There really isn’t much about hacking, malware, and security in the tech world that’s surprising anymore. Except for this. A security risk has been found in Samsung Galaxy smartphones – five generations of the handsets. It’s a design flaw that wasn’t caught until now. Even more surprising? It appears hackers never found this security risk.
Also read:Samsung Galaxy Owners to Get Digital Car Key Ability
Researchers Find Samsung Galaxy Design Flaw
Tel-Aviv University researchers in Israel – Alon Shakevsky, Eyal Ronen, and Avishai Wool – wrote a paper titled “Trust Dies in Darkness: Shedding Light on Samsung’s TrustZone Keymaster Design,” detailing their findings about the security risk in Samsung Galaxy phones.
The researchers explain in the paper how they were able to remotely extract cryptographic keys. They were also able to get past the FIDO2 authentication to reach highly sensitive data on all the recent Samsung Galaxy models.
The phones carry the Trusted Execution Environment (TEE), which includes the TrustZone Operating System (TZOS). While it may sound like a system that would keep your passwords and sensitive data safe, the paper’s authors were able to break through.
Once they broke through the structure, they created an exploit that allowed them to get to data that was protected by the hardware of the Samsung Galaxys. As if that weren’t enough, the researchers created a second exploit that allowed them to affect more recent Samsung phones running Android 9 and later that you would think would be protected from such risks.
The Samsung Galaxy phones had cryptographic keys that protected data with AES-GCM encryption. This meant apps could only reach that data if they went through the Samsung Keystore.
The Tel-Aviv researchers explained that “the implementation of the cryptographic functions within the TZOS is left to the device vendors who create proprietary undocumented designs.” Yet, Samsung had a very flawed design that allowed the researchers to break through with two exploits.
What this Means for Galaxy Owners
Through a process that seems like extreme luck, if you’re a Samsung Galaxy owner and have done your due diligence with security updates, you’re probably safe.
Despite the design flaw that allowed two huge security risks, there are no known exploits – other than the ones created by the researchers – that have taken advantage of the two vulnerabilities they found: CVE-2021-25444 and CVE-2021-25490.
Hackers could have used malware to get root or kernel privileges, but none ever did. Again, this design flaw goes back through five generations: Samsung Galaxy S8, S9, S10, S20, and S21.
Truthfully, though, Samsung Galaxys have been protected for the past year. Last August, CVE-2021-2544 was patched by Samsung, who had learned of the security risk from the Tel-Aviv researchers. Two months later, CVE-2021-25490 was patched as well. If you’ve kept your phone updated, you’re probably safe.
If you’re not sure if you have the most recent updates, check the update information in “Settings -> About Phone -> Software Information.”
You’d be wise to update now if you haven’t, as hackers have undoubtedly read this news as well. They know there are approximately 100 million Samsung Galaxy phones with this security flaw.
If you’re looking for a good reason to have an older Samsung Galaxy phone, the S9 is currently the only phone known to help you test for COVID.
Our latest tutorials delivered straight to your inbox
