Security Researcher Finds Security Bug in Android Phones Distributed at Security Conference

What’s the most cyber-secure place in the world? A cyber security conference, right?

Nope.

A snooping researcher managed to find a security flaw in the official app for the RSA Conference, a marquee tech security event being held in San Francisco this week. It’s a reminder of the nagging security issues plaguing Android phones. It’s also sort of hilarious.

Vendors at these sorts of conferences usually have smartphones to check in visitors to their booths. RSA vendors were given Samsung Galaxy S4 handsets set in “kiosk” mode, with a password protecting the scanning app. Andrew Blaich, a lead security analyst with Bluebox Security, dug into the source code of the app where, he claims, there was “an easily found bug.” He writes:

When we used that passcode we were able to gain access to the kiosk app’s settings. This, in turn, let us gain access to the device’s system settings, which then enabled us to put the device into developer mode to gain full access to the device. This is concerning because if we can do this, an attacker can too, letting them root the device, pull any data off of it, or install malware to steal even more data.

Security researchers like Blaich make part of their living pointing out such exploitable bugs, many of which are never actually exploited by hackers. That trend is more common with Google’s Android, since it, unlike Apple, relies on a complex layer of software, carriers and manufacturers to get security right.

Also, it’s probably unlikely that anyone at a tech conference would hack into a vendor’s phone. Then again, of all the places where that could theoretically happen, a gathering of cyber security tech experts ranks up there on the list. We reached out to the RSA to see what they have to say.

This article originally appeared on Recode.net.

Will you support Vox’s explanatory journalism?

Most news outlets make their money through advertising or subscriptions. But when it comes to what we’re trying to do at Vox, there are a couple of big issues with relying on ads and subscriptions to keep the lights on:

First, advertising dollars go up and down with the economy. We often only know a few months out what our advertising revenue will be, which makes it hard to plan ahead.

Second, we’re not in the subscriptions business. Vox is here to help everyone understand the complex issues shaping the world — not just the people who can afford to pay for a subscription. We believe that’s an important part of building a more equal society. And we can’t do that if we have a paywall.

So even though advertising is still our biggest source of revenue, we also seek grants and reader support. (And no matter how our work is funded, we have strict guidelines on editorial independence.)

If you also believe that everyone deserves access to trusted high-quality information, will you make a gift to Vox today? Any amount helps.

One-Time Monthly Annual

$5/month

$10/month

$25/month

$50/month

Other

$

Yes, I'll give $5/month

Yes, I'll give $5/month

We accept credit card, Apple Pay, and Google Pay. You can also contribute via