How did this dodgy "Software Update" notification appear?

[nzseries1]

Hi there,

Yesterday the "software update" icon appeared on my phone, and when I expanded the notification, it said "Information message". So I tapped it, and a popup appeared, saying this:

"Message

Dear Customer we recommed (sic) you to upgrade to new version of software for improving mobile's performance and security. Path:Settings > Device information > Software update

To get the best from your device, please keep your phone up to date and regularly check for software updates."

This message bothers me for several reasons:
1. The incorrect spelling and grammar
2. The fact it's not signed (who is "we" exactly?)
3. The path given to access "software updates" is not correct (it's actually Settings > About device > Software updates)
4. I can't clear the individual notification by swiping it off the screen, and tapping "CLEAR" doesn't clear it
5. I can't stop notifications for the app itself. Normally, to get rid of unwanted notifications, you long-tap on the notification, which will bring up the app that produced it, then you press the "i" and then untick "Show notifications". However, on this occasion, I cannot do that, because the app is "Software update" and "Show notifications" and "Force Stop" are greyed out.

Is this a legitimate notification? I find it hard to believe, for the things given above.
The fact that this notification is even possible suggests to me that the Samsung Galaxy has potential security vulnerabilities. How is such a dodgy popup even possible? I guess it could be some app I've installed, however I have very few apps installed on my phone, and they're mostly popular apps rather than dodgy third-party apps with few downloads. But even if that were the case, I would expect that long-tapping on the notification would bring up the app that produced it, rather than the "software update" app.

Can anybody offer any advice? Screenshot below.

 

[Javier P]

There are several threads reporting this same notification. It seems that only affects Samsung devices and doesn't look very legit. I recommend you to exit using the return key. So far it's not clear what is the origin of it. This is one of the threads

http://forums.androidcentral.com/showthread.php?t=664816

 

[nzseries1]

Ah thank you. I did a google search for "Dear customer we recommed" but got no results (I see in the thread you linked to they have the message in a screenshot only) so I started a new thread. Apologies.

 

[Javier P]

Ah thank you. I did a google search for "Dear customer we recommed" but got no results (I see they have the message in a screenshot only) so I started a new thread. Apologies.

No problem at all! Tell us if you find something. This notification is bothering several users.

 

[air_head]

I received this notification on Thursday. I have been in touch with Samsung and I'm awaiting a call from the mobile specialists. The Samsung team originally went through some trouble shooting with me (safe mode, soft reset, forcing stops on Internet browser's and of course scanning for viruses) but the notification is still there. I have not pressed "ok" and they also advised not to press "ok" as they don't know what it is. I will let you know when Samsung call me to see what they say!

 

[BertieAhern]

Just wanted to add, I've had the same message, same issues, can't quit it either. So far I've only pressed return, not 'ok'. Hoping for some news asap.

Oh, and just in case anyone thinks it's limited to Galaxy S5, I'm a Galaxy S6.

Also, mine has the option of 'update' as well as 'ok'.

 

[Chalky7]

Hi all,

This popped up on my Galaxy S6 this morning - the poor spelling and grammar instantly made alarm bells ring.

I went into the software updater in the settings menu and it says there is an update available but my storage is full. Here are the details of this update:

Size: 1416.08 MB
Version: G920FXXU3DPCJ / G920FTEF3DPC1 / G920FXXU3DPCJ
OS upgrade
Android 6.0 Marshmallow

I'm worried to install this too in case the phone's software updater has been hijacked. Is there any official word on this yet?

 

[air_head]

So Samsung got in touch with me today and arranged a remote management session for tomorrow. I will be back tomorrow to let you know haw it goes.

Can I just ask what network everyone is on? I've seen a few people say they are on O2. Maybe it's O2 that's forced the shady notification.

 

[Chalky7]

Hey, I'm on O2 too...

I've installed the update from the settings screen and can confirm the update to 6.0 (Galaxy S6) went without a hitch. The 'dodgy' notification is no longer showing.

I'm thinking it was legitimate, but somehow made it past the proof-reader. I'd still recommend updating through the system settings rather than the notification though...

 

[nzseries1]

I'm not on O2, I first got the notification while I was on holiday in Dubai. Glanced briefly at the network name, can't remember exactly what it was but it definitely wasn't O2.

 

[BertieAhern]

3 mobile.

Mine updated to Marshmallow, but the notification is still there.

If it was legitimate, why only notify a few people to upgrade? Mine upgrades automatically as it is. And why have I never had one before?

Seems extremely unlikely to be legit to me, particularly given recent security concerns.

 

[bobblebob]

Seems extremely unlikely to be legit to me, particularly given recent security concerns.

The amount of people that are getting it I think it may be legit. If it was something nasty, it would include a link or something to click which would take you to some dodgy website. I know some got an Upgrade button, but all I got was an OK button to click that just got rid of the message. So nothing in it for any scammers sending a message that says update via the proper channels. Ive done a scan with Malwarebytes and that picks nothing up

Anyone had the message reappear if they didn't update?

 

[BertieAhern]

I hope I am wrong and it's nothing. But how do you know that clicking 'ok' didn't install some malware?

I'm hoping air_head gets some good feedback from Samsung.

 

[bobblebob]

Well I did a scan with malwarebytes after clicking ok and picked nothing up. Nothing untoward with the phone since then.

One other thing I noticed is looking in the data tab Samsung Push Notifications has used abit more data this month that it has in the previous 3 months. Assume if it was a Samsung Push notification this morning that's why the data usage has increased from that app

Seems its legit.

A rep from 3 posted this on another forum after checking with the "devices" team at the networkl

Hi Guys,

The message that ye have received is legitimate

The message is to let you know that there is a new software available on the phone from Samsung.

http://www.boards.ie/ttfthread/2057582011

 

[nzseries1]

Pfft. Nice "two-second response" there by 3. No elaboration at all, other than "it's legit".

 

[air_head]

Samsung told me NOT to click "ok". There is an update, but they don't know where the notification is coming from.

 

[air_head]

So, I've just finished the remote session with someone from the tech team... he didn't know where the notification has come from and thinks it may of been from a 3rd party app (even though I've only got apps via the app store and the notification still appears in safe mode?!?!). Apparently I'm best deleting every app I have downloaded until the notification goes away, and if that doesn't work then a factory reset.

I feel it was a waste of time to be honest. I've been through every app already and stopped notifications and it still was there, it was still there in safe mode and my phone is already up to date.

No answers given unfortunately.

Good news- the notification has gone!
Bad news- he clicked OK on it, so gosh knows what he clicked OK to. :/

 

[nzseries1]

Seems worrying that he thinks it's an app... long tapping on the notification should show which app it is, but it doesn't. If the tech team don't know, then who else could possibly know?

 

[BertieAhern]

Disappointing. Clearly it wasn't an official notification, you'd think they'd take more action.

FWIW the only 3rd party app I had active during the period was Words With Friends...

 

[maddjc49]

I'm on EE and have the same notification. There is no way I will click on ok to get rid of this as that could well be exactly what a scammed would want you to do. Disappointing Samsung have not come out with something on this!!!