Samsung Tizen OS: 40 unknown OS vulnerabilities

Tuesday 4th April 2017
Amihai Neiderman Def Camp 2016 discovers 40 unknown zero-day vulterabilities in the Samsung operating system, Tizen

The vulnerabilities “would allow someone to remotely hack millions of newer Samsung smart TVs, smart watches, and mobile phones already on the market, as well as ones slated for future release, and all without needing physical access to them.”

Cyber security experts explain how this happened 

Tizen and what users should do to keep their devices secure:  (right) Professor Giovanni Vigna, founder and CTO, Lastline: “It seems that Samsung, in its rush to come to market with a product to substitute Android, has not performed the relevant code analyses that would have prevented these flaws from being shipped with the Tizen OS.

“This is another clear example of how the pressure to deploy software in the current consumer market can actually harm the security of systems (from phones to IoT devices). Security needs to be built-in and not be an afterthought, as it is much harder to fix something broken that has been deployed to millions of devices, than to deploy secure (or at least reasonably secure) systems in the first place.”

Mark James, (left) security specialist at ESET: “Devices have integrated into our daily lives in a way that was never imagined when first designed, so it's no surprise that they are now becoming a serious target for cyber criminals. TV's and smart watches are capable of harvesting so much of our private data and could be sent to almost any location with or without the user’s knowledge. The only defence is to ensure that all of your internet connected devices are updated on a regular basis. If you cannot update then you should ask yourself "do I really need it connected to the internet?" and if no, then disconnect it. 

Art Swift, president, prpl Foundation: “If the industry reports are accurate, there appear to be a litany of failures in the development process. Also, the failure of the vendor to respond forthrightly to the researcher's findings with either a willingness to work with the researcher to find fixes, or to provide software patches directly, is quite concerning.

“In order to prevent such issues in the future, the not for profit prpl foundation is working with industry to develop ways to create a more secure IoT. The prpl security framework encourages peer review, properly signed software anchored in a hardware root of trust, the re-use of well-understood and widely used communications and security protocols and the use of security by separation to isolate vulnerabilities.”

Paul Calatayud, (left) CTO, FireMon: “This recent discovery of the level of details in code quality within Samsung is alarming given that recently it was also discovered the NSA was researching exploits against smart TVs to support various programs.  “As a security practitioner, we often use Microsoft as solid example of a company that places a sizable emphasis on product security. Operating systems are now being replaced by IoT devices, but the security programs are not keeping with the pace of innovation. Same can be said about the car, healthcare, and other markets. The demand for security professionals will continue to increase. 

“Home networks are becoming complex with consumer data and connected devices, but it's also important to note many of these consumer electronics also have a home in corporations: conferencing rooms etc.”

Custom Search

Scotland, Computer News in Scotland, Technology News in Scotland, Computing in Scotland, Web news in Scotland computers, Internet, Communications, advances in communications, communications in Scotland, Energy, Scottish energy, Materials, Biomedicine, Biomedicine in Scotland, articles in Biomedicine, Scottish business, business news in Scotland.

Website : beachshore