All Samsung phones vulnerable to network traffic snooping, unwarranted screen recording: Security Researcher Elliot Alderson

By Digit NewsDesk | Updated 10 Apr 2019
All Samsung phones vulnerable to network traffic snooping, unwarranted screen recording: Security Researcher Elliot Alderson
  • The well-known security researcher Elliot Alderson has reportedly found a vulnerability that is present on all Samsung phones.
  • The flaw enables an attacker to snoop network traffic of a victim, provided the former is physically able to access the phone.
  • The flaw has been disclosed to Samsung.

The French security researcher Elliot Alderson, aka @fs0c131y, has some new information to share about flaws in Samsung devices. He claims to have found a new vulnerability in all Samsung phones, which enables an attacker to capture the victim’s network traffic without their consent, given the hacker can gain physical access to their victim’s device. Additionally, the exploit enables the hacker to record the victim’s screen for up to an hour. Alderson disclosed the vulnerability to Samsung three weeks ago. The researcher has tweetstormed the exploit with a proof of concept and it all starts by booting up the Calculator app that is pre-installed on all Samsung phones. 


Typing (+30012012732+ in the calculator app will bring up DRParser Mode app. Typing *#9900# on the DO Parser Mode app boots up the Service Mode app, which has several critical options like logging network packet data and more. Three options on the Service Mode app menu are greyed out and out of them, Elliot used the "tcp dump start"  command-line packet analyzer to capture network traffic. However, tapping the button asks for an OTP, which the researcher bypassed since it is a locally implemented mechanism and doesn’t require an active net connection. Reversing the Service Mode app, the researcher was able to create a proof of concept via the CheckOTP method. This enabled him to enter the OTP key created in the prompt and enable capturing of network traffic. The network traffic capture log is saved on local storage. 

The flaw not only enables one to snoop on network traffic, but also allows an attacker to record their victim’s screen for up to an hour. This is apparently done via the IMS LOGGER option, which is one of the three greyed-out options on the Service Mode app. Enabling the “Record Screen" option from Filter Options when tapping on IMS LOGGER is said to do the trick, and the recording is saved on the local storage. 


Related Reads:

Asus software update utility was hacked to install malware on thousands of computers, company issues fix

Twitter aims to combat spammers by limiting daily follows to 400

Digit NewsDesk
The guy who answered the question 'What are you doing?' with 'Nothing'.

Recent Questions

Using Samsung KNOX security
Parag Jadhav
Sept 12, 2014
Responses 1
Vivek Bhatt
Sept 16, 2014
Be the first one to post the comment
Post a New Comment
You must be signed in to post a comment