Samsung patches flaw in update tool to foreclose man-in-the-middle attacks

samsung patches flaw in sw update galaxy tabpro s 9776
Jeffrey Van Camp/Digital Trends
Samsung has patched a flaw in its drive update tool that would have allowed malicious actors to carry out man-in-the-middle (MITM) attacks.

The Samsung SW Update tool tracks the software on your Samsung laptop or computer and alerts you of updates when they are available. Researchers at Core Security discovered that this tool was sending user data back to a server in clear text and unencrypted, making it a prime target for interception.

A second vulnerability revealed that Samsung’s software did not authenticate updates as they were being downloaded from Samsung’s servers. This could in theory allow an attacker to inject their own malware into your computer.

“These vulnerabilities in Samsung SW Update Tool could allow a malicious user to read and modify the requests made both by the user and by the Samsung servers and potentially allow such user to infect the victim with a malware or a remote access tool and gain control over its machine,” said Core security researcher Joaquín Rodríguez Varela in a statement.

“After our report, Samsung implemented a ciphered communication between the tool and its servers and also a verification mechanism of the downloaded drivers.”

According to the advisory, Core Security first notified Samsung of the vulnerabilities it discovered in late January and Samsung released a fix for the update tool in early March following weeks of correspondence with the security researchers.

This isn’t the first time that Samsung has had security issues with the SW Update tool. A Microsoft employee last year found that the SW Update tool in certain Samsung computers was disabling the automatic updates in Windows 8.1. The file that was responsible wasn’t built in from the start on your computer but rather installed unknowingly when SW carried out one of its own updates. Samsung ultimately patched that flaw too, but had denied it was an issue at first.

Mobile

G’day, Google: U.S. users can now give Assistant a British or Australian accent

U.S. Google Assistant users can give their Assistant a different voice. Google has updated Assistant with the ability for users to give it either a British or Australian accent, which could make it a little more personal for some.
Mobile

Want to watch Netflix in bed or browse the web? We have a tablet for everyone

There’s so much choice when shopping for a new tablet that it can be hard to pick the right one. From iPads to Android, these are our picks for the best tablets you can buy right now whatever your budget.
Gaming

Some ‘Fortnite’ players aren’t too happy with the new Infinity Blade weapon

The most recent update for Fortnite added the Infinity Blade melee weapon to battle royale, and some players aren't happy with how much it has changed the game during competitions.
Gaming

How you can give your PS4 a fresh start with a factory reset

Learn the many ways you can factory reset your PS4. From reverting your settings to factory to doing a full wipe and reinstalling the latest PlayStation firmware, we cover it all here, step by step.
Photography

Not just for Lightroom anymore, Loupedeck+ now works with Photoshop

Loupedeck+ can now help photographers edit in Photoshop too, thanks to physical controls for swapping tools, running actions, and more. The photo-editing console expanded to include Photoshop in the list of compatible editing programs.
Computing

Turn your Raspberry Pi into a Steam streaming hub with Valve’s Steam Link app

Valve's Steam Link app is now fully supported by Raspberry PI hardware, meaning that just about anyone with a few dollars to spare can build their own Steam streaming box in a matter of minutes.
Computing

Amazon takes $300 off Intel Core i7 Surface Pro 6 in latest sale

If you're looking for savings on the Surface Pro 6, Amazon is the place to shop. It currently is discounting the Intel Core i7 variant of Microsoft's latest 2-in-1 by $300, though no Type Cover is included.
Music

Here's our head-to-head comparison of Pandora and Spotify

Which music streaming platform is best for you? We pit Spotify versus Pandora, two mighty streaming services with on-demand music and massive catalogs, comparing every facet of the two services to help you decide which is best.
Computing

Our favorite Chrome themes add some much-needed pizzazz to your boring browser

Sometimes you just want Chrome to show a little personality and ditch the grayscale for something a little more lively. Lucky for you, we've sorted through the Chrome Web Store to find best Chrome themes available.
Computing

Don't keep typing the same thing -- learn to copy and paste with these shortcuts!

Looking for useful Windows keyboard shortcuts? The most common are the cut, copy, paste and undo shortcuts compatible with all kinds of tasks. They can save you an awful lot of time if you learn how to use them.
Computing

Latest Facebook bug exposed up to 6.8 million users’ private photos

An API bug recently left an impact on Facebook users. Though the issue has since been fixed, some of the apps on the platform had a wrongful access to consumers photos for 12 days between September 13 and September 25. 
Computing

You can now get a Surface Laptop 2 for $800 at the Microsoft Store

Along with deals on other variants, starting configurations of Microsoft's Surface Laptop 2 are now going for $800 online at its retail store, cutting $200 from its usual $1,000 starting price. 
Computing

Need a monitor for professional photo-editing? These are the very best

Looking for the best monitor for photo editing? You'll need to factor in brightness, color accuracy, color gamut support and more. Fortunately, we've rounded up the best ones for you, to help you make an educated purchase.
Computing

HDR monitors are beginning to have an impact. Here are the best you can buy

HDR isn't the most common of PC monitor features and is often charged at a premium, but the list of available options is growing. These are the best HDR monitors you can buy right now.