Search the Community

Dissecting the Linux/Moose malware http://www.welivesecurity.com/wp-content/uploads/2015/05/Dissecting-LinuxMoose.pdf ( PDF ) Download Source

Researchers have reportedly found a vulnerability in a security system embedded in Samsung's Galaxy S4 smartphone that could allow an attacker to steal data. Security researchers at Ben-Gurion University of the Negev in Israel uncovered vulnerabilities in Samsung's KNOX security solution. The findings were first reported by the Wall Street Journal, which noted that KNOX is currently being reviewed by the U.S. Department of Defense and other government agencies for potential use. Aimed at Google Android devices, KNOX includes the ability to enforce the separation of information through containerization as well as a secure boot and kernel monitoring capabilities. According to researchers at BGU's Cyber Security Labs, the issue makes interception of data communications between the secure container and the external world – including file transfers and emails – relatively easy. "To us, Knox symbolizes state-of-the-art in terms of secure mobile architectures and I was surprised to find that such a big 'hole' exists and was left untouched," Ph.D. student Mordechai Guri said in a statement. "The Knox has been widely adopted by many organizations and government agencies and this weakness has to be addressed immediately before it falls into the wrong hands. We are also contacting Samsung in order to provide them with the full technical details of the breach so it can be fixed immediately." Guri, who is part of a team of BGU researchers that focus on mobile security and other cyber-issues, uncovered the vulnerability while performing an unrelated research task. According to BGU, KNOX's secure container is supposed to ensure that all data and communications that take place within the secure container are protected. Even a malicious application should attack an area outside the secure container all the protected data should be inaccessible under all circumstances. However, researchers found that that is not the case. "To solve this weakness, Samsung may need to recall their devices or at least publish an over the air software fix immediately," said Dudu Mimran, chief technology officer of the BGU labs, in the statement. "The weakness found may require Samsung to re-think a few aspects of their secure architecture in future models." Samsung did not respond to a request for comment from SecurityWeek. However, the company told the Wall Street Journal that it was investigating the matter, and that preliminary investigation has found that the researchers' work seems to be based on a device that was not equipped with features that a corporate client would use alongside Knox. "Rest assured, the core Knox architecture cannot be compromised or infiltrated by such malware," the Samsung spokesperson told the Wall Street Journal. Source: Samsung KNOX Security Software Embedded in Galaxy S4 Vulnerable, Researchers Say | SecurityWeek.Com