Phone Hacks - "Honor View 10 arriving internationally January 8th, Honor 7X Red Model coming to U.S."

Honor View 10 arriving internationally January 8th, Honor 7X Red Model coming to U.S.

MTPwn Can Access Samsung Devices’ Storage Without Unlocking Them

When it comes to Android phone security, one of the best-known platforms is Samsung’s Knox, a suite for Samsung phones aimed at enterprise. It’s considered one of the best on the market, but it isn’t impregnable, as a recently uncovered exploit showed.

The exploit (SVE-2017-10086), which was fixed in the October 2017 security patch or  November 2017 security patch (depending on the device model), leveraged a vulnerability in Samsung’s implementation of Media Transfer Protocol (MTP) that could allow an attacker to view all of a device’s files. It’s been nicknamed “MTPwn”, and it affects all Samsung devices running Android 4.4.x to Android 7.x.

MTPwn allows a hacker to bypass the lock state of unpatched devices even if they’re in “charging” mode, and enable MTP access from a computer. How’s that possible? Affected devices run an MTP server when a device is plugged in and in charging mode. Normally, computers can’t read the files because the phone blocks them from viewing any usable storage on the device. That works pretty well in practice, but Samsung overlooked the fact that the MTP server can receive commands — an attacker can simply force the MTP server on the device to list the device’s files, retrieve the files from its internal storage, or copy files to it.

Check out the GitHub repo of MTPwn to see how it works, and how you to test it out on your own Samsung device.


Source: MTPwn GitHub

tags : android auto, android wear, android device manager, android 1, android phone, android messages, android studio, android tablet, android emulator, android tv, android p, android 17, android tv box, android browser, android keyboard, android apps, android best games, android oreo, android lost, android latest version, android versions, android central, android police, android, android one, android screen recorder.

Comments

Popular posts from this blog

Google Reportedly Paying Apple $9 Billion to Remain Default iOS Search Option

How to Get iPhone XS Depth Effect Control On iPhone X, iPhone 8 Plus, and iPhone 7 Plus

Facebook Uses Your 2FA Phone Number for Targeted Advertising