Samsung Galaxy S phones fail to properly validate Swiftkey language pack updates

Overview

Samsung Galaxy S phones, including the S4 Mini, S4, S5, and S6, fail to properly validate Swiftkey language pack updates.

Description

CWE-345: Insufficient Verification of Data Authenticity - CVE-2015-2865 Samsung Galaxy S phones, including the S4 Mini, S4, S5, and S6, are pre-installed with a version of Swiftkey keyboard that is signed by Samsung to operate with system privileges. By design, Swiftkey periodically checks for language pack updates over HTTP. By intercepting such requests and modifying the necessary fields, an attacker can write arbitrary data to vulnerable devices.

Impact

A remote, unauthenticated attacker conducting a man-in-the-middle attack may be able to write arbitrary data to vulnerable devices checking for updates. Depending on the frequency of Swiftkey update checks, such an attack may have a low likelihood of occurring.

Solution

Apply an update Samsung has provided a firmware update to cell phone carriers for distribution to affected users. If your cell phone carrier has not provided the over-the-air update, consider the following workaround:

Avoid untrusted networks Avoid using untrusted networks, including public WiFi. Using your device on an untrusted network increases the chance of falling victim to a MITM attack.

Vendor Information (Learn More)

Vendor	Status	Date Notified	Date Updated
Samsung	Affected	02 Mar 2015	16 Jun 2015
Samsung Mobile	Unknown	10 Jun 2015	10 Jun 2015

If you are a vendor and your product is affected, let us know.

CVSS Metrics (Learn More)

Group	Score	Vector
Base	5.7	AV:A/AC:M/Au:N/C:N/I:C/A:N
Temporal	4.5	E:POC/RL:OF/RC:C
Environmental	4.5	CDP:N/TD:H/CR:ND/IR:ND/AR:ND

References

• https://www.nowsecure.com/blog/2015/06/16/remote-code-execution-as-system-user-on-samsung-phones/
• http://cwe.mitre.org/data/definitions/300.html