Pierluigi Paganini
May 13, 2019
French white hat hacker Robert Baptiste (aka @fs0c131y) discovered how to brick all Samsung mobile phones.
Baptiste bought a Samsung mobile phone a few months ago and decided to analyze it. After a few hours of tests, he discovered an unprotected receiver in the ContainerAgent application.
The researcher noticed the presence of a broadcast receiver called
SwitcherBroadcastReceiver into the ContainerAgent application version 2.7.05001015.
The receiver is enabled and exported by default, Baptiste focused its analysis on the implementation to understand how to trigger the receiver.
Below some considerations made by the expert in a blog post published on Medium:
By looking the onReceive method of the SwitcherBroadcastReceiver, we are able to deduce that This receiver:
The expert started working to the creation of the intents when noticed that if the extra ACTION_COMMAND is set to 1001, the immediateLock method is invoked using the value of the extra user_handle as a parameter.
This means that using setting the value of user_handle to 150, the user id associated with the “Knox user”, it is possible to lock immediately the Knox container. Baptiste was able to create the final intent to lock the Knox container.
He also discovered that setting the extra ACTION_COMMAND to 1002 it is possible to call ‘
“So, if I set the value of user_handle to 0, the user id of the first user, it will switch automatically to the first page of the launcher.” continues the expert.
The expert was able to create the final intent to switch to the first page of the launcher.
In order to exploit this flaw, the white hat hacker created a specially crafted “Locker application:”
The Proof Of Concept (POC) developed by Baptiste sends the 2 intents developed by the expert every second, he also noticed that once opened the app for the 1st time, the app icon will disappear.
This will cause the device will be inoperable due to this local DoS attack.
“Every time the victim will open the SecureFolder app, the container will be locked and every time he will try to use his phone, the phone will come back directly to the first page of the launcher.” concludes the expert.
Below the timeline of the attack:
If you are interested in the “intents” created by Elliot give a look at his post:
https://medium.com/@fs0c131y/how-to-brick-all-samsung-phones-6aae4389bea
| [adrotate banner=”9″] | [adrotate banner=”12″] |
(
[adrotate banner=”5″]
[adrotate banner=”13″]
