you just look at capabilities, the ability to upgrade the device to arbitrary software in the future is FAR worse than any number of current vulnerabilities

But if you start to include the probability of that being used to attack users, things turn around and the existing vulnerabilities are a far bigger problem

Not going to buy any Samsung device again.

Posted Mar 12, 2014 23:36 UTC (Wed) by dlang (guest, #313) [Link] (6 responses)

don't you think you may be overreacting a bit? At least give Samsung a chance to respond to this.

This could be a debugging tool accidentally left in the production build.

It could be something intended to do updates to the phone.

It could be something intended to allow unbricking of phones.

It could be something planted by the NSA (or it's competitors) that they didn't notice.

"had sufficient permissions to access and modify users files " != "was intended to access and modify users files" It could be that it had this much access because it was intended to be able to replace root owned files.

Samsung didn't need this to get access to your data. If you are running their OS build, they already had the access, and also had the access to replace any of the software on the phone with new software that did something malicious (and software that auto-updates from a source gives that source the ability to make arbitrary changes to that software, that's the intent of the auto-update)

The only time they would need to resort to this tool is if you replaces the OS on the phone and they still wanted to make changes to it (or access your data on it, assuming that they know where your interesting data is on a different OS)

The chances of them going to any noticeable effort for such a odd corner case are very small.

Now, if Samsung comes back the way Sony did and claim that this is a desired, anti-piracy tool, then I will probably agree with you. But if they either say 'oops, we didn't mean for that to make it to a live phone' or explain why they thought this was needed to help the user, that would be something very different.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 0:03 UTC (Thu) by cesarb (subscriber, #6266) [Link] (5 responses)

> It could be that it had this much access because it was intended to be able to replace root owned files.

It could be that it had this much access because it was intended to be able to _read_ root owned files.

I believe that at least on some Samsung-designed Android phones, a few files essential to the modem operation are on the Linux-accessible filesystem, in a separate small partition (/efs IIRC). This includes things like the phone's IMEI.

They might have found the mechanism the modem uses to read (and modify) these files. It would be very interesting if they found out which files this mechanism is normally used for.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 0:10 UTC (Thu) by dlang (guest, #313) [Link] (3 responses)

Exactly. I would be very interested if they made their replacement log any requests to use it and then published that log.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 1:24 UTC (Thu) by excors (subscriber, #95769) [Link] (2 responses)

You shouldn't even need to replace anything - just install the Android SDK on a PC, connect over USB, and run "adb logcat -b radio -v threadtime | grep RxRFS_OpenFile". It's not trying to be sneaky.

>> [...] a few files essential to the modem operation are on the Linux-accessible filesystem, in a separate small partition (/efs IIRC).

According to http://redmine.replicant.us/projects/replicant/wiki/Samsu..., the paths sent by the modem get prepended with "/efs/root/", so it sounds like that's what they were aiming for. (The developers just didn't bother adding any checks to prevent ".." in the requested paths, so you can easily break out of that directory.)

Not going to buy any Samsung device again.

Posted Mar 13, 2014 2:07 UTC (Thu) by cesarb (subscriber, #6266) [Link] (1 responses)

Just a common path traversal bug, then. I'd classify it as a "remote code execution" one, since I'm counting the modem as "remote" (it's running on a separate CPU, from the Linux POV it's remote), and it can potentially overwrite executables (or create a new executable and change the configuration so it'll load on boot).

Not very serious until a remote code execution bug is found on the modem firmware (or if it has a real backdoor). It won't surprise me if that happens soon.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 16:49 UTC (Thu) by raven667 (subscriber, #5198) [Link]

Just from the summary, removing the spin language like "incriminating" and "backdoor", it does seem like a path traversal bug. I wouldn't be surprised if this particular path, from the baseband CPU to the application CPU, wasn't considered a security boundary during the design of the device, only from the application CPU to the baseband CPU is considered security critical, just the same as from the OS kernel to the application is not considered a security boundary, but from the application to the OS kernel definitely is.

One OS has exclusive file-system access

Posted Mar 13, 2014 0:48 UTC (Thu) by iam.TJ (guest, #56644) [Link]

I've reverse engineered [1] several 'smart' phones with dual-CPU architectures where the baseband real-time executive OS is something like REXX/AMSS running on the boot CPU and the user interface OS is Android/Linux running on the application CPU.

Internal flash memory is partitioned and some partitions are used for read/write data by the real-time executive. At power-on the boot CPU has exclusive access to the flash partitions.

However, once the boot CPU has initialised the application CPU and handed over control to the secondary boot loader on the application CPU, which in turn loads the kernel and the root file-system, it cannot directly access the flash partitions without risking corruption.

From that point on the application CPU OS has exclusive control of the flash memory. If the boot CPU needs to access it that has to be done via shared memory or other RPC mechanisms.

These are required for Firmware Over The Air (FOTA) updates and access to other partitions [2] containing OS and user configuration data, including such things as touch-screen calibration data.

[1] http://tjworld.net/wiki/Android/HTC/Vision/BootProcess
[2] http://tjworld.net/wiki/Android/HTC/Vision/HbootAnalysis#...

Not going to buy any Samsung device again.

Posted Mar 13, 2014 0:42 UTC (Thu) by bug1 (guest, #7097) [Link] (2 responses)

The big question is, why did they put it there ?

If they put it there because "someone" told them to, and banned them from talking about it, then there is no reason to think all phones manufacturers arent in the same situation.

Samsung looks bad because they got caught, but dont for a second think that makes others better.

Governments will never allow an untraceable phone to be built, they are too paranoid.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 3:24 UTC (Thu) by drag (guest, #31333) [Link] (1 responses)

> The big question is, why did they put it there ?

Probably was used during development.

Or as other poster mentioned before this:

http://webcazine.com/1414/how-to-upgrade-firmware-over-th...

Never assign to malice that can be trivially explained by incompetence or just laziness. If you have proof that is something else.

However: The reality is that there is nothing unique about this with Samsung. Every other phone on the market is going to have similar issues.

If you want to have a secure phone the most important part of the phone is the actual radio. Samsung may or may not have used this feature for evil purposes, but it absolutely has the significant potential for abuse. This way you can control the information going in and out of your phone. Without you having control over the radio then whoever does actually control the radio controls the most important feature of your phone.

Not going to buy any Samsung device again.

Posted Mar 13, 2014 9:54 UTC (Thu) by tzafrir (subscriber, #11501) [Link]

Regarding "every other phone" (and especially the future tense):
http://neo900.org/faq#floss
To be available in Q3. And even then, not exactly "in the market".

Not going to buy any Samsung device again.

Posted Mar 13, 2014 10:17 UTC (Thu) by Wol (subscriber, #4433) [Link] (2 responses)

Well, I think you need to change that to "not going to buy any mobile phone again".

Samsung have been caught out this time. What makes you think the other companies are any different?

And which companies do you actually TRUST? Just because my motives are quite happily in line with Google's motives, doesn't mean I trust them to do the right thing! But I trust that if they do something wrong, it's incompetent not malicious. There are companies I would not trust with a bargepole, and Samsung certainly isn't on that list.

Cheers,
Wol

Not going to buy any Samsung device again.

Posted Mar 13, 2014 17:03 UTC (Thu) by drag (guest, #31333) [Link] (1 responses)

> And which companies do you actually TRUST?

You can't really trust any of them, unfortunately.

Due the regulatory environment any large corporation can be blackmailed or threatened by the government into installing back doors into the device's radio/modem. So even if the corporation is a good public citizen we really can't stop them from being forced into doing immoral things _if_ it can be done in secret.

I don't know the specifics of how FCC and friends regulate these radio devices, but I expect that they have things setup to essentially require proprietary logic on the radio/modem side of things to lock out consumers; who the government believes cannot be trusted to have access to the radio spectrum.

Maybe it can be worked around. Similar to how Madwifi and such things have been replaced by free software equivalents. I haven't a clue.

For people that have specific security concerns it is probably a good idea to just give up on cell phones altogether and just keep one for emergency or backup purposes. Small tablets and the proliferation of wifi access points means that in many places VoIP communication is a viable as a work around even though it's far from ideal. I would expect that it is possible to find a tablet or other device that doesn't have the proprietary software running on a master processor.

Everything has a backdoor...

Posted Mar 15, 2014 11:52 UTC (Sat) by walex (guest, #69836) [Link]

Due the regulatory environment any large corporation can be blackmailed or threatened by the government into installing back doors into the device's radio/modem.

That's such an amazing display of trust in good corporations oppressed by bad governments.

It is very easy for a security agency or a mafia or anybody with sufficient resources to get their people hired as programmers by crucial companies, and totally risk free; a bit less risk free is to find programmers already working at crucial companies and bribe or threaten them. Large corporations can be completely unaware.

Protest loudly the incompetence of the agency of the country where you pay your taxes if it does not have already several programmers working for Samsung, Nokia, Google, Intel, Verizon, RedHat, Debian, HP, Seagate, CISCO, ARM, ...

Everything (mobiles, printers, disks, routers, WiFi APs, ....) must have backdoors, more or less cleverly disguised.

FSF: Replicant developers find and close Samsung Galaxy back-door

Posted Mar 13, 2014 0:11 UTC (Thu) by zyga (subscriber, #81533) [Link]

It smells like an odd implementation of FOTA. Though given the variation of "modem" firmware it does look strange/unrealistic.

Disclaimer: I used to work for Samsung a few years ago.