Samsung.com Account Takeover Vulnerability Write-up

Nytro · January 25, 2014

Samsung.com Account Takeover Vulnerability Write-up

First of all let me say this: Hurray! They fixed it!

After contacting Samsung multiply times I thought they’d completely blown me off in fixing this bug but it looks patched (hopefully!).

EDIT: Samsung contacted me and said thanks for the report of the vulnerability. They seemed sincerely interested in fixing the problem – quite the opposite of my initial impression with them (their initial impression of me must’ve been odd considering I’m pretty sick with a cold at the time of this writing).

The Vulnerability

All Samsung.com accounts can be taken over due to an issue with character removal after authentication. When you register at New URL you can add extra spaces to the end of your account name and it will be registered as a separate account altogether. Alone this is not a big issue (other than perhaps spamming an email address by making multiple accounts with additional spaces after them). However, upon navigating to a Samsung subdomain such as Samsung US | TVs - Tablets - Smartphones - Cameras - Laptops - Refrigerators these trailing spaces are scrubbed from your username. Once this happens and you navigate back to Samsung.com you are authenticated as just a regular email address without any trailing spaces – effectively taking over your target’s account.

So if your username was originally “admin@samsung.com<SPACE><SPACE>”, after visiting Samsung US | TVs - Tablets - Smartphones - Cameras - Laptops - Refrigerators it would be scrubbed to “admin@samsung.com”.

Apparently scrubbing isn’t always a good thing

(the security puns don’t get worse than that!)

More Detailed instructions (Now patched, at least for shop.us.samsung.com):

1. Register an account at Samsung.com with the email address of a target, use Tamper Data or another HTTP intercept tool and add trailing spaces to the username.

2. Complete the account registration process

3. Navigate to “shop.us.samsung.com”, ex: http://shop.us.samsung.com/store?Action=DisplayCustomerServiceOrderSearchPage&Locale-en_US&SiteID=samsung

4. Navigate back to the main Samsung.com domain, ex: Galaxy Note 10.1- 2014 Edition

5. Proceed to attempt to add items to your cart and go to checkout page

6. Notice the account details and cards on file are those of your target

Sadly because this isn’t a Samsung TV there is no bug bounty for this exploit, but oh well.

Proof of Concept Video