Researchers at Tel Aviv University and Samsung recommend that owners of Galaxy smartphones update their devices as soon as possible, since a vulnerability has been discovered in them that allows the disclosure of user data.
Researchers at Tel Aviv University discovered the problem last year and reported it to Samsung in May. The company released a fix in October.
Experts intend to present the results of their research in August 2022 at the USENIX conference. They were also previously published on the website of the International Association for Cryptological Research (IACR).
“To protect Android smartphones, there is a special component called TrustZone. This component is a combination of hardware and software, and its purpose is to protect the most sensitive information – encryption and identification keys. We found an error in the implementation of the Samsung TrustZone code, which allowed hackers to extract encryption keys and gain access to protected information,” explained Avishai Wool, head of the study, professor at the School of Electrical Engineering at Tel Aviv University.
According to one of the researchers Eyal Ronen, smartphone manufacturers, including Samsung, are making great efforts to secure their products. TrustZone should serve as a kind of internal safe, which even the most advanced hacker will not be able to crack.
“If I confirm a bank transfer with a fingerprint, this fingerprint gets into the TrustZone, and hackers have no way to use it to make transactions from my bank account. In our article, we talk about problems in Samsung’s code that allow access to these sensitive encryption keys,” Ronen said.
One of the authors of the study, Alon Shakevsky, worked for several months to extract the code from the device so that the team could study it. However, a few weeks ago, hackers broke into Samsung’s database and published the code, Wool explained.
“Information that used to be confidential is now available to everyone, including researchers like us. Therefore, phone manufacturers should learn a lesson and publish the code in advance. Let experts and researchers check the architecture, and do not rely too much on the closeness of the code. There is no guarantee that the code will remain closed for a long time, because in the end it will leak anyway. In the end, we did help Samsung,” Wool said.