Samsung SwiftKey: The latest AppSec vulnerability highlights

The Samsung smartphone SwiftKey security slip-up grabbed headlines in mid-June when it was discovered that 600 million Samsung smartphones were vulnerable to remote code execution (RCE) attacks.

Synopsys security experts were all over the issue, providing analysis of the problem and guidance to help organizations avoid the same common software design flaws.

• Jim DelGrosso explained that detecting RCE vulnerabilities can be a challenge if you’re not specifically looking for them—even if they are well-documented and relatively common.
• John Kozyrakis got into even more detail about preventing similar hacks in the future and applying the lessons of SwiftKey to other applications. He reported that Synopsys encounters RCE attacks frequently in our application testing and other engagements.
• The Samsung SwiftKey scenario is also addressed in the August 2014 document from the IEEE Center for Secure Design.

This Samsung SwiftKey issue underscores why the depth and quality of your application security testing (AST) matters, and why organizations need to ask hard questions when evaluating AST vendors.