Replicant detects suspicious backdoor implanted in Samsung Mobile Phone firmware

The AOSP-based free Android derivative edition Replicant developer found recently that there are suspicious Backdoor programs in Samsung's Galaxy series Mobile Phone firmware, allowing remote control of the system I/O through the modem.

To put it simply, in addition to the application processors running General programs and user interaction, the smartphone also has a communication processor dedicated to the operations of the communication module. Although systems running on application processors, such as Android, are open-source or partially open-source, most of the operating systems on communication processors come from closed-source private firmware provided by SoC. This is where the suspected backdoor program discovered by Replicant is located.

The Replicant developer found on several Samsung mobile phones that the firmware of the customized version is responsible for interacting with the communication processor to implement a private IPC, allow the communication processor to perform read, write, and delete operations on the file system of the Master System. Since this process is at the underlying level and the communication processor operates almost all the time, it is intended that users can remotely operate the file system without their knowledge. New models cannot access the personal data of user partitions because of the introduction of SELinux, but earlier models are completely exposed, allowing others to modify them.

Based on the current situation, the Replicant developer has modified the firmware to block the file system I/O operation request of the communication processor. Similar operations can also be used by other firmware such as CM in the future.

Other highlights:

• Affected models: Nexus S, Galaxy S, Galaxy S2, Galaxy Note, Galaxy Tab 2, Galaxy S 3, and Galaxy Note 2. the backdoor of Galaxy S even runs as root.
• Backdoor hidinglibsec-ril.soIn the library file, this file is still included by almost all third-party firmware for Samsung mobile phones, including CM. Therefore, even if you use the CM firmware, you will still be manipulated by the backdoor until a third-party firmware developer applies the Replicant patch.
• At this stage, no legal or user-related application has been found for the backdoor implantation, but it is not ruled out that the backdoor was deployed due to the legal requirements of a region after it was further clarified.

 

FSF also issued its own voice on the incident and called on users to ask Samsung Mobile to publicly explain the issue.

Detailed Analysis Report

Message Source:Phoronix