Samsung security: How long is 'too long' to patch?
Summary:A vulnerability in Samsung mobile devices which placed social networking accounts has been patched -- finally.
How long should companies have to patch security problems before public disclosure? A case study documenting a recent Samsung mobile vulnerability begs the question.
The Dr. Manuel Sadosky Foundation, based in Argentina, disclosed on security list Full Disclosure a vulnerability which impacts Samsung device users. Discovered by Joaqun Manuel Rinaudo, security vulnerabilities in the Samsung SNS Provider application for Android place social media accounts at risk, potentially allowing malicious third-party apps to access photos, status updates, feeds, location and other information -- as well as post content on the user's behalf without consent.
The Samsung Social Networking Service Provider application (SNS Provider) is used by Samsung devices to manage social media accounts including those on Facebook, Twitter, Google+, LinkedIn and Foursquare. The service also acts internally as a bridge to allow other applications, such as Gallery, to access data and content stored on these websites.
When a user logs into their social media account on a Samsung device which has SNS Provider installed, the app immediately requests full access to the account. If permitted, an access token to the account is obtained and stored in a local shared preference file.
SNS Provider is used monthly by 41 million users as of February 17, 2015, according to the bulletin.
The foundation says SNS Provider implements services used for management and syncing of these accounts, but "these services aren't protected by any permissions." The security notice states:
In addition, Samsung's software also allows other apps to request the access token to Facebook and Twitter accounts -- which are protected by custom permissions but no "proper" protection level tags. As a result, users are not notified by default when requests are sent.
"A malicious application that is granted these permissions could then connect to these services and obtain the credentials required to access a users's social network account content permanently," the security bulletin states. "For example, such an application could access the user's private messages on Facebook using the access token provided by the corresponding SNS Provider service."
Go here to read the rest:
Samsung security: How long is 'too long' to patch?