WARNING: Samsung Users

[SyCoREAPER]

Fellow Samsung Owners,

There is an alarming security flaw on most if not all Samsung devices but you have a few options.



Samsung Keyboard, whether your default keyboard or not, intercepts ALL 'Cut' and 'Copy' actions. This means every OTP, Password, Picture, etc.. that you Cut or Copy in the past will be in Samsung Keyboard's Clipboard. Right now you probably have a backlog of clipboard items.



First Option (Most annoying and Tedious)

Constantly open Samsung Keyboard and clear the clipboard.

Second Option (Still Manual but less tedious)

Post 2 and Post 11 of this thread for another option and confirmation.

Spoiler: Clicking Here: These options are AT YOUR OWN RISK. I take no responsibility and am not liable if you brick/break your phone. I've tested them, they work but you've been warned.

Third Option (Mid-ground Option, Safer but not 100%)

Follow the guide to App Freeze. Once you've followed all the install steps, in Icebox go to System Apps and look for 'Samsung Keyboard'. Long press and 'Frost'. Samsung Keyboard is now disabled but not deleted. Should you need to factory reset the app will still be there.


Fourth Option (Advanced Users, VERY Risky) - I'm not even telling you HOW to do this, only WHAT. If you know how to recover and fix Android, you will know how to do this.

Use ADB to delete Samsung Keyboard. It's name is 'Honeyboard'.



This is risky because I'm 90% sure a factory reset will not restore it and upon reset you will have no keyboard.

 

[BerryBubbles]

I have the edge clipboard panel enabled. After I'm done with the copy, I just slide open the panel & hit clear. It just takes seconds...

 

[SyCoREAPER]

I have the edge clipboard panel enabled. After I'm done with the copy, I just slide open the panel & hit clear. It just takes seconds...

View attachment 359720

Are you using Samsung Keyboard? If not, do the two match up before and after clearing?

 

[BerryBubbles]

Are you using Samsung Keyboard? If not, do the two match up before and after clearing?

Yes, I am using Samsung Keyboard & they do match up before & after.

Sometimes, I need to save a copy & if I pin it either through the keyboard or in the edge panel it shows pinned in the other.

 

[SyCoREAPER]

Yes, I am using Samsung Keyboard & they do match up before & after.

Sometimes, I need to save a copy & if I pin it either through the keyboard or in the edge panel it shows pinned in the other.

View attachment 359721

If you switch to another keyboard, does the side panel still work? I'm only playing 20 questions so I can determine if this can be made another option. I did a 4th method that I'm not sharing because it might need an ODIN flash to fix if it breaks and right now everything is working.

 

[BerryBubbles]

That I can't answer, as I've only used Samsung Keyboard & I do not have any other keyboard installed on any of my devices. Sorry.

 

[Sizzers]

Thanks for the heads up.

I never use any of Samsung's apps apart from some Good Lock modules for UI customisation.

Just checked and deleted the clipboard and it was quite scary what I found. A very dirty and underhand feature.

 

[gomezz]

Surely this is only a security risk if a third party can access the clipboard without the user's say so. Or am I being naive?

 

[belodion]

Surely this is only a security risk if a third party can access the clipboard without the user's say so. Or am I being naive?

That’s how it seems to me too, or indeed if a third party can access any other place or app where security details might be stored.

 

[SyCoREAPER]

That’s how it seems to me too, or indeed if a third party can access any other place or app where security details might be stored.

Surely this is only a security risk if a third party can access the clipboard without the user's say so. Or am I being naive?

The issue isn't just that it's storing but also intercepting the action.
A bad actor doesn't even need to gain access to S-Keyboard, only figure out what action it is using to intercept and either create a app that either imitates Keyboard or replace Keyboard with a malicious version.

Its all theoretical down to IF someone will attack it. But that applies too all vulnerabilities out there equally. If they didn't matter security patches wouldn't be needed.

 

[tismydroid]

If you switch to another keyboard, does the side panel still work? I'm only playing 20 questions so I can determine if this can be made another option. I did a 4th method that I'm not sharing because it might need an ODIN flash to fix if it breaks and right now everything is working.

Yes, side panel still works with another keyboard. I use Google keyboard and use the side panel to access past copy/paste.

 

[BerryBubbles]

Yes, side panel still works with another keyboard. I use Google keyboard and use the side panel to access past copy/paste.

Thanks for confirming that!

 

[Sizzers]

I've just noticed that the Samsung My Files app is pasting from the clipboard.

I normally use Files by Google and Solid Explorer but following a favourable article I read somewhere I decided to try My Files. I really like the UI so I've been using it for the last couple of weeks until today.

I normally clear the clipboard after use from the Edge Panel but sometimes I will forget. This was the case here and when I opened My Files a toast popped up to say it had pasted from the clipboard.

Looks suspicious.