600 million Samsung mobiles at risk of being spied on

If you are a Samsung Galaxy user, then there is some bad news for you — you can be easily spied on. Vulnerability in an in-built facility in the phones can expose you to a critical cyber-security risk, researchers have discovered.

The SwiftKey keyboard feature that comes pre-installed in over 600 million Samsung mobile devices -- from the S3 to the latest S6 - can be easily hacked to give away vital user information, Ryan Welton, a researcher with cyber-security firm NowSecure claimed at the Black Hat security conference in London.

According to reports, the flaw allows hackers to spy on a Samsung Galaxy user easily and remotely access sensors and resources like GPS, camera and microphone.

Moreover, reports say, the hacker can secretly install malicious applications and tamper with how certain applications work. The hacker could even spy on phone calls and messages and attempt to access sensitive personal data like pictures and text messages.

Researchers at NowSecure reportedly told Samsung about the vulnerability in November, but nothing has been fixed as of now. So, they made the findings public, reported CNN Money.

The report quoted NowSecure CEO Andrew Hoog as saying that on a well-established system that ranks cyber-security problems from 1 to 10, this vulnerability stood at 8.3.

How does this virus work?

British tech firm SwiftKey makes the keyboard feature - with word prediction software — used by Samsung devices.

"Last year, NowSecure researchers discovered that the SwiftKey keyboard can be tricked to accept a malicious file when the software updates. Because of the way the keyboard is installed, that virus can access some of the deepest, core parts of the phone's computer system," the CNN Money reported.

According to an explanation of the threat by The Guardian, the fault lies within Samsung's code.

"SwiftKey-based keyboards on other Android devices from other manufacturers and SwiftKey's apps from the Google Play Store, iPhone are unaffected. If the Samsung Android device is connected to a malicious Wi-Fi network when the keyboard attempts to update its trending phrases and language pack, a hacker could substitute the update for a backdoor into the phone giving a hacker almost complete access to the phone," it said.

What is Samsung and SwiftKey saying?

In a press statement by SwiftKey that was quoted by CNN Money, the company said, 'the way this technology was integrated on Samsung devices introduced the security vulnerability.'

The statement seems to have been deleted by the company.

The Guardian quoted Joe Braid, chief marketing officer of SwiftKey, saying, 'Unfortunately, we were only made aware of the issue on Tuesday. We are working as hard as possible to support Samsung and help it fix the issue.'

Samsung told the media, it 'takes emerging security threats very seriously... and [is] committed to providing the latest in mobile security.'