It's been a busy week for the cybersecurity world. The U.S. government announced recently that it had been a victim of two serious data breaches on the Office of Personnel Management (OPM). In addition password management company LastPass released notifications that it also had been hacked and urged customers to change master passwords and use multi-factor authentication. Now, a security company has reported that it found a security flaw in Samsung Galaxy phones last November that still hasn't been fixed.
The flaw has to do with the keyboard on those devices. Technology firm, SwiftKey is the maker of the keyboard, but says the flaw is within the implementation of it on the Samsung devices. The way it is installed may allow hackers to access some of the core parts of the computer system on the phone, if they catch it at the right time.
For now, it is being advised that Galaxy owners with versions S3 to S6 avoid using unsecured public WiFI or even the carrier's network to download updates for the phones. It is because the vulnerability allows the potential for exploit when an update is being installed. It's not necessarily easy to pull it off, but it can be done. It is safer to install updates from a secured wireless network instead.
The issue may allow users to be exposed to spying. For example, when company executives or government employees travel abroad, it may make it easier for others to eavesdrop; a practice that is well-known to occur for those traveling to China. The U.S. recently approved the Samsung Galaxy for use by government employees. This has become a topic of conversation recently after sensitive information about federal employees was breached in the OPM incidents. The fear is that the information stolen may be used against them and the U.S.
SwiftKey claims it only found out about the issue recently. Although Samsung was notified about it over six months ago, the company that reported it to them said Samsung asked for over a yearto fix it before notifying the public about it. Samsung claims it didn't know the full details and severity of it until this week. Now that the cat is out of the bag, the company has said it will have a fix ready in a few days.
However, it is up to the phone service carriers to release it to their users and that has historically been a long process. When they do, apply it right away; from a secured location.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
