Tel Aviv University (TAU) researchers discovered a serious security flaw in Samsung’s flagship Galaxy series in May 2021, and in October the company released a software update that fixed the loophole. According to the researchers, users who have not updated their Android software since October are urged to do so as soon as possible, because hackers could take advantage of the loophole to hack into the Galaxy smartphones in the series and steal sensitive information, for example that which protects Bitcoin wallets.

The study was conducted by Professor Avishai Wool of TAU’s School of Electrical Engineering, Dr. Eyal Ronen of TAU’s Blavatnik School of Computer Science, and TAU graduate student Alon Shakevsky.

“In protecting smartphones using the Android system, there is a special component called TrustZone,” explains Professor Wool. “This component is a combination of hardware and software, and its job is to protect our most sensitive information — the encryption and identification keys. We found an error in the implementation of Samsung’s TrustZone code, which allowed hackers to extract encryption keys and access secure information.”

“It should be understood that companies like Samsung go to enormous lengths to secure their phones, and yet we still hear about attacks, for example in the case of the NSO spyware,” Dr. Ronen adds. “TrustZone is designed to be the last layer of protection, the internal safe. So, even if NSO managed to hack into my phone, it still wouldn’t be able to access the encryption keys. For example, if I approve a bank transfer using a fingerprint, the fingerprint enters the phone’s TrustZone, and hackers will have no way to use the fingerprint to carry out transactions in my bank account. In our article, we showed that failures in Samsung’s code also allowed access to these sensitive cryptographic keys.”

In May 2021, the TAU researchers contacted Samsung and presented their findings. In October 2021, Samsung released an update to the Android operating software that fixed the major loophole in about 100 million Galaxy phones. Of course, the company and the researchers coordinated the date of the publication of the findings and the date of the update in order to prevent hackers from taking advantage the loophole.

“Alon Shakevsky worked for months on extracting the code from the device so that we could investigate it,” says Professor Wool, “and two weeks ago hackers broke into the company’s databases and leaked Samsung’s code. The information that was previously confidential is today available to everyone, including researchers like us. Therefore, the lesson for phone companies should be to publish the code in advance, let the experts and researchers check the architecture, and not to rely too much on the code’s secrecy. A secret code never guarantees longevity, because it will eventually leak. In the end, we helped Samsung.”

“We encourage all owners of Samsung Galaxy devices to update their software,” Dr. Ronen concludes.