How a $50,000 Exploit Chain Turned Bixby Against Samsung Phones 5万美元漏洞链如何让Bixby反噬三星手机

TL;DR

• Researchers Dimitrios Valsamaras (Microsoft) and Ken Gannon (Mobile Hacking Lab) chained multiple vulnerabilities in Samsung apps to achieve remote system-level compromise on Galaxy devices
• The exploit chain targets Samsung Members (CVE-2025-21079), Samsung Account (CVE-2025-58486, CVE-2025-58487), and Bixby's Capsule infrastructure to escalate from a clicked link to full device control
• The attack was demonstrated at Pwn2Own Ireland in October 2025, earning $50,000, and successfully reproduced on Galaxy S25, S24, and Flip 7 devices
• Samsung patched the vulnerabilities in November and December 2025, but older unpatched devices remain at risk
• The exploit requires all targeted apps to be installed, which is typical for flagship models but uncertain for budget devices

Why It Matters

This research highlights how preinstalled manufacturer apps with elevated permissions can form a dangerous attack chain, turning benign user interactions (clicking a link) into full device compromise. It underscores the importance of app sandboxing and permission management on Android, especially for virtual assistants with deep system integration.

Technical Details

• Exploit Chain: CVE-2025-21079 forces Samsung Members to load a malicious URL → CVE-2025-58486 redirects Samsung Account to an attacker-controlled site → CVE-2025-58487 (XSS) forces Samsung Account to open Bixby via its special "side entrance" permission
• Capsule Exploitation: Bixby uses "Capsules" — hidden background services acting as mini internal servers that perform app tasks. The researchers reverse-engineered the Capsule infrastructure to force Bixby to invoke Capsules maliciously, bypassing Samsung's restriction that normally only Bixby can communicate with them
• Privilege Escalation: The chained exploit achieves "system" level permissions — the highest privilege on stock Android — enabling remote code execution and data exfiltration
• Affected Devices: Successfully reproduced on Samsung Galaxy S25, S24, and Flip 7; patches released November 2025 (Samsung Members) and December 2025 (Samsung Account)

Industry Insight

• Manufacturers should audit inter-app communication pathways and permission grants, especially for preinstalled apps with access to sensitive services like virtual assistants
• The "side entrance" architecture between Samsung Account and Bixby demonstrates how legitimate integration points can become attack vectors when combined with web-facing vulnerabilities
• Security teams should prioritize patching for flagship devices running older firmware, as the exploit requires specific preinstalled apps that may not be present on budget models but are standard on premium ones

TL;DR

• 安全研究员在Black Hat会议上披露了三星Galaxy设备漏洞利用链，通过Samsung Members、Samsung Account和Bixby的级联漏洞可实现远程系统级权限获取
• 攻击链涉及三个CVE漏洞（CVE-2025-21079、CVE-2025-58486、CVE-2025-58487），在Pwn2Own Ireland 2025比赛中获得5万美元奖金
• 漏洞利用链通过Bixby的Capsule机制实现权限提升，可在用户点击恶意链接后完成远程代码执行
• 三星已在2025年11月和12月分别发布补丁修复相关漏洞，但旧设备可能仍未受保护

为什么值得看

本文揭示了移动设备预装应用间权限传递的安全风险，展示了攻击者如何通过精心设计的漏洞利用链绕过安全隔离机制，对移动设备安全架构设计具有重要警示意义。

技术解析

攻击链始于用户点击恶意链接，通过CVE-2025-21079漏洞强制Samsung Members应用连接到恶意网站，随后利用CVE-2025-58486和CVE-2025-58487（XSS漏洞）控制Samsung Account应用，最终通过Bixby的Capsule机制实现系统级权限获取。

Capsule是应用内部的隐藏后台服务，充当迷你内部服务器，Bixby通过语音命令与之通信执行任务。攻击者通过逆向工程发现可强制Bixby调用恶意Capsule，从而直接控制应用功能。

三星已在2025年11月修复Samsung Members漏洞，12月修复Samsung Account漏洞，但旧设备可能仍未受保护。漏洞在Galaxy S25、S24和Flip 7上成功复现。

行业启示

预装应用间的权限传递风险需要重新审视，厂商应建立更严格的跨应用通信安全审计机制，防止通过漏洞利用链实现权限提升。移动设备安全架构应关注应用间隔离机制，特别是语音助手等具有系统级权限的服务。