The Galaxy S4, S5 and S6 vulnerable because of their fault … – Frandroid

Since the Galaxy S4, Samsung uses for its default keyboard technology keyboard SwiftKey third. According to security researchers, it is the victim of a serious security vulnerability that can compromise the security of the Galaxy S4, S5 and S6 and possibly other terminals of the brand.

Since the Galaxy S4 in 2013, Samsung uses technology SwiftKey keyboard for home. SwiftKey is integrated basis, not as an application, but directly within TouchWiz. Samsung slightly changes the operation of the keyboard and its theme, but the prediction engine is based on SwiftKey. The third-party application, available on the Play Store, has no security problem . However, Samsung variant delivered on Galaxy S4, S5 and S6 (and all terminals using SwiftKey TouchWiz technology natively) suffered a rather large security hole . NowSecure company’s engineers have indeed managed to access numerous data from a mobile affected by the flaw: access to the various sensors to personal data, possibility of installing a virus, spy on phone conversations, etc. In short, an almost full access to all phone functions.

A flaw not clogged

Samsung is aware of this flaw since November 2014 and has began deploying updates for the plug from the operators. However, it is not certain that all the terminal operators from the Galaxy S4 is immune. The company NowSecure accurate and Galaxy S4 Mini US operator AT & T is vulnerable, like the Galaxy S6 Verizon and Sprint. The engineers advise to learn from your operator to find out whether the patch was deployed. Most of the information very difficult time to obtain. Samsung did not say whether the patch was deployed on all operator terminals off from the Galaxy S4 via an OTA update.

An ingenious attack

To reduce the risk NowSecure suggest avoiding unsecured Wi-Fi connections or unknown or using another mobile terminal. The fact disable the keyboard does not affect Samsung because it never really uninstalled (that is simply impossible) and then it is always possible for hackers to use it to to access the phone. For the curious, the engineers described in a blog post how the attack takes place. It is quite “simple” because it uses the updated key mechanism that takes advantage of user account access system, comparable to root permissions. The attack still requires some expertise because be temporarily redirect outbound traffic from the device.