Bug allowed full takeover of Samsung user accounts

Hackers could have taken over any Samsung account just by tricking a user into accessing a malicious link, a security researcher told ZDNet yesterday.

The vulnerability has now been fixed after the researcher, Ukrainian bug bounty hunter Artem Moskowsky, reported the issue to Samsung this month.

At the heart of this Samsung account issue is what security experts call a cross-site request forgery (CSRF) vulnerability. Explained in lay terms, this vulnerability allows an attacker to trick a user's browser into executing hidden commands on other sites the user is currently logged in, but while on an attacker's site.

Also: Samsung unveils new Notebook 9 Pen 2-in-1: Bigger size, better battery

Moskowsky told ZDNet that he identified three CSRF issues in Samsung's account management system.

The first would have allowed an attacker to change profile details, the second would have allowed an attacker to disable two-factor authentication, while the third would have allowed an attacker to change the user's account security question.

While all three were important issues, the third one could have been used to take over an account. Moskowsky told ZDNet that an attacker could have tricked a user into accessing a malicious link that would have changed the user's security question and respective answer.

Also: 5 features I'd love to see come to every smartphone in 2019

The attacker could have then attempted to log into the user's account using that user's email address and initiate a password recovery password that relied on the now-tainted security question. With a new password in hand, the attacker could then access the user's Samsung account.

For good measure, if the account would have used two-factor authentication, that could have been disabled at the same time the user accessed the malicious link.

Must read

• Samsung commits to making more exciting midprice phones (CNET)
• Samsung Galaxy A9: A cheat sheet (TechRepublic)

Access to a Samsung account can allow an attacker to track a user's movements via the Find My Device feature, control the user's inter-connected smart devices, access user health data, gain access to private notes, and more.

For the three bugs he reported, Samsung awarded the researcher a $13,300 reward. Last month, the researcher also collected a $25,000 bounty for a Steam bug that would have allowed an attacker to get any CD keys for any Steam game, ever.

2018's worst cryptocurrency scams, cyberattacks (in pictures)

Related stories:

• Ships infected with ransomware, USB malware, worms
• For the fourth month in a row, Microsoft patches Windows zero-day used in the wild
• Super Micro says external security audit found no evidence of backdoor chips
• Google+ hit by second API bug impacting 52.5 million users
• HP offers hackers $10,000 to find bugs in its printers TechRepublic
• Facebook entices researchers with $40,000 reward for account takeover vulnerabilities
• The rockstar hackers protecting you from the bad guys CNET
• Hackers can exploit this bug in surveillance cameras to tamper with footage