Samsung Says Its Find My Mobile Service is Safe
Responding to a recent report that Samsung's Find My Mobile service was vulnerable to certain hack attempts, Samsung says that the reported issue was fixed through an update on October 13, and no user information has been compromised.
But even before the update, any data from the phone or on the server could not be accessed by the hacker, Samsung claims.
NIST had reported that the Remote Controls feature on Samsung mobile devices did not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.
Samsung says that the "unlikely" situation where the attacker could lock/unlock user's device and make the device ring (but not access any data), would have been if the user fell under all four of the following conditions:
- The attacker occupies a way to send a link containing malicious code.
- The Find My Mobile user sets up Find My Mobile Remote control 'ON' at his/her device
- The user enters up his/her ID and password and logs on Find My Mobile website (http://findmymobile.samsung.com) (If the user doesn't use the website after log-on, it will be automatically logged out)
- The user clicks the link in email/instant message/SMS sent by attackers
Find My Mobile is available for Samsung smartphones and tablets which run on Android 2.3.3 Ginger bread or higher from Galaxy S.
NIST had reported that the Remote Controls feature on Samsung mobile devices did not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.
Samsung says that the "unlikely" situation where the attacker could lock/unlock user's device and make the device ring (but not access any data), would have been if the user fell under all four of the following conditions:
- The attacker occupies a way to send a link containing malicious code.
- The Find My Mobile user sets up Find My Mobile Remote control 'ON' at his/her device
- The user enters up his/her ID and password and logs on Find My Mobile website (http://findmymobile.samsung.com) (If the user doesn't use the website after log-on, it will be automatically logged out)
- The user clicks the link in email/instant message/SMS sent by attackers
Find My Mobile is available for Samsung smartphones and tablets which run on Android 2.3.3 Ginger bread or higher from Galaxy S.