Enormous security flaw allows hackers to eavesdrop on more than half-a-billion Samsung devices

Chicago-based security firm NowSecure has published a report that details a bug in the Swift keyboard software, a program that comes preinstalled on more than half-a-billion Samsung devices, and which could allow a remote attacker to control a user’s network traffic for the purpose of executing arbitrary code on the user’s phone.

Making matters worse, if your phone is one of the 600 million Samsung devices subject to this error, the Swift keyboard software cannot be uninstalled, which means it could be exploited even when not in use. 

While data breaches and security flaws seem common nowadays, what makes this particular instance so noteworthy is the fact that Swift runs in a privileged context on the phone; that is, it can access most of the phone’s functions. So, a well-versed hacker privy to this weakness would be able to exploit it in order to secretly install malware on the individual’s device for the purpose of accessing the camera, microphone, and GPS, or to eavesdrop on calls or messages, or to change the way apps perform.

The bug could also be used to steal photos and text messages.

NowSecure states it notified Samsung of the vulnerability in December of last year, and that the US Computer Emergency Readiness Team and Google’s Android team were also made aware of the situation. Fortunately, Samsung was quick to react and started providing a patch to network operators shortly after being notified; what’s not known, though, is how many of them have actually been provided to its users.

Among the devices vulnerable to this flaw: Samsung Galaxy S6, S5, S4 and S4 mini on major U.S. carriers, including Verizon, AT&T, Sprint and T-Mobile.

NowSecure recommends best course of action until you can confirm your device has received the patch is to avoid unsecured WiFi networks and / or use a different device. 

The company also made it a point to state that SwiftKey, the downloadable keyboard app available on Google Play, which is based on the same software development kit, has no relation to the preinstalled version, and installing it or removing it from your device does not fix the vulnerability. 

Read NowSecure’s full report here.

Via Mashable