On Wednesday, developers of an alternative version of Google's Android mobile operating system published a startling claim: Samsung's S3, Note 2, and seven other models of Galaxy smartphones contained a backdoor that provides remote access to virtually all data stored on the devices. The code that allows access, which controls the phones' baseband or modem processors, made it possible to remotely read, write, or even modify users' files.
"Provided that the modem runs proprietary software and can be remotely controlled, that backdoor provides remote access to the phone's data, even in the case where the modem is isolated and cannot access the storage directly," Paul Kocialkowski, one of the Free Software Foundation (FSF) developers who reported the finding, wrote in a separate post. "This is yet another example of what unacceptable behavior proprietary software permits!" Going on to plug the Android replacement known as Replicant, he continued: "Our free replacement for that non-free program does not implement this backdoor. If the modem asks to read or write files, Replicant does not cooperate with it."
To get a second opinion, Ars turned to Dan Rosenberg, a senior security researcher at Azimuth Security, who specializes in the reverse engineering of Unix and embedded devices. While he expanded the list of affected phones to include Samsung's more recent S4 and Note 3 models, he largely dispelled the claims that the software provided a backdoor that could be used to compromise users' privacy or security. What follows is an e-mail interview conducted early Thursday.
Read 15 remaining paragraphs | Comments