Samsung is one of the leaders in the number of phones sold. To provide all of its offers, the company needs a lot of web domain names (hundreds of them) in order to connect them with different applications and services.
One domain name that was linked to the S Suggest app has expired, and Samsung has failed to notice it.
S Suggest was an app that would suggest other applications to use on users' smartphone. It also had a social aspect, showing users which apps their friends were using via its Facebook integration. S Suggest has been pre-installed on many Samsung phones, before Samsung discontinued it in 2014.
According to a security researcher who purchased the domain, this could have led to malicious attacks on millions of devices.
Anubis Labs's CTO, João Gouveia, has taken ownership of ssuggest.com, the domain name in question. He said that S Suggest app was the only application that is affected by data sent from the expired domain.
The vulnerability is because S Suggest needs a lot of permission to run. "Someone with bad intentions could have grabbed that domain and do nasty things to the phones.” Such permissions include the ability to reboot, install packages, get full internet access, and more.
Anyone with access to the domain could use it to force the installation of malicious software via the app.
Gouveia reported that he monitored over 620 million individual connections to the domain from over 2.1 million devices. What this means, there were still a significant number of phones from 2014 and before that were left vulnerable by Samsung.
But Samsung disputed that claim, saying that "control of the domain 'does not allow you to install malicious apps, it does not allow you to take control of users’ phones.'”
Gouveia that took ownership of the domain, has offered to give back the domain to Samsung.
Samsung was also criticized for poor security practices just a couple of months prior, when another researcher described its Tizen software as possibly "the worst code [he's] ever seen," due to multiple bugs and critical vulnerabilities.
