Samsung Fixes Three Critical Bugs Reported by Ukrainian Bug Bounty Hunter

By Bill Toulas / December 13, 2018

Only a while after Samsung claimed that their phones and software are the most secure out there, a set of three CSRF (cross-site request forgery) issues in their own account management system have lashed these claims. The revelation of the bugs was made by Ukrainian security researcher and bug bounty hunter Artem Moskowsky, the same person who uncovered a serious Steam bug last month.

CSRF attacks involve the authentication of the user in a web application and a sequence of state-changing requests that the user does not realize. They can manifest as simply as by visiting a website or opening a link from a chat or email, forming a platform to trick the user into executing whatever actions the attacker is aiming for. Usually, these actions involve the changing of an email address that leads to the granting of access of the attacker to the victim’s account.

Moskowsky identified and reported three CSRF issues, with the first allowing the attacker to alter the profile details, the second to disable the two-factor authentication, and the third and worse one to change the account’s security question. The attacker could just visit the Samsung account sign-in page, initiate a password recovery process by using the altered security question, and finally, having disabled the two-step authentication, access another user’s Samsung account.

Besides getting access to the user’s personal data and private notes, the attacker could also use this method to track the whereabouts of the victim via the platform’s “Find My Device” feature. For the contribution of Moskowsky’s reports, Samsung compensated the researcher with a $13300 reward and fixed the security gaps in their account management system.

Do you have a Samsung account? Are you confident about Samsung’s security? Let us know of your opinion in the comments section below, and also visit our social pages on Twitter and Facebook to find out what else is on today.

For a better user experience we recommend using a more modern browser. We support the latest version of the following browsers: For a better user experience we recommend using the latest version of the following browsers: