Why All Samsung Phones Are Suddenly At Major Risk Of Being Hacked
This article is more than 2 years old
The digital age continues to grow and expand all around us with new technologies and applications coming into existence daily. Society has become more reliant on these technologies to the degree that if these products failed us, we fear that would plummet humanity into chaos. The threat is real and we have learned that Samsung phones have been compromised because of leaked signing keys that create a security threat to the apps on those phones.
The threat comes in the form of computer hackers and malicious malware that try to corrupt computer systems. We have recently learned that Samsung has confirmed that their update signing key was leaked. The shocking part of all of this is that this occurred back in 2016 and has been a vulnerability for the last seven years.
To dive into the technical aspects of exactly how vulnerable our Samsung devices are to a potential malware threat we need to understand the process in which phones and apps interact with each other. Applications for our phones receive updates from the application manufacturers to correct glitches and issues users might be facing with the installed software. These updates occur when an app developer becomes aware of an issue from either their engineers discovering it or user feedback that is reported to the company.
Once they are aware of the issue their engineers will work on a solution that resolves the problem. If the issue is minor, they will bundle multiple fixes into an update package which then gets sent out to all the users who have it downloaded to their devices. When the update package from the company is connected to the device it requests the company’s signing key which is a unique password so the device can be sure it was sent by the company and not a computer hacker. This security protocol protects the device from having malicious programs designed to either gather sensitive user data or programs that can destroy the hardware on which the virus program runs on.
According to ARS Technica, “If a third-party developer ever lost their signing key, it would be bad. If an Android OEM ever lost their system app signing key, it would be really, really bad.” That is exactly what happened with Samsung Android devices back in 2016. Since this is categorized as a really, really bad situation what could this breach realistically affect?
ARS Technica further reports, “Samsung’s compromised key is used for everything: Samsung Pay, Bixby, Samsung Account, the phone app, and a million other things you can find on the 101 pages of results for that key.” Now if this leak occurred back in 2016 what has Samsung done to correct the potential threat? Samsung’s response, “Samsung takes the security of Galaxy devices seriously. We have issued security patches since 2016 upon being made aware of the issue, and there have been no known security incidents regarding this potential vulnerability. We always recommend that users keep their devices up to date with the latest software updates. “
However, when talking with experts in this field they all have the same conclusion which is that Samsung’s response doesn’t really make any sense. The biggest concern is why has Samsung not changed its signing key since they are fully aware that it has been compromised. As of now, consumers are left in the dark about how this breach occurred and how Samsung is handling the issue, which has already been ongoing for 7 years.
If you are a Samsung Galaxy user the only thing you can do is wake up each day and hope that your device is not irrevocably damaged by hacker updates that might occur because they have the signing key for your device. We will keep a close eye on what comments Samsung may have for us about its plans to solve this signing key issue.
