Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Handhelds Open Source Operating Systems Privacy Security

Replicant Hackers Find and Close Samsung Galaxy Back-door 81

Posted by timothy from the in-their-spare-time dept.
gnujoshua writes "Paul Kocialkowski (PaulK), a developer for the Replicant project, a fully free/libre version of Android, wrote a guest blog post for the Free Software Foundation announcing that whlie hacking on the Samsung Galaxy, they "discovered that the proprietary program running on the applications processor in charge of handling the communication protocol with the modem actually implements a back-door that lets the modem perform remote file I/O operations on the file system." They then replaced the proprietary program with free software.

While it may be a while before we can have a 100% free software microcode/firmware on the the cellular hardware itself, isolating that hardware from the rest of your programming and data is a seemingly important step that we can take right now. At least to the FSF anyhow. What do others think: is a 100% free software mobile device important to you?"
This discussion has been archived. No new comments can be posted.

Replicant Hackers Find and Close Samsung Galaxy Back-door More

Replicant Hackers Find and Close Samsung Galaxy Back-door

Comments Filter:

  • NSA ?

    GCHQ ?

    Or their equivalent from South Korea ?

    • Comment removed (Score:5, Interesting)

      by account_deleted ( 4530225 ) on Thursday March 13, 2014 @08:19AM (#46472433)
      Comment removed based on user account deletion

      • Re: (Score:2)

        by Cenan ( 1892902 )

        This was my exact thought when I read it earlier. I've used that functionality myself before. On top of that, what they replaced the Samsung Android version with was a crippled, no hardware acceleration piece of crap. But I think they already knew that, and they knew exactly why that "backdoor" was there, but now their obscure "alternative" to stock installs is all over the nerd news.

        • Re: (Score:3)

          by dos1 ( 2950945 )

          That "obscure alternative" is one of the only ones consisting of entirely free software. Instead of whining that something doesn't work you should rather help implementing what's missing, either by direct contributions, money donations or even just a good word to the developers. Otherwise the rarity of free mobile systems like SHR, QtMoko or Replicant will become even more rare and none of them will be ever usable for anyone else than hardcore geeks.

      • I'm sure Samsung is sending in the blade runner for these replicants hackers

      • They shouldn't need to expose full filesystem I/O for a remote wipe. They should only need to expose a locked up command that triggers the wipe within the local OS.

        Either this is a back door, or they are the worst software engineers ever.

        • Comment removed (Score:4, Insightful)

          by account_deleted ( 4530225 ) on Thursday March 13, 2014 @09:58AM (#46473367)
          Comment removed based on user account deletion

          • Really? So what's the point of being able to read files belonging to the owner? If the backdoor only permitted nuking of the filesystem, then it wouldn't be a big deal. This is pretty clearly an application to facilitate surveillance of citizens, and therefore can be fairly described as sinister.

      • Re: (Score:2)

        by sjames ( 1099 )

        Why would a wipe my data function need the ability to read a file and transmit it over the modem? Why would it need a download this and save it here function?

    • Re:Who's behind that back-door ? (Score:4, Funny)

      by jason.sweet ( 1272826 ) on Thursday March 13, 2014 @08:27AM (#46472497)

      NSA ?

      GCHQ ?

      Or their equivalent from South Korea ?

      AT&T

      • NSA ?

        GCHQ ?

        Or their equivalent from South Korea ?

        AT&T

        AT&T would be redundant for NSA.

        • Re: (Score:2)

          by Lumpy ( 12016 )

          Sorry but AT&T is far more evil than the NSA.

          • Not really.

            You pay AT&T to rape you. The NSA does it for free.

            • Re: (Score:2)

              by Cenan ( 1892902 )

              I'd provide a link to the NSA budget, alas that is classified [fas.org]. But rest assured that they are being paid, you can stop sending them your food stamps now.

          • Sorry but AT&T is far more evil than the NSA.

            True. As another poster has observed, the NSA rapes you as part of your basic taxpayer services at no additional cost.

            Plus, the NSA doesn't employ telemarketers to call you up 5 times a day 7 days a week year after year, exploiting the loopholes in the "Do Not Call" registry. To say nothing of the junk mail.

    • Re:Who's behind that back-door ? (Score:4, Insightful)

      by Andy Dodd ( 701 ) <atd7@c[ ]ell.edu ['orn' in gap]> on Thursday March 13, 2014 @01:12PM (#46475269) Homepage

      "Never attribute to malice that which can be attributed to stupidity."

      My guess, after years of working with Samsung's poor-quality platform software and multiple runins with their utterly piss-poor configuration management processes (as in, the Korean divisions at Samsung Mobile don't seem to have any, as evidenced by numerous situations during the Superbrick fiasco):

      Samsung probably put this into the RIL library to facilitate modem debugging. e.g. the modem can read/write to /efs/root/ in order to make it easier for a developer to track state changes of the modem or whatever. (Why do this instead of using whatever debugging functions are built into the modem such as maybe JTAG? This is probably for late-stage development where they wanted to test finishing touches on the modem using final hardware and the modem's debugging functions weren't physically available.)

      Keep in mind that, based on the reverse engineering effort, Samsung *intended* this feature to only access files within /efs/root/ - the EFS partition is specifically reserved for device-specific state and calibration data (most notably the phone's IMEI is stored in the EFS partition, and with the exception of some miscellaneous other config data such as MAC addresses for wifi and BT, it's almost entirely for modem-related items. I may be wrong about the MAC data, I'm a bit rusty and haven't poked around at my EFS partitions in a long time.) It's only due to a screwup (lack of sanitization of escape sequences such as ../../ ) that someone can in theory access files outside of /efs/root

      So at some point, Samsung probably removed the corresponding components on the baseband firmware side (no one has yet to confirm anything on the modem side that sends these commands, nor has anyone caught any of these commands being issued - the behavior of the library was verified by injecting extra commands with a kernel patch in the driver between the modem and the library), but someone forgot to remove them from the RIL library on the applications processor side. Forgetting to remove dead code and/or leaving epic security holes in place (remember that in late 2012, someone realized that Samsung left a world readable/writable device node that effectively mapped all system memory to that device file - allowing anyone to read or write any part of memory. For more, do a Google search for "exynos-abuse" ) is pretty typical for Samsung.

      As to my experience here - I was one of the Cyanogenmod maintainers for the Exynos 4210 (I9100, I777, N7000) handset family, and also did some work on 4412 devices (primarily the Note 10.1 - GT-N8013) throughout 2012 and the first half of 2013. I'm 90% retired from working with Haxxinos these days and was (along with the majority of the rest of the Exynos maintainers) one of the people who left the project to start Omni after the Focal relicensing attempt fiasco.

      An interesting question is - what architecture is the XMM626x's baseband processor? Is it custom or an ARM variant making it easier to analyze the baseband firmware itself? More than two years of working with that family of devices and I never personally looked in detail at what was running on the baseband side.

      • Re: (Score:2)

        by Andy Dodd ( 701 )

        Another article on this, I agree with Dan's assessment - http://arstechnica.com/securit... [arstechnica.com]

  • Dupe (Score:5, Informative)

    by Desler ( 1608317 ) on Thursday March 13, 2014 @07:50AM (#46472223)

    Yeah we know.

    http://mobile.slashdot.org/sto... [slashdot.org]

  • Wow! Two backdoors in one day? (Score:3, Funny)

    by Anonymous Coward on Thursday March 13, 2014 @07:50AM (#46472231)
    Wow! Two backdoors [slashdot.org] in one day? The Replicant team is really on a roll! And both of the backdoors in the exact same place! Impressive.

  • First Post FAIL! (Score:1)

    by Anonymous Coward

    This article was already posted once before on slashdot today!

  • Slashdot editors (Score:3)

    by coofercat ( 719737 ) on Thursday March 13, 2014 @08:03AM (#46472331) Homepage Journal

    Slashdot editors fail to spot dupe, and fail to fix it - even though it's on the frikkin' home page. Wow, that really is news ;-)

    Timothy, you've surpassed yourself. Tonight, when you go home to your SO and they ask you "how was your day, dear", you can proudly say "I really rocked today - I did some awesome stuff, I really moved the needle, I pushed the envelope, I really excelled!".

    • Re: (Score:1)

      by Threni ( 635302 )

      There's always this:

      http://soylentnews.org/ [soylentnews.org]

      Perhaps it'll free us from the laughable beta, and non-news for nerd clickbait too?

      • I have seen a dupe or two there. Still in two minds about whether it'll free us or dupe us... :P

        • Re: (Score:1)

          by Threni ( 635302 )

          I only discovered it very recently; competition is good, right? Not sure why it started exactly, but it's good to know that there's somewhere similar in case this one continues to get worse.

          • Worse? I would say you must be new here, but I can read useids... It was started by the whole "Fuck Beta" group which confused me (beta, was and as far as I know remains optional), and like all things borne of "violent" revolution suffers a bit from some infighting. Hopefully they'll resolve that, but it remains to be seen if they can build a decent community. I am registered and do read there, but comment more here, which says something.

            • Same here. I joined soylent and pipe, for good measure. For the time being though I still read /. more regularly and I haven't posted to either soylent or pipe so far. Soylent has already witnessed quite some drama (an ousted leader has used the phrase "palace revolt", I kid you not).

    • Re: (Score:2)

      by PPH ( 736903 )

      Timothy, you've surpassed yourself. Tonight, when you go home to your SO

      There will already be another Timothy there.

  • oh for crying out loud timothy (Score:1)

    by Anonymous Coward

    Evidently the editors don't read the front page - given that there's *already* a story on there about this precise issue, using precisely the same blog.

  • Replicants? (Score:4, Funny)

    by rossdee ( 243626 ) on Thursday March 13, 2014 @08:07AM (#46472353)

    Someone call Harrison Ford

  • Wow (Score:3)

    by Charliemopps ( 1157495 ) on Thursday March 13, 2014 @08:13AM (#46472397)

    I'm used to the dupes being weeks or months old... maybe Days for really bad ones. But this was like 12hrs ago? Do the editors even read slashdot anymore?

  • Android

  • They smell like... Tacos. Duplicate posts make even Slashdot Beta seem like home.
  • I think this is a dupe from about 4 or 5 articles back.
  • > "is a 100% free software mobile device important to you?"

    In a word: Yes.

    The borderline (and sometimes not-so-borderline) criminal behavior of some software/hardware makers, coupled with often exorbitant costs for a device that will either be destroyed (via being cheaply made) or totally obsolete in a few years makes me quite leery of trusting or relying on a modern smartphone, much less actually spending my own money on one. Especially when my company provides me with a phone, POS though it may b

Slashdot Top Deals

The explanation requiring the fewest assumptions is the most likely to be correct. -- William of Occam

Close