Third-party developers discover a 'backdoor' in Samsung Galaxy devices

Developers of Replicant, a project that aims to offer free and open source distribution of Android for popular smartphones and tablets, claim to have discovered a backdoor in some Samsung Galaxy smartphones and tablets.

Writing a blog post for the Free Software Foundation, Replicant developer Paul Kocialkowski said that a program that shipped with some Samsung Galaxy smartphones and tablets "makes it possible for the modem to read, write, and delete files on the phone's storage."
According to information available on the Replicant website, the devices that include this backdoor are Samsung Galaxy S (I9000), Galaxy S II (I9100), Galaxy Note (N7000), Galaxy Nexus (I9250), Nexus S, Galaxy Tab 2 7.0 (P31xx), Galaxy Tab 2 10.1 (P51xx), Galaxy S III (I9300), and Galaxy Note 2 (N7100).
Kocialkowski says that on several devices the backdoor program "runs with sufficient rights to access and modify the user's personal data." He adds that the "backdoor provides remote access to the phone's data, even in the case where the modem is isolated and cannot access the storage directly."
The developer of course recommends installing Replicant Android images on to your Samsung device as a 'fix' for this backdoor. "If the modem asks to read or write files, Replicant does not cooperate with it," says Kocialkowski. He adds that even that may not be a good-enough fix if the backdoor allows the modem to take control of the main processor and override the instructions - a scenario that Replicant cannot monitor or verify.
Before the conspiracy theorists come out in numbers, it's worth noting that the Replicant website says "it is possible that these were added for legitimate purposes, without the intent of doing harm by providing a back-door. Nevertheless, the result is the same and it allows the modem to access the phone's storage."
Samsung has been silent on the issue so far, though that might change as the story gets picked up by the mainstream news outlets. Technical details of the backdoor are available on the Replicant website.



 
source:ndtv