{"uuid": "c4a6ccaf-ac2a-46b3-9744-45c759ab60f3", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2021-25490", "type": "seen", "source": "https://t.me/hacking_Attack/43987", "content": "graphic keys stored on the device: They also let attackers bypass security standards such as FIDO2.\n\nAccording to The Register, as of the researchers\u2019 disclosure of the flaws to Samsung in May 2021, nearly 100 million Samsung Galaxy phones were jeopardized. Threatpost has reached out to Samsung to verify that estimate.\n\nSamsung responded to the academics\u2019 disclosure by issuing a patch for affected devices that addressed CVE-2021-25444: an IV reuse vulnerability in the Keymaster Trusted Application (TA) that runs in the TrustZone. Keymaster TA carries out cryptographic operations in the Secure world via hardware, including a cryptographic engine. The Keymaster TA uses blobs, which are keys \u201cwrapped\u201d (encrypted) via AES-GCM. The vulnerability allowed for decryption of custom key blobs.\n\nThen, in July 2021, the researchers revealed a downgrade attack \u2013 one that lets attacker trigger IV reuse vulnerability with privileged process. Samsung issued another patch \u2013 to address CVE-2021-25490\u00a0\u2013 that remoged the legacy blob implementation from devices including Samsung\u2019s Galaxy S10, S20 and S21 phones. The Problem with Designing in the DarkIt\u2019s not just a problem with how Samsung implemented encryption, the researchers said. These problems arise from vendors \u2013 they called out Samsung and Qualcomm \u2013 keeping their cryptography designs close to the vest, the Tel Aviv U. team asserted.\n\n\u201cVendors including Samsung and Qualcomm maintain secrecy around their implementation and design of TZOSs and TAs,\u201d they wrote in their paper\u2019s conclusion.\n\n\u201cAs we have shown, there are dangerous pitfalls when dealing with cryptographic systems. The design and implementation details should be well audited and reviewed by independent researchers and should not rely on the difficulty of reverse engineering proprietary systems.\u201d See Also: Offensive Security Tool: Swaks \u2013 Swiss Army Knife for SMTP \u2018No Security in Obscurity\u2019Mike Parkin, senior technical engineer at enterprise cyber risk remediation SaaS provider Vulcan Cyber, told Threatpost on Wednesday that getting cryptography right isn\u2019t exactly child\u2019s play. It\u2019s \u201d a non-trivial challenge,\u201d he said via email. \u201cIt is by nature complex and the number of people who can do proper analysis, true experts in the field, is limited.\n\nParkin understands the reasons cryptologists push for open standards and transparency on how algorithms are designed and implemented, he said: \u201cA properly designed and implemented encryption scheme relies on the keys and remains secure even if an attacker knows the math and how it was coded, as long as they don\u2019t have the key.\u201d\n\nThe adage \u201cthere is no security in obscurity\u201d applies here, he said, noting that the researchers were able to reverse engineer Samsung\u2019s implementation and identify the flaws. \u201cIf university researchers could do this, it is certain that well-funded State, State sponsored, and large criminal organizations can do it too,\u201d Parkin said.\n\nJohn Bambenek, principal threat hunter at the digital IT and security operations company Netenrich, joins Parkin on the \u201copen it up\u201d side. \u201cProprietary and closed encryption design has always been a case study in failure,\u201d he noted via email on Wednesday, referring to the \u201cwide range of human rights abuses enabled by cell phone compromises,\u201d such as those perpetrated with the notorious Pegasus\u00a0spyware.\n\n\u201cManufacturers should be more transparent and allow for independent review,\u201d Bambenek said.\n\nWhile most users have little to worry about with these (since-patched) flaws, they \u201ccould be weaponized against individuals who are subject to state-level persecution, and it could perhaps be utilized by stalkerware,\u201d he added.\n\nEugene Kolodenker, staff security intelligence engineer at endpoint-to-cloud security company Lookout, agreed that best practice dictates designing security systems \u201cunder the assumption that the design and implementation of the system will be reverse-engineered[...]\n\n___________________________ \n@hacking_Attack\n@Hacking_Video", "creation_timestamp": "2026-09-06T07:00:05.573034Z"}