From Samsung Account to RCE: A Journey to a Remote 0-Click Capability

From Samsung Account to RCE: A Journey to a Remote 0-Click Capability

Speakers: Kaufi (Security Researcher, Independent)

Conference: OffensiveCon

YouTube: https://www.youtube.com/watch?v=KbKzze2MhgM

Overview

In this compelling talk at OffensiveCon, Yuval Kaufman, known as Kalfy, a VP R&D at Radiant Research Labs, detailed an intricate journey culminating in a remote zero-click capability leading to Remote Code Execution (RCE) on Samsung Android devices. The research focused on exploiting vulnerabilities within the vast Samsung Account ecosystem and proprietary image processing mechanisms. Kalfy emphasized the methodical approach taken, navigating numerous challenges to chain seemingly disparate primitives into a potent attack chain.

The significance of this research lies in demonstrating how a fully covert, zero-interaction exploit can be constructed by meticulously analyzing vendor-specific code and interaction flows. Unlike typical exploits requiring user interaction or visible cues, this capability aimed for complete stealth, making it exceptionally dangerous. All vulnerabilities discussed in the presentation have since been patched by Samsung, but the methodology and findings offer invaluable insights into securing complex mobile ecosystems.

Background

▶ Watch: Talk introduction and journey overview (0:00)

Kalfy began by establishing a foundational terminology crucial for understanding mobile zero-click exploitation:

• Sink: This refers to the actual vulnerability that enables arbitrary code execution, such as an out-of-bounds heap overflow in a parser. It's the "payload delivery" mechanism.
• Source: This is the entry point, the mechanism through which the malicious input reaches the sink without user interaction. For zero-click scenarios, the attack surface is severely limited to automated processes.
• Covertness: This component ensures the exploit remains undetected. Any user-facing alerts, crashes, or suspicious activity would compromise the covert nature of the attack.

The research's starting point was the Android image processing pipeline. When an Android application displays an image, it typically uses the BitmapFactory API. Under the hood, this API relies on Skia, an open-source graphics library, which in turn integrates various third-party libraries like JPEG and WebP decoders to process encoded image bytes into usable pixel data (Bitmap objects). Kalfy highlighted that Android vendors often compile their own graphics libraries alongside Skia, introducing proprietary code.

This proprietary vendor code became the initial focus, drawing inspiration from past research. Kalfy specifically referenced an excellent write-up by Mateusz from Google's Project Zero, which detailed exploitation of Samsung's proprietary image processing libraries (specifically Coram libraries) through MMS messages. While Project Zero's findings led to these libraries being removed from the standard BitmapFactory flow, Kalfy noted they still existed on Samsung devices. This observation formed the basis for the research: finding a new way to reach these potentially vulnerable, vendor-specific image decoders. The primary target for the "sink" was identified as a memory corruption vulnerability within the libimagecodec.qcom shared library, which Kalfy's team had separately confirmed to be exploitable, though the details of that specific exploit were beyond the scope of this particular talk.

Key Findings

▶ Watch: Explaining sink, source, and covertness in research (3:40)

The research uncovered a series of interconnected findings and primitives that, when chained together, formed the basis of the zero-click RCE:

1. Re-discovery of libimagecodec.qcom Accessibility: Despite being removed from the standard Android BitmapFactory flow, the proprietary libimagecodec.qcom library was found to still be present and utilized by Samsung's custom Java Native Interface (JNI) APIs. Specifically, Samsung implemented its own QuramBitmapFactory Java class, which directly invoked native functions within these libraries for image processing.

1. Identification of Target Applications: By decompiling Samsung's system applications (APKs and JARs) using tools like Jadx and searching for references to QuramBitmapFactory, Kalfy identified a comprehensive list of Samsung packages that utilized this proprietary image processing. Among these, the Samsung Gallery application emerged as a prime candidate due to its inherent handling of images and potential for background processing.

1. Primitive 1: Shared Album Image Synchronization (Initial Source): Investigation into the Samsung Gallery's "shared albums" feature (similar to Google Photos or iOS shared albums) revealed that images synchronized to a shared album are automatically downloaded and parsed by the recipient's device using the QuramBitmapFactory. This was confirmed using Mitmproxy to observe network traffic and Frida to hook the CoreBitmapFactory API and trace calls originating from the SharedAlbumNotificationReceiver. However, this primitive initially required the target to accept an invitation and generated a visible notification, thus failing the "zero-click" and "covertness" criteria.

1. Primitive 2: Profile Picture Credential Leakage (Enabling Zero-Click): A critical breakthrough involved manipulating the profile picture update mechanism within the Samsung Account system. When a user updates their profile picture, the device uploads the image and then updates the profile account with the image's location. Kalfy discovered that by intercepting this flow, an attacker could set their profile picture to a URL on a self-hosted server. When an attacker then sends a shared album invitation, the target device automatically attempts to fetch the inviter's profile picture from the attacker-controlled server. Crucially, this request included sensitive Samsung Cloud client credentials in the HTTP headers (e.g., X-Samsung-Account-Id, X-Samsung-Access-Token). This leakage allowed the attacker to impersonate the victim and programmatically accept the shared album invitation on their behalf, thus achieving a zero-click entry into the shared album.

1. Primitive 3: Notification Silencing (Achieving Covertness): To address the visible notification generated by the shared album invitation, Kalfy investigated the underlying push notification mechanism. Samsung devices utilize Firebase Cloud Messaging (FCM) (formerly GCM) to receive push messages from Samsung Cloud servers. These messages, processed by the mobile services background package, trigger the gallery application to display notifications. Kalfy discovered a field within the incoming FCM message called pushExtension, which was expected to be a JSON object but was transmitted as a string. By sending a malformed JSON string in this pushExtension field during a second, carefully timed invitation, an attacker could cause an exception in the mobile services package. This exception would interrupt the application's workflow, causing the background service to restart and effectively silencing any pending notifications, including the shared album invitation notification.

Technical Deep Dive

▶ Watch: High-level Android image processing background (6:00)

The technical journey began with the understanding that Samsung's proprietary image processing libraries, like libimagecodec.qcom, though no longer directly accessible via the standard Android BitmapFactory, were still present on devices. The challenge was to find an alternative entry point.

Step 1: Identifying the Samsung-Specific Image Processing API

Kalfy's team employed JNI (Java Native Interface) analysis. JNI is Android's mechanism for Java code to interact with native libraries. By opening the libimagecodec.qcom shared object with IDA Pro, they identified all natively exported JNI functions. This revealed a custom Samsung BitmapFactory class named QuramBitmapFactory within a specific Samsung package. This class provided a Java API for developers to utilize the native libimagecodec.qcom functionality.

Step 2: Locating Applications Using QuramBitmapFactory

To find applications that might inadvertently expose this vulnerable surface, Kalfy pulled all JARs and APKs from a Samsung device. Using Jadx for decompilation, they then grepped for the QuramBitmapFactory package name. This yielded a comprehensive list of Samsung applications, most of which were related to user-facing image editing and thus not suitable for a zero-click attack. However, the Samsung Gallery application stood out as it handles images extensively, often in background contexts.

Step 3: Probing the Samsung Gallery Shared Album Feature

The Samsung Gallery's "shared albums" feature was identified as a potential source. The hypothesis was that images shared in these albums would be automatically processed on recipient devices. To test this:

• Network Analysis with Mitmproxy: Kalfy used Mitmproxy to observe the network traffic during a shared album synchronization. The sender's flow involved initiating an upload session, sending a PUT request with the image, finalizing the session, and updating the album. The receiver's flow showed requests for album updates, identification of new images, and automatic downloading.
• Dynamic Code Injection with Frida: To confirm automatic parsing, Frida was used to hook the CoreBitmapFactory API on the receiver device. Synchronizing an image to a shared album resulted in a successful decodeFile call originating from a component named SharedAlbumNotificationReceiver, confirming that images were indeed automatically parsed.

Step 4: Achieving Zero-Click via Credential Leakage

The shared album primitive, while automatically parsing images, still required the target to accept an invitation and generated a visible notification. This led to investigating the invitation flow itself.

• Profile Picture Manipulation: When a user creates a shared album and invites others, the invitation process includes fetching the inviter's profile picture. Kalfy discovered that an attacker could update their Samsung Account profile picture to a URL pointing to a server they controlled.
• HTTP Header Leakage: When the target device received an invitation, it would automatically issue an HTTP GET request to the attacker's server to fetch the profile picture. Crucially, this request contained sensitive Samsung Cloud client headers, including X-Samsung-Account-Id and X-Samsung-Access-Token. These headers are used by the Samsung Cloud client to authenticate the user with Samsung's servers. By capturing these, the attacker could effectively impersonate the victim.
• Automated Invitation Acceptance: With the victim's credentials, the attacker could programmatically interact with Samsung Cloud APIs to accept the shared album invitation on the victim's behalf, without any user interaction. This eliminated the need for the victim to click "accept."

Step 5: Achieving Covertness by Silencing Notifications

The final hurdle was the visible notification alerting the user of a new shared album invitation. This required disrupting the notification flow itself.

• Firebase Messaging (FCM) and mobile services: The notification originated from the Gallery application but was triggered by the mobile services background package, which processes push messages received via Firebase Cloud Messaging (FCM).
• Malforming pushExtension: Kalfy discovered that incoming FCM messages contained a pushExtension field, which was expected to be a JSON object but was treated as a string. By sending a second invitation with a malformed JSON string in this pushExtension field, the mobile services package would attempt to parse it, resulting in an exception.
• Chaining for Covertness: The full notification silencing primitive worked as follows:

1. The attacker sends the initial invitation with their profile picture hosted on their server. The attacker's server receives the credential-leaking request but delays its response for approximately 30 seconds. During this delay, the mobile services package on the victim's device hangs while waiting for the profile picture.
2. Within this 30-second window, the attacker sends a second invitation containing the malformed pushExtension field.
3. The second, malformed FCM message causes an exception in the mobile services package. This exception interrupts the entire processing flow of the first invitation, causing the background service to restart.
4. Upon restart, the mobile services package loses its state regarding the pending invitation, effectively silencing the notification for the initial invitation.

The Full Zero-Click RCE Chain:

1. Attacker updates their Samsung Account profile picture to a URL on a self-controlled server.
2. Attacker creates a shared album and invites the target.
3. Target's device automatically fetches the attacker's profile picture from the controlled server, leaking Samsung Cloud credentials to the attacker. The attacker's server holds the response.
4. While the target's mobile services package is hung (waiting for the profile picture response), the attacker sends a second invitation with a malformed pushExtension field.
5. This malformed message causes an exception and restart of the mobile services package, silencing the notification for the first invitation.
6. Using the leaked credentials, the attacker programmatically accepts the shared album invitation on behalf of the target.
7. Finally, the attacker synchronizes a malicious image (containing the libimagecodec.qcom exploit) to the now-shared album.
8. The target device automatically downloads and parses the malicious image using QuramBitmapFactory, triggering the memory corruption vulnerability and achieving Remote Code Execution in the context of the mobile services package, all without any user interaction or visible cues.

Demo / Proof of Concept

▶ Watch: Why image processing is chosen as the RCE sink (8:00)

Kalfy presented a concise demo showcasing the culmination of this complex attack chain. The setup involved:

• A target Samsung device on the right, visibly showing no existing shared albums in its Gallery application.
• Three terminal screens on the left:
• The top terminal ran the Proof of Concept (POC) script responsible for orchestrating the invitation, credential leakage, notification silencing, and exploit delivery.
• The middle terminal hosted a local server controlled by the attacker, designed to receive the leaked credentials from the target device.
• The bottom terminal ran a netcat listener, awaiting a reverse shell connection from the successfully exploited target device.

The demonstration showed the POC script executing, followed by the local server displaying the received Samsung Cloud credentials. Shortly after, the netcat listener received a connection, confirming successful arbitrary code execution. Kalfy highlighted that the RCE was achieved in the context of the mobile services package, indicating the level of privilege gained. Finally, returning to the target device, the Gallery application was shown to now contain the shared album, proving that the target was added without any user interaction or visible notification. The shared album could then be removed in the same covert manner it was established.

Defensive Implications

▶ Watch: Samsung's custom graphics library and vendor code (9:59)

This research provides several critical lessons for mobile device manufacturers and security professionals:

1. Strict Input Validation: The pushExtension vulnerability highlights the importance of robust input validation, especially for data intended to be parsed as structured formats like JSON. Even if a field is technically a string, if it's expected to be JSON, it must be validated as such before parsing to prevent exceptions that could be leveraged for denial-of-service or state manipulation attacks.
2. Secure Handling of Credentials: The profile picture primitive exposed a severe flaw in how client credentials were handled when fetching external resources. Applications should never automatically send sensitive authentication headers to arbitrary, attacker-controlled URLs. Mechanisms like token binding or origin-specific credential handling should be implemented to prevent leakage.
3. Isolation of Proprietary Libraries: While vendor-specific optimizations are common, incorporating proprietary code into critical components like image decoders introduces a unique and often less scrutinized attack surface. These libraries should undergo rigorous security audits, be sandboxed appropriately, and ideally, be isolated from sensitive background services or user-facing applications.
4. Careful Design of Notification Flows: The ability to silence notifications by disrupting background processes demonstrates that notification systems, seemingly benign, can become attack vectors for covertness. Notification flows should be designed with resilience against unexpected states or exceptions, ensuring that critical alerts cannot be easily suppressed.
5. Principle of Least Privilege: Achieving RCE in the context of the mobile services package, rather than a more isolated image parsing service, underscores the importance of the principle of least privilege. Critical background services should have the absolute minimum permissions and access necessary to perform their functions, limiting the impact of a successful exploit.
6. Comprehensive Ecosystem Security: The success of this attack relied on chaining multiple, seemingly minor vulnerabilities across different parts of the Samsung ecosystem (Gallery app, Samsung Cloud, mobile services package, proprietary image codecs). This emphasizes the need for a holistic security approach that considers the interactions and dependencies between various components, rather than just isolated vulnerability assessments.
7. Regular Patching and Updates: The fact that all findings were promptly patched by Samsung highlights the ongoing arms race in mobile security. Users should always keep their devices updated to ensure they receive the latest security fixes.

Key Takeaways

• Zero-click RCE on Samsung devices is achievable by chaining multiple, distinct vulnerabilities across different system components.
• Proprietary vendor code (e.g., Samsung's QuramBitmapFactory and libimagecodec.qcom) often presents a rich, less scrutinized attack surface for memory corruption vulnerabilities.
• JNI analysis and decompilation are powerful techniques for reverse engineering how native libraries are used by Android applications, revealing hidden attack surfaces.
• Credential leakage via manipulated external resource URLs can be a critical primitive for bypassing user interaction and enabling session hijacking or impersonation.
• Notification flows can be disrupted by triggering exceptions in background services, offering a path to achieve covertness in zero-click attacks.
• Achieving a fully covert, zero-interaction exploit requires a deep understanding of the entire mobile ecosystem, including network protocols, background services, and inter-process communication.

About the Speaker(s)

Yuval Kaufman, also known as Kalfy, is a Security Researcher and VP R&D at Radiant Research Labs, a vulnerability research company based in Israel and Europe. With a decade of experience, his background is deeply rooted in mobile zero-click exploitation and reversing. Kalfy is passionate about exploring complex mobile ecosystems to uncover sophisticated vulnerabilities.