Chainspotting 2: The Unofficial Sequel to the 2018 Talk "Chainspotting"

Chainspotting 2: How Five Logic Bugs Chained Together to Pwn the Samsung Galaxy S24

Speaker: Ken Gannon (NCC Group, at time of research)

Conference: OffensiveCon 2025 — May 16–17, 2025, Berlin

YouTube: https://www.youtube.com/watch?v=LAIr2laU-So

Reading time: ~9 minutes

TL;DR

Ken Gannon was the sole phone entrant at Pwn2Own Ireland 2024 and successfully compromised the Samsung Galaxy S24 using an unbroken chain of five logic bugs — zero memory corruption required. Starting from a browsable intent vulnerability in Samsung Gaming Hub (version 7.1.01.7), the chain exploits a JavaScript enable bypass, an arbitrary intent launch primitive, and an unsigned-APK installation flaw in Samsung Smart Switch Agent (version 2.0.002.24) to install and launch Drozer on the target device.

Introduction

The conventional approach to hacking Samsung phones at Pwn2Own — exploiting automatic install functionality in the Galaxy App Store — was closed off in 2024. Samsung stripped all auto-install code from the App Store between the 2023 and 2024 competitions, forcing any researcher targeting a Samsung device to find an entirely new attack path. Ken Gannon was the only researcher who accepted that challenge.

The resulting exploit chain is noteworthy for two reasons. First, it contains no memory corruption: every bug is a logic flaw — a missing signature check, an overly broad URL prefix whitelist, an unfiltered intent dispatch — of the kind that often flies under the radar of fuzzing-focused security programs. Second, the chain illustrates how a researcher can transform a limited initial primitive (loading an arbitrary URL in a WebView) into a full device compromise by methodically expanding the attack surface at each step. Gannon's talk, a self-declared sequel to his 2018 "Chainspotting" talk, is a step-by-step walkthrough of that expansion.

Why the Galaxy App Store Path Was Dead in 2024

▶ Watch: Galaxy App Store History (2:00)

In 2022 and 2023, the Galaxy App Store was exploited four times each year at Pwn2Own, always through the same class of vulnerability: a JavaScript interface exposing an auto-download-and-install function that could be triggered without user interaction. This "install code" allowed the App Store's WebView to silently fetch and install any application from the Galaxy Store given a crafted URL or intent.

By 2024, Samsung had removed every variant of that install code from the Galaxy App Store. The only installation pathway remaining required physical user interaction — pressing a button on the device — which Pwn2Own rules prohibit. Any researcher targeting the S24 in 2024 needed a completely different approach.

Gannon considered two alternatives: exploit Samsung's server-side infrastructure (rejected because Samsung logs all server interactions, and the internet connection quality during his time in the Philippines was unreliable) or enumerate vulnerabilities in the pre-installed applications on the device itself. He chose the latter, knowing it meant manually reviewing every app on the phone.

Bug 1: Unfiltered URL Loading in Samsung Gaming Hub

▶ Watch: Bug 1 — Unfiltered WebView URL (6:00)

Samsung Gaming Hub (version 7.1.01.7) is a pre-installed Samsung app for browsing and launching games from the Galaxy Store and Samsung's cloud gaming service. It contains a WebView and exposes browsable intent activities.

The first bug is elementary: the WebView within Gaming Hub could be forced to load any URL without filtering. An attacker creates a minimal browsable intent hosted on a web server with a URL parameter pointing to an arbitrary destination. When a user clicks the link, Gaming Hub opens its WebView and loads the attacker-specified URL — no whitelist, no scheme restriction, no domain validation.

In isolation, this is low-severity: loading a URL in a WebView that has no JavaScript access or bridge APIs is a cosmetic problem. Gannon documented it as the entry point and moved on to the next question: what happens if JavaScript runs?

Bug 2: JavaScript Enable Bypass via Prefix-Only Whitelist

▶ Watch: Bug 2 — JavaScript Enable Bypass (6:30)

Gaming Hub's WebView did enforce one check for JavaScript: it evaluated whether the loaded URL matched a whitelist of trusted prefixes before enabling JavaScript execution. The check used Kotlin's String.startsWith() function, comparing the URL against a list of Samsung and partner domains.

The flaw is that startsWith() matches the beginning of the string — and several of the whitelist entries lacked a trailing slash. A URL beginning with https:// trivially starts with https:. More practically, a URL beginning with https://legit-samsung-domain.com.attacker.com starts with https://legit-samsung-domain.com, satisfying the check. Gannon registered a domain whose prefix matched one of the whitelist entries and hosted his payload there.

With JavaScript enabled, the attack surface expanded significantly. The Gaming Hub WebView now ran attacker-controlled JavaScript, creating the foundation for the next bug.

Bug 3: Arbitrary Activity Launch via Intent URI Redirect

▶ Watch: Bug 3 — Arbitrary Activity Launch (8:00)

The third bug is the pivot that converted a JavaScript execution primitive into a device-wide attack surface. Gaming Hub's WebView implementation included a shouldOverrideUrlLoading callback (or equivalent) that fired whenever the WebView received a 302 redirect. If the redirect destination URL used the intent:// URI scheme, the WebView code parsed it into an Android Intent object using Intent.parseUri() and passed the resulting intent to startActivity() — with no filtering on what activity could be targeted.

Combined with the JavaScript execution from bug two, this became a persistent C2 channel: attacker-controlled JavaScript in the Gaming Hub WebView continuously polls the attacker's Python Flask server, which responds with 302 redirects containing intent:// URIs. Gaming Hub dutifully converts each redirect into an intent and fires startActivity(), launching whatever exported activity the attacker specifies.

The practical impact: whereas Gannon previously had 413 browsable intent activities to evaluate as potential second-stage targets, he now had access to all 2,219 exported activities on the Samsung Galaxy S24.

Bug 4: Unsigned APK Installation in Samsung Smart Switch Agent

▶ Watch: Bug 4 — Smart Switch APK Install (12:01)

With arbitrary activity launch capability established, Gannon turned to finding an app that could install arbitrary APKs — the missing piece required to deploy Drozer (the Android remote administration and penetration testing agent) on the target device.

Samsung Smart Switch Agent (version 2.0.002.24) is the background service component of Samsung's phone-to-phone data transfer product. It exposes a single exported activity protected by a Samsung-defined custom permission. Conveniently, Gaming Hub held that custom permission — so Gannon's C2 channel could launch the Smart Switch Agent activity directly.

The vulnerability: Smart Switch Agent accepted a ssmUri intent extra specifying a URI (using a file:// or content:// scheme) pointing to an APK. The agent downloaded the APK from that URI to its own private files directory, renamed it to SmartSwitchMobile.apk, and installed it — all without verifying the APK's signature against any Samsung signing certificate. The agent was designed to update Samsung-signed applications but omitted the signing check entirely.

To deliver the Drozer APK to the file system for Smart Switch Agent to fetch, Gannon needed one more bug: a way to write an arbitrary file to a path accessible via file:// or expose it through a content provider reachable from Smart Switch Agent.

Bug 5: Arbitrary File Write Completing the Chain

▶ Watch: Bug 5 — File Write and Full Chain (16:00)

The fifth and final bug provided the file-write capability. Another Samsung application exposed an exported activity or content provider that, through a logic flaw, could be made to write attacker-controlled data to a location on disk accessible to Smart Switch Agent. Gannon noted that Smart Switch Agent explicitly lacks access to the SD card area — a design constraint he had to account for when choosing the write target path.

With all five bugs in place, the complete chain executes as follows:

1. The target user clicks a malicious hyperlink (browsable intent trigger).
2. Gaming Hub opens its WebView and loads the attacker's domain (bug one).
3. The domain matches the prefix whitelist, enabling JavaScript (bug two).
4. JavaScript begins polling Gannon's Python Flask C2 server.
5. The C2 instructs Gaming Hub to launch the file-write activity via intent:// redirect (bug three).
6. The Drozer APK is written to disk at the target path.
7. After fifteen seconds, the C2 instructs Gaming Hub to launch the Smart Switch Agent activity.
8. Smart Switch Agent reads the ssmUri extra, downloads the Drozer APK from the on-disk path, and installs it without signature verification (bug four + five).
9. Gaming Hub launches Drozer. The device is compromised.

The entire chain requires one click from the user and completes within roughly fifteen seconds, with no memory corruption, no kernel exploit, and no browser zero-day.

Notable Quotes

"There were sixty-one entries targeting IoT and SOHO devices, and I was the only phone entry. Neat." — Ken Gannon ▶ 2:00

"I cannot stress how important this is in Pwn2Own. I am no longer limited to just looking at browsable intents. I can look at any exported activity I want on that phone." — Ken Gannon ▶ 12:01

"Beforehand, there were only four hundred and thirteen different browsable activities to look at. Now there's two thousand two hundred and nineteen different exported activities I have to fucking look at." — Ken Gannon ▶ 12:01

Key Takeaways

• Samsung's removal of auto-install code from the Galaxy App Store between 2023 and 2024 forced a complete change of attack strategy, but the pre-installed application ecosystem on the S24 provided equivalent entry points through logic bugs alone.
• The chain's five bugs — unfiltered WebView URL load, startsWith()-only JavaScript whitelist bypass, intent://-scheme arbitrary activity launch, unsigned APK installation in Smart Switch Agent, and an arbitrary file write — are all logic flaws requiring no memory corruption or heap manipulation.
• The Gaming Hub intent:// redirect primitive effectively multiplied the attack surface from 413 browsable activities to 2,219 exported activities, demonstrating how a moderate initial primitive can be a force multiplier when the target device has a large pre-installed application footprint.
• Smart Switch Agent's omission of APK signature verification — despite being designed to install Samsung-signed update packages — is a canonical example of a security-critical check that was present in the design intent but absent in the implementation.
• Logic-bug chains of this kind are particularly dangerous because they frequently evade fuzz-based discovery and binary analysis tooling, remaining invisible to automated security scanning while being straightforward to reproduce once identified manually.