Security Breach Leaves 600 Million Samsung Smartphones Vulnerable

A smartphone security expert at NowSecure, a leading mobile security company, has discovered a major vulnerability in Samsung smartphones. The breach affects the SwiftKey keyboard, which is a bundled built-in feature in several popular Samsung handsets, including the Galaxy Note 3 and 4, and the Galaxy S3, S4, S5 and S6. Estimates suggest that as many as 600 million Samsung smartphone users face an elevated hacking threat as a result of the breach.

The SwiftKey feature allows users to slide between letters rather than physically tap individual keys, making for much more intuitive and accurate auto-correct capabilities. However, the detected security breach has a vulnerability that permits hackers to access devices while posing as authorized users and execute malicious code through the SwiftKey software. While the technical details of the vulnerability are complex, they essentially stem from the fact that SwiftKey software bears Samsung’s private signature key, allowing hackers who are able to modify upstream traffic to gain access by pretending to be a privileged user.

Worse, SwiftKey cannot be uninstalled or disabled, leaving users vulnerable to a range of attacks including DNS hijacking, ARP poisoning, rogue routing and packet injections. However, there is some good news: the security vulnerability is not one that can be exploited by novice or even mid-level hackers, as the modification of upstream traffic requires advanced hacking skills.

Security concerns are a universal feature of the app development industry, but they are of particular concern to healthcare app developers, who are designing software products that deal with highly sensitive personal information. User privacy and hacking are also expected to be major points of focus in the Internet of Things app development landscape, as emerging IoT smart technologies will create unprecedented opportunities for black-hat hackers.