An Israeli cybersecurity researcher has uncovered 40 unknown zero-day vulnerabilities in Samsung’s operating system Tizen. The vulnerabilities “would allow someone to remotely hack millions of newer Samsung smart TVs, smart watches, and mobile phones already on the market, as well as ones slated for future release, without needing physical access to them.” IT security experts from Lastline, ESET, prpl Foundation and FireMon commented below.
Professor Giovanni Vigna, Founder and CTO at Lastline:
“It seems that Samsung, in its rush to come to market with a product to substitute Android, has not performed the relevant code analyses that would have prevented these flaws from being shipped with the Tizen OS.
“This is another clear example of how the pressure to deploy software in the current consumer market can actually harm the security of systems (from phones to IoT devices). Security needs to be built-in and not be an afterthought, as it is much harder to fix something broken that has been deployed to millions of devices, than to deploy secure (or at least reasonably secure) systems in the first place.”
Mark James, Security Specialist at ESET:
“Devices have integrated into our daily lives in a way that was never imagined when first designed, so it’s no surprise that they are now becoming a serious target for cyber criminals. TV’s and smart watches are capable of harvesting so much of our private data and could be sent to almost any location with or without the user’s knowledge. The only defence is to ensure that all of your internet connected devices are updated on a regular basis. If you cannot update then you should ask yourself “do I really need it connected to the internet?” and if no, then disconnect it.
“One of the biggest problems with technology is the speed at which it progresses – one minute the whole family is sat watching primates with Sir David Attenborough on one of your only 5 channels, the next you have a choice of over 240 channels with your TV being capable of viewing all your social media accounts. Internet surfing or playing games, all require intelligence and internet connectivity but more importantly access to your private data. In our quest for the “Smart TV” we often do not question how or where our data will be stored or sent and most would never look at how often the actual TV operating system or apps are going to be updated but that’s exactly what cyber criminals will do – they are looking for every new and unrestricted way they can find exploits and vulnerabilities on our new technologies. One of the only ways to stop them is having the ability to patch or update as fast and as easily as possible.”
Art Swift, President at prpl Foundation:
“If the industry reports are accurate, there appear to be a litany of failures in the development process. Also, the failure of the vendor to respond forthrightly to the researcher’s findings with either a willingness to work with the researcher to find fixes, or to provide software patches directly, is quite concerning.
“In order to prevent such issues in the future, the not for profit prpl foundation is working with industry to develop ways to create a more secure IoT. The prpl security framework encourages peer review, properly signed software anchored in a hardware root of trust, the re-use of well-understood and widely used communications and security protocols and the use of security by separation to isolate vulnerabilities.”
Paul Calatayud, CTO at FireMon:
“This recent discovery of the level of details in code quality within Samsung is alarming given that recently it was also discovered the NSA was researching exploits against smart TVs to support various programs.
“As a security practitioner, we often use Microsoft as solid example of a company that places a sizable emphasis on product security. Operating systems are now being replaced by IoT devices, but the security programs are not keeping with the pace of innovation. Same can be said about the car, healthcare, and other markets. The demand for security professionals will continue to increase.
“Home networks are becoming complex with consumer data and connected devices, but it’s also important to note many of these consumer electronics also have a home in corporations: conferencing rooms etc.”
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.