Cybersecurity researcher Mateusz Jurczyk has highlighted a long-standing vulnerability in Samsung smartphones. The flaw is in the Qmage format (. Qmg), supported since 2014 by the phones of the South Korean manufacturer. This vulnerability represents a risk for Samsung devices since it allows an attacker to install malware on the phone without arousing the suspicion of its owner.
In his report, the researcher from Google’s Project Zero team explained how it was possible to exploit the phone’s security flaw. In reality, the hacker must make sure to bypass the Address Space Layout Randomization (ASLR) protections of the Skia library, the place where all the images received are sent for processing. To do this, he must send several MMS messages containing malware hidden in a Qmage image. Once in the Skia library, the malware can be deployed on the phone without the owner's knowledge.
Samsung quickly corrected the problem
Exploitation of the fault is particularly worrying since it requires no human intervention, no click. "I have found ways to get full processing of MMS messages without triggering a notification sound on Android, so totally stealth attacks might be possible," said Mateusz Jurczyk.
The researcher obviously warned the South Korean manufacturer. A security update is offered on Samsung phones from 2014 to today. It is obviously advisable to install the May security update, especially since the flaw has been made public. Hackers could try to take advantage of it before it was filled.
To check if an update is available on your phone, go to your phone's settings, tab "About the device" and "Software update".
High-Tech
"Krook": A security breach affects nearly a billion smartphones of any brand
High-Tech
100x zoom, selfies in 40 megapixels: The Samsung Galaxy S20 Ultra puts everything on the photo!
- Computer virus
- Smartphone
- Hacker
- High-Tech
- Cybersecurity
- Samsung
- Pirate