Skip to main content

Samsung patches flaw in update tool to foreclose man-in-the-middle attacks

samsung patches flaw in sw update galaxy tabpro s 9776
Jeffrey Van Camp/Digital Trends
Samsung has patched a flaw in its drive update tool that would have allowed malicious actors to carry out man-in-the-middle (MITM) attacks.

The Samsung SW Update tool tracks the software on your Samsung laptop or computer and alerts you of updates when they are available. Researchers at Core Security discovered that this tool was sending user data back to a server in clear text and unencrypted, making it a prime target for interception.

Recommended Videos

A second vulnerability revealed that Samsung’s software did not authenticate updates as they were being downloaded from Samsung’s servers. This could in theory allow an attacker to inject their own malware into your computer.

Please enable Javascript to view this content

“These vulnerabilities in Samsung SW Update Tool could allow a malicious user to read and modify the requests made both by the user and by the Samsung servers and potentially allow such user to infect the victim with a malware or a remote access tool and gain control over its machine,” said Core security researcher Joaquín Rodríguez Varela in a statement.

“After our report, Samsung implemented a ciphered communication between the tool and its servers and also a verification mechanism of the downloaded drivers.”

According to the advisory, Core Security first notified Samsung of the vulnerabilities it discovered in late January and Samsung released a fix for the update tool in early March following weeks of correspondence with the security researchers.

This isn’t the first time that Samsung has had security issues with the SW Update tool. A Microsoft employee last year found that the SW Update tool in certain Samsung computers was disabling the automatic updates in Windows 8.1. The file that was responsible wasn’t built in from the start on your computer but rather installed unknowingly when SW carried out one of its own updates. Samsung ultimately patched that flaw too, but had denied it was an issue at first.

Jonathan Keane
Former Digital Trends Contributor
Jonathan is a freelance technology journalist living in Dublin, Ireland. He's previously written for publications and sites…
Apple’s AR smart glasses may not be dead, after all
Person wearing Meta Orion smart glasses.

It seems Apple’s plans for making AR glasses are not dead after all, though it might take some time before the company puts them on the shelves. Bloomberg recently reported that Apple has shelved its AR smart glasses project, just like its doomed car project.

Now, the outlet claims that Apple has not entirely given up on that category. “I’m told that Apple’s long-term goal of standalone AR glasses remains intact, and the company will keep working on underlying technology — like screens and silicon — to help make such a device more feasible,” writes Mark Gurman in the latest edition of his PowerOn newsletter.

Read more
The 8 best color laser printers for 2025: tested and reviewed
The Color LaserJet Pro 4301fdw has good photo print quality on glossy paper.

The best color laser printers are a great investment that can save you time and money compared to cartridge-based inkjet printers. Laser printers use toner, which lasts a long time, delivering a low cost per page for monochrome documents and incredibly fast color prints. The best color laser printers offer high-quality prints and reliability that help keep your home office or small business productive.

If you need to scan documents for record-keeping and photo capture or want the convenience of a color copier, an all-in-one color laser printer is an essential tool for your small business or personal use. For a small added cost, you get expanded capabilities. That's why we include several all-in-one models from the best printer brands.

Read more
Zotac outsmarts scalpers by selling GPUs directly to gamers
A promo for the Zotac RTX 50-series GPUs

Zotac is taking a bold step to combat GPU scalping by selling its latest RTX 50-series graphics cards including the RTX 5090 and RTX 5080 directly to gamers through its official gaming Discord server. This initiative is an attempt to ensure that genuine customers have a fair chance to purchase the latest GPUs at MSRP (Manufacturer's Suggested Retail Price) without interference from scalpers and bots.

To qualify, users must actively engage in the Zotac Discord community by participating in discussions, events, and challenges. Winners are then selected using a random number generator, ensuring a transparent process. Currently, the program is limited to users in the U.S., and while a limited number of RTX 5080 units are available, the RTX 5090 is not yet in stock.

Read more