The Dr. Manuel Sadosky Foundation, based in Argentina revealed the existence of vulnerabilities in the Samsung SNS Provider application for Android which sets social media accounts at risk, potentially allowing vicious third-party apps to access photos, status updates, feeds, location and other information as well as post content on behalf of the users without their assent.

The Samsung SNS Provider application is used by Samsung devices to control social media accounts including those on Facebook, Twitter, Google+, LinkedIn and Foursquare. It also acts as a link to allow other applications, such as Gallery, to seizure data and content stored on these websites.

The users are requested to provide full access to the account when they log into the social media account on a Samsung device where SNS Provider is installed.

SNS Provider is used monthly by 41 million users as of February 17, 2015, according to the bulletin, “A malicious application that is granted these permissions could then connect to these services and obtain the credentials required to access a user’s social network account content permanently,” the security bulletin states. “For example, such an application could access the user’s private messages on Facebook using the access token provided by the corresponding SNS Provider service.”

The detail of the vulnerable packages is mentioned below:

•    SNS Provider version older than 1.1.1 on Samsung devices on Android 4.1
•    SNS Provider version older than 1.1.6 on Samsung devices on Android 4.2
•    SNS Provider version older than 1.2.1 on Samsung devices on Android 4.3
•    SNS Provider version older than 1.3.5 on Samsung devices on Android 4.4
•    SNS Provider version older than 1.3.5 on Samsung devices on Android 5.0

The South Korean firm disabled the App ID assigned to SNS Provider on Facebook and Twitter in February, and issued fixed versions of the app with a new ID after making a declaration to Samsung. Users are now secure from malware which uses the access tokens obtained via prior versions. If users are still using vulnerable versions, they are likely to see expiry or ‘try again’ notices when they log in.