Software giant Google claims that Samsung Galaxy S6 is riddled with major security flaws. This is after Project Zero, the company's elite team of hackers, discovered that the Korean-based Android smartphone contains 11 bugs that are considered "high-impact security issues," a report from iDigital Times said on Thursday.
According to the report, the Project Zero team has allotted one week to examine the bugs in Samsung OEM. The group has conducted the following activities to locate the bug.
- "Gain remote access to contacts, photos and messages. More points were given for attacks that don't require user interaction, and required fewer device identifiers.
- Gain access to contacts, photos, geolocation, etc. from an application installed from Play with no permissions
- Persist code execution across a device wipe, using the access gained in parts 1 or 2"
Listed below are the 11 issues discovered by Google's Project Zero team found in Samsung Galaxy S6, according to the team's official blog site.
1. CVE-2015-7888
2. CVE-2015-7889
3. CVE-2015-7890
4. CVE-2015-7891
5. CVE-2015-7892
6. CVE-2015-7893
7. CVE-2015-7894
8. CVE-2015-7895
9. CVE-2015-7896
10. CVE-2015-7897
11. CVE-2015-7898
"The majority of the issues are fixed, however three will not be patches until November. Fortunately, these appear to be lower severity issues. CVE-2015-7898 and CVE-2015-7895 require an image to be opened in Samsung Gallery, which does not have especially high privileges and is not used by default to open images received remotely via email or SMS (so an exploit would require the user to manually download the image and open it in Gallery). The other unfixed issue, CVE-2015-7893 allows an attacker to execute JavaScript embedded in emails, which increases the attack surface of the email client, but otherwise has unclear impact," Project Zero said.
Meanwhile, ZD Net reports that the 11 security flaws spotted in the Samsung Galaxy S6 Edge was discovered by Project Zero researcher Mark Brand. It can be recalled that it was Brand who, back in July, has informed Samsung about the traversal bug via the handset's WifiHs20UtilityService.
"The service scans for a zip file in /sdcard/Download/cred.zip and unzips it. What makes it dangerous is that the file-write vulnerability can be triggered by browsing to a website without any user interaction. The type of attack, otherwise known as a drive-by download, is commonly employed against desktop browsers," the report said.
