If you were an Apple user then you must aware of Find My Phone app service provided by the Apple to remotely locate or disable the phone and to do more with the phone, but the same feature created by the Samsung for its mobile phones is not too secure as Apple one.
According to a flaw discovered by the security researchers Samsung’s Find my Phone app is vulnerable and an attacker able to use the victim’s phone remotely. After successful exploitation attacker also gets access to sensitive data too.
The main thing about this flaw is—It is a Zero Day vulnerability and may be is being used at the time of publishing this news.
NIST—The National Institute of Standards and Technology warning users of this new Zero-Day Vulnerability in the Samsung Find my Phone app.
As I said above this is something like the Apple’s Find my Phone app, the Samsung app also able to lock a theft device remotely by the owner and also play sounds on the phone like Apple’s push notifications.
This amazing and scary vulnerability founded by Mohamed Abdelbaset Elnoby (@SymbianSyMoh), who is an Information Security Evangelist from Egypt.
According to Mohamed this Flaw is a CSRF (Cross-Site Request Forgery) attack and allows an attacker to remotely lock or unlock the device and make the affected device to be ringed.
Cross-site request forgery, also known as a one-click attack or session riding and abbreviated as CSRF (sometimes pronounced sea-surf) or XSRF, is a type of malicious exploit of a website whereby unauthorized commands are transmitted from a user that the website trusts. Unlike cross-site scripting (XSS), which exploits the trust a user has for a particular site, CSRF exploits the trust that a site has in a user’s browser.
How an Attacker will affect your device?
First an attacker will try to trick you to click a malicious link, if you click that link then all of the privileges will be sent to the attacker too and then the attacker is lord of your device, after the successful exploitation the attacker can:
- Change password
- Change personal details
- Purchase something from your saved credit cards
- Access sensitive data
“In this way, the attacker can make the victim perform actions that they didn’t intend to, such as logout, purchase item, change account information, retrieve account information, or any other function provided by the vulnerable website,” Mohamed said.
Mohamed also uploaded a video on YouTube to show his POC:
To protect yourself, don’t use any of the Find My Phone service of Samsung until an update comes of it and Don’t click to any suspicious link.