A bug in Samsung’s default texting app is sending random pics to other people | Hacker News Reader

A bug in Samsung’s default texting app is sending random pics to other people

gizmodo.com

186 pointsilarum84 comments

I've been in the OEM industry for years and can't believe this happened in production.

For something like texting/RCS, there are thousands of phones being tested thousands of time by thousands of people with multiple additional checkpoints (ODM, Google, Carriers). It's a core functionality so it's extremely tightly verified.

RCS was first implemented about three years ago for phones so it's shocking that this kind of bug happened now. I also worked on the initial infrastructure for this so I can't imagine how this bug was even introduced. My bet goes to it being a server-side issue, especially since it's carrier-specific, and not a software bug.

This is the first time I'm hearing about RCS at all. I know SMS is ancient, but I had no idea it had been superceded like this. (Probably because I've never had a smartphone - they're a bit beyond my budget.)

I (very vaguely) know that SMS works on top of SS7. I just checked out https://en.wikipedia.org/wiki/Rich_Communication_Services, which was interesting but doesn't have that many technical details.

I'm very curious to understand how RCS works technically. I get the impression it can work over IP as well as carrier-integrated data transfer?

GSM's official specification document is what we used when we implemented everything. "Advanced Messaging" and "IP-based messaging" were some other ways we referenced the feature like you said. Carriers definitely have to support this themselves and set transfer limits, provide the web-view, etc...

What do you do? There are (were) wonderfully fast windows phones for for $20

Appreciate it hugely. It's actually the data costs that are prohibitive - I've only just started looking around, but my first quote is $39 for 2GB and 500 free minutes ($1/min after that) from Telstra, Australia's juggernaut.

I did recently think I critically needed to stay in touch (this is why I have the numbers above), but that requirement seems to have settled a little, which is why I'm less motivated to get on the merry-go-round of plan-hunting now. Chances are prepaid is probably what I'll end up doing ("yeah this is my number this week", here we come, lol).

What I _really_ want is an IoT/M2M contract, but I have no idea how to look for those :D

Oh - as for what I do, currently working on kickstarting that :) this sums up the difficulty FWIW: https://news.ycombinator.com/item?id=15004608#15005811 (I'm working on it, it's fine)

If it's possible to be a server side issue, then no phones are ever secure.

SMS and phone calls were never secure.

SMS and phone calls should never let the server see every file on your device, or every image

>SMS and phone calls should never let the server see every file on your device,

That may be the case but the bug could still be on the server side:

  Carol the Client: Hi Steve, will you send this photo to 111-1111?

  Steve the Server: Hi Carol, I've sent your photo to 555-5555

Unless you encrypt the data to your recipient's client-side held key, the opportunity for the server to err and data leak, persists.

That doesn't explain the case where all photos on the phone were silently sent to a contact.

Maybe its Google's answer to SnapChat, call it SnapRoulette :-)

But more seriously the messaging story on Android is abysmally broken. There are SMS messages, vendor wrapped SMS/MMS messaging, Google flavored chat apps that sometimes map to SMS/MMS and sometimes to some Google protocol.

Combine that with an insane permission model that basically wants you to hand over access to all your SMS/MMS rights for applications that deal with photos and I wouldn't put it past being a bit of malware in some photo client.

Samsung has its own SMS client, Samsung Messages. The fact Android allows custom SMS apps doesn't seem like a bad thing.

Apps can send photos via Android Intent without requiring SMS permissions. If an app requests that permission, the user can say no. I'm not sure how that qualifies as insane.

> The fact Android allows custom SMS apps doesn't seem like a bad thing.

Only if it's clearly distinguishable. Call me old fashioned but I'd like to know if my messages are handled by a core Google-developed android app or by some third party like Samsung, which clearly demonstrate that it shouldn't have that kind of access.

It its something of concern for you, its impossible to find it hard to know if your messaging app is by Google or not.

Additionally, a Samsung sms app is really not third party on a Samsung phone.

And lastly, the biggest concern about this on android is usually "how to get out of Google control" so being able to replace a core app like this by any that you prefer be it Google, Samsung or a special privacy oriented one is hardly something I can consider a disadvantage.

Samsung is not a third party on a phone and OS developed by Samsung, it's more of an OEM.

Fair point. Let me rephrase it - I consider Samsung's OS itself an unnecessary third party on a phone that should be running official Android. Then again, I prefer iOS since I explicitely don't want to deal with the half-baked mess of an OS developed by incompetent OEMs.

I don't understand your issue. If you want to use the normal sms app on a Samsung phone you're free to do. And Samsung doesn't hide that it isn't it, it actually makes it super obvious (because they want people to wish for Samsung, not for Android, see Tizen)

I have a Galaxy phone and have no idea if it's the basic Android or Samsung app. It just says Messages in the app settings, there is no Samsung Messages app.

Samsung Messages is also called 'Messages' and uses and orange and white icon. I went to Menu > Settings > About Messages and no where does it state that it is a Samsung app (but it is).

Yep, Android (Google) Messages' logo is a white text bubble on blue background. If you have a Samsung phone and didn't explicitly install another SMS app you're probably using the Samsung one. Ditto for the email client (Email), the photo gallery (Gallery), calendar (Calendar) etc. Samsung likes to do their own thing.

Edit: occurs to me that they don't have their own Maps app though. I'm honestly a bit surprised they didn't try to make at least their own UI for Google Maps, seems like a Samsung thing to do. I should also add that I don't mind the Samsung apps at all nowadays, but I do kinda wish they would just stick to the Google stuff (and quietly take Bixby out back and shoot it).

The default one on Samsung phones that can neither be uninstalled nor disabled is Samsung's. It can be made not-default, and you can turn off all of its permissions, but you can't get rid of it.

But you can get to the app permissions and revoke all permissions, rendering the app incapable to run

Not without root, that is.

Or on unrooted phones, you can use adb to remove software.

So you're saying that you could remove all the bloatware that comes with Android phones these days simply with adb?

Didn't realize it was that easy.

It one of the reasons why it's a security issue to leave usb debugging enabled all the time. adb has almost unlimited access to your device when it is.

But, yeah, i think you just type 'adb uninstall <package name>'. I can't remember exactly since it's been a while.

On my pixel 2, messages is the text app, if I want to switch that to something like Hangouts then I have to accept a diag box and allow it. Only one app can do this at a time. This isn't Google, this is 3rd parties being dumb.

But I would say that I hate that iOS apps can't access my SMS messages. I've typed thousands of "pin codes" from SMS and I can't have auto-transactions in my budget app from bank SMS notifications. While I don't like an idea about allowing every app to access SMS messages, I'm fine to allow some apps to access all SMS messages and temporary allow app to access all new SMS messages.

I would be happy if I went to add a photo to a text message and it said, "Allow Messages to access photos just this one time?" and I confirmed it. And then it turned off permission again after the message was composed.

What I don't like is when you get an app like "SuperPhotoStickers!"[1] which allegedly lets you take a picture, put stickers on it, and text it to a friend. Asks for permission to access texts all the time, and has a service that runs all the time, and later you find your phone has been sending photos and/or texts to a third party without you knowing about it. That is what I mean it is a broken permission system.

In a sane world you would be able to say "only access pictures taken with the App" and only access the text subsystem (SMS/MMS) only when "the App is open and the UI is on the screen in front of me."

[1] Example name, not a real app as far as I can tell.

something like for this session like how sudo works would work pretty well too

That should be able to use Intents for both picking the image and sending the message, no permissions required.

LineageOS has had this function since CyanogenMod.

iOS 12 automatically copies SMS codes to the clipboard. That said if you can avoid it don’t use SMS for 2 factor.

Even better than that it adds them as an autofill suggestion in the numeric keyboard https://ios.gadgethacks.com/how-to/ios-12-makes-easier-use-t...

That looks solved to me.

Apple definitely works hard for usable privacy.

Huh. Android Messenger will prompt me to copy the code to clipboard (which I don't think I've ever used since I'm always actually logging on with my laptop).

Would an option to forward all texts from a phone number to an app (read only, and only a single number authorized at a time) work? Or would it be too clumsy?

This story is very thin on details, but with the abysmal quality level of most Samsung software it is 100% believable.

Absolutely agreed. Great hardware that Samsung took a huge dump on with inferior replacement apps. Why do they even bother to develop worse versions of things built into Android? After my s8 issues and my randomly rebooting refrigerator, Samsung has lost me as a customer.

> randomly rebooting refrigerator

Call me old-fashioned, but a refrigerator should never have to reboot. ;-) A microcontroller running drop-dead-simple firmware is OK, but if it ever has to reboot for any reason save power outages, they've failed.

I'll certainly agree on Samsung's software (at least the sort of things users directly interact with) being a vortex of suck, though. Back when I used a Galaxy S Relay "4G" (the "4G" in quotes because they were calling DC-HSPA+ "4G"), I found the phone to be much better after I installed CyanogenMod.

Too bad CyanogenMod imploded, and worse, there's no LineageOS for that old handset, which was one of the last good slider phones.

To be fair to Samsung, I have no complaints about their SSD firmware, but I'll stay away from their cell phones.

The value proposition of IoT is so bad. Maybe I'm old fashioned too, but I prefer things that work and can be repaired by third parties when they don't.

I requested the source code on that refrigerator just to see how terrible it was. It's garbage clearly but I was pleasantly surprised they didn't hard code any passwords like Cisco's standard operating procedure. I still would never put it on wifi though.

Why do they even bother to develop worse versions of things built into Android?

They want to differentiate. In their minds, people will look at their friend's phone and go "oh wow, how do I get that sweet messaging app?" and the answer will be "You have to buy a Samsung!".

Of course, we all know it doesn't work out like that for a variety of reasons, not least of which is their inability to execute on a better clone of the existing Android apps.

> They want to differentiate.

It's sad, because they do that (IMO) really well, especially on their flagships, with hardware; the software isn't merely unnecessary, it's a cost that weighs against the hardware.

>They want to differentiate.

mission accomplished

Just saw a "Hey, Bixbi" ad yesterday and it was as cringy as Scott's Tots. The company just has such an air of desperation and jealousy.

Samsung doesn't trust Google to be completely impartial- is why they have replacement apps for decent defaults like SMS.

Also if Android fails or is deprecated for some reason then they could replace the OS without a user revolt.

> go into your phone’s app settings and revoke Samsung Messages’ ability to access storage. Until a real solution is released, this will prevent Messages from sending photos or anything else stored on your device, whether you want it to or not.

I tried this but now when I launch the Samsung messages app, it asks me permission to access the phone's storage. When I click 'deny', the app closes so I can't access my messages with this "solution"

They seem to have the advice slightly mixed up. It's not "revoke Samsung Messages storage permissions OR switch to another SMS app" it should be "revoke Samsumg Messages storage permissions AND switch to another SMS app"

Highly recommend https://www.signal.org/ which on Android can act as your normal SMS client (as an added bonus if your contact also uses Signal there are some security enhancements)

Thank you; just made the permission change & made Signal my default SMS app. If it's good enough for Edward Snowden, it's good enough for me.

I'm not surprised. Semi related, my S8 often never saves photos that I take. It's a very common problem they have yet to acknowledge.

https://www.reddit.com/r/GalaxyS8/comments/7kc8wj/photos_not...

I bet you it's Bixby getting revenge.

I swear the last software update on my s8 made that button more sensitive just to annoy me into using that garbage.

Good job samsung. This is probably related to their rollout of rcs on T-mobile, especially as this only affects samsung's texting app and not android messages... which is absolutely maddening as the point of rcs UP is to use whater rcs UP client you want. -.- freakin' telecoms.

> switch to a different texting app like Android Messages or Textra

Great, I just got a Galaxy S9 after being a longtime iPhone user. What are HN's experiences with these messaging apps?

avoid samsung and stick to the google phones like pixel 2

@tuxracer posted a comment here to use Signal.org which looks great for privacy so I made the switch

They're all exactly the same and haven't changed appreciably in 10 years.

I just upgraded from an 8-year-old Samsung Galaxy S (jumping from Android 2.1 to 7), there's been a lot. Off the top of my head:

* The difference between SMS and MMS is much more hidden from users

* Group messages (where everyone is communicating with everyone in the same conversation, not a mass-text)

* Not only did stickers not exist, graphical emoji didn't exist except in third-party messaging apps

* More web integration, like being able to search for an image and send that

* Google Pay integration, apparently I can send and request money

All crap. Move back asap.

Ridiculous!! Hey but I am still using Nokia Lumia ... already a dead product. Windows 8.1's default SMS app for mobile doesn't access gallery or any other thing.

The article was deleted. What happened? Here's a "mirror": https://www.gizmodo.com.au/2018/07/a-bug-in-samsungs-default...

I guess it's undeleted now

The article is wrong. You can't disable its permission. The App won't work.

It seems like this is better described as "phones running Samsung's software", lest we further normalize this locked black box culture.

edit: this post now links to a different site with a better title.

Samsung's software makes their otherwise good phones markedly terrible. My Galaxy S5 got so slow at one point that I was planning on getting a new phone and thought "what the hell, I'll try to root this one and if I brick it then nothing of value was lost." It's a good thing I did successfully root it because I removed all the Samsung garbage and it continues to run exceptionally well! Sure, disk space probably played a role, but I noticed that their keyboard had a large part to do with the slowness. After replacing it with AnySoftKeyboard, it's run as smooth as butter.

EDIT: Another pro-tip I have for anyone with an Android phone is to ditch Google for DuckDuckGo, not only for privacy but because it simply outperforms Google's UI responsiveness by lightyears.

I'm in the camp of installing an OS as the first thing you do with a device [0], and I really can't abide by the idea that a computer is just expected to get slower over time.

My S4 (i9500) was still running great on LineageOS (some games even) right up until a few months ago [1].

Good job taking your leap. Going through the process can definitely be unnerving when you're doing it to a device you rely on (which is a large part of why I recommend doing it immediately after getting the device).

Or by all means everyone, keep dumping "old" hardware to stay on the manufacturer's software treadmill. I just replaced that S4 with an almost mint S7 for $80!

[0] I will say, it actually does end up feeling like a little bit of a let-down to get a shiny new device, do the job of flashing it, and then be greeted with the same stock LOS setup. But then I remind myself that I got said device for a deliberate purpose, and it's actually nice not having to relearn an arbitrarily different UI.

[1] FWIW, the symptoms lead me to believe it came down with something similar to "the emmc bug" that's been described for the i9300.

Did you put on one of the alternative Android OS? Can't afford a new phone just now, and I was wondering if rooting mine would help, think I will after what you've just said.

It's an S3 that is becoming slower and more frustrating to use every time there's an update. It can take anything from 20 seconds up to a minute to respond to a button press, and of course I'm never sure if I touched the button properly so I hit it again. It'll respond to the entire queue in a second or two, and then I need to start over.

No, I left the Samsung-provided Android on it, although I've installed updates here and there.

I never owned an S3, but judging by my experience, getting root and removing all of Samsung's crapware should bring new life to an S3. As I mentioned, their keyboard software is ridiculously slow and bloated, and can make it seem like the apps being used are slow when it's really just the keyboard blocking the UI. It's been a couple years, but I remember their apps took up quite a bit of space.

By the way, another thing that could be slowing down your S3 is the battery. If it's not holding a charge well, the operating system is going to use up less power to try and stay running, hence a significant performance decrease. If your phone has a removable battery, a replacement can be had on Amazon for ~$10. Having replaced my own battery, I can say it's definitely worth doing.

Thanks - very much appreciated! The battery is starting to age and is beginning to lose its charge quickly, so I'll look into that.

I love LineageOS and pretty much most of my devices that can run it, run it. This includes various older Note phablets and Note tablets. It is pretty fast, remains up to date, has great privacy controls, and the Google Apps (one of the biggest power hogs, IME) can be slimmed down or omitted if necessary.

Galaxy S8 and S9 generations of Samsung phones can't really be compared to previous versions. Touchwiz lag is nonexistent, and the apps are quite a bit less intrusive.

As a first time Samsung owner with an S9, I can't comment on 'less intrusive', but it is definitely frustrating.

Multiple apps called "messages" and "contacts", not super easy to tell which is stock android and which is samsungs? Bixby always gets in the way, where did this "SmartThings" app come from which is ALWAY in the system tray and difficult to disable and can't be removed.

I won't be buying another Samsung device, I'm not sure how they got the reputation they have.

It's crapware plain and simple. Samsung insists on installing, then not supporting any of their stuff with updates. Google needs to step up and prevent it by allowing every app to be uninstalled and deliver Android updates themselves. But in the mean time if you buy a phone, basically expect it never to get upgraded in any meaningful way.

Except for that bixby bullshit. And that you can't uninstall all their crappy apps even if they are slightly less intrusive.

Replace Google for duckduckgo? UI responsiveness? Using anysoftkeyboard?

It's an S5... And old... That's the problem.

Components do not degrade significantly in the lifespan of a phone. Websites are generally no more intensive than when the S5 came out, and there's no reason for apps to be either. "It's old" is a worthless excuse for poor software design - as evidenced by the fact that using FOSS restores full performance.

My guess is that they were getting updates from their carrier.

Back when the original Galaxy S was new, one of AT&T's minor updates bricked some peoples' phones and caused many more to run slowly. I'd already rooted mine and afterwards disabled some of the offending apps that they installed, so in terms of performance it still runs today as well as it did in 2010. I just never did a carrier update again.

Uh, yeah... if I don't have to spend money on a new phone when I can just install better software, that's my preference.

I kinda like the idea of getting random pics from people....

Is this really a bug? Look at this:

> Samsung Messages sent out their entire photo gallery to a contact in the middle of the night.

Is it really possible to make this by mistake? Sounds like Samsung deliberately made a backdoor that sends the whole gallery to "someone". Their "bug" might be sending to unintended person.

Are you legit suggesting that Samsung intentionally created a feature to send themselves (or "the government") the entire camera rolls of their customers' phones, and simply got the destination wrong?

Or maybe more plausibly, they do have export code in there for any number of reasons including debugging, and they left it in there and are triggering it by accident. GP is likely just suggesting that it's quite amazing that a single little bug can do all of these steps as opposed to intentional code executed unintentionally.

Something something don’t attribute malice for stupidity

Reply on news.ycombinator.com