Security firm exposes Samsung Smartphone security hole

A security flaw discovered in Samsung smartphones has left as many as 600 million Galaxy phones at risk of being hacked.

Cyber security firm NowSecure released its findings about a vulnerability affecting all Samsung Galaxy models between S4 and S6. According to NowSecure, the security hole allows an attacker to hack into the Galaxy smartphone through a network by accessing a vulnerability in the device's pre-installed SwiftKey keyboard software.

This can give the attacker the ability to remotely eavesdrop on phone calls and voicemail, read texts, turn on the microphone and view private photos.

The security flaw occurs when the device reboots, and when the keyboard software automatically updates at any random time. Potential hackers that are in the right place at the right time then have the opportunity to infiltrate a vulnerable device.

Ryan Welton, a mobile security researcher with NowSecure, wrote that the firm first notified Samsung in December 2014 of the flaw, along with the United States Computer Emergency Readiness Team (CERT) and Google's Android security team.

Welton said the company began issuing patches to mobile providers at the start of 2015, though "it is unknown if the carriers have provided the patch to the devices on their network."

After a lack of response from the providers, the security firm published its findings to the public on June 16.

A spokesperson for Samsung told ABC News that the company "takes emerging security threats very seriously."

"Samsung Knox has the capability to update the security policy of the phones, over-the-air, to invalidate any potential vulnerabilities caused by this issue. The security policy updates will begin rolling out in a few days," the spokesperson said. "In addition to the security policy update, we are also working with SwiftKey to address potential risks going forward."

Unfortunately, the pre-installed keyboard software cannot be uninstalled from the device, and it isn't easy for the user to tell if their wireless carrier has patched the problem. According to NowSecure, there are no confirmed patches issued by any carrier for any of the affected Galaxy models as of June 16.

See if your Galaxy smartphone is at risk at NowSecure's blog.

NowSecure recommends Galaxy users to avoid unsecured Wi-Fi networks and to ask their mobile provider for information about a security patch.