Bug discovered in Galaxy Phones Swift Keyboard App

SwiftKey is a third-party keyboard app that learns your writing style over time for a more intelligent autocorrect. I use it on my Nexus 6.

For those who use the SwiftKey app by choice on other phones, this is not a concern. LINK

quote:

---

Swiftkey is not to blame here and vulnerability is unrelated to SwiftKey’s consumer apps on Google Play and the Apple App Store. So your Swiftkey app has nothing to do with this story.

Yes, it supplies Samsung with the core technology that powers the word predictions in their keyboard.

But TechCrunch understand that the way that Swiftkey’s engine was integrated on Samsung devices introduced the security vulnerability in the first place.

It’s also a very low risk problem. For the bug to expose the phone, a user would have to be connected to a compromised network (such as a spoofed public Wi-Fi network) created for those purposes by a hacker with malicious intentions.

In a statement, Swiftkey told us that even then the access is only possible if the user’s keyboard is “conducting a language update at that specific time, while connected to the compromised network.”

It absolutely does not affect SwiftKey’s app on Google Play or the Apple App Store.

Here’s the bottom-line: our sources have told us that Samsung “screwed up” how they implemented Swiftkey’s SDK into their keyboard. Why? because they crazily gave the keyboard system level permissions.

As NowSecure says:

“It’s unfortunate but typical for OEMs and carriers to preinstall third-party applications to a device. In some cases these applications are run from a privileged context. This is the case with the Swift (sic) keyboard on Samsung… This means that the keyboard was signed with Samsung’s private signing key and runs in one of the most privileged contexts on the device, system user, which is a notch short of being root.”

Swiftkey does have one issue though: It used HTTP rather than HTTPS in some aspects of how the keyboard gets updated. This might have protected what appears to be a basic mistake in how Samsung integrated SwiftKey on their devices.

But whether it’s HTTP vs HTTPS is not the main issue here. It’s the system permissions – which is a problem laying firmly in Samsung’s camp.

---

I thought I was on tOT and initially read the headline as

"Bug discovered in another Galaxy" and I was all like :it's happening:


... then I read it again. I am disappoint.

quote:

---

"Bug discovered in another Galaxy" and I was all like :it's happening:

---

Only good bug is a dead bug!