A new report from security researchers Context has identified what were "serious security failings" in Samsung’s Android tablet, the Galaxy Tab.

One issue concerned the tablet’s content synchronisation service, called Keys. According to Context’s investigation, when the tablet is set to synchronise over WiFi, anyone connected to the same WiFi network could not only intercept the data being synrchronised but also access the file system of the tablet.

"The tablet and the software on your desktop agree a network port over which to synchronise, but there [was] no encryption and no authentication," explains Jonathan Roach, principal consultant at Context. "So anybody on the same WiFi network, for example in an office environment, can see the traffic so they can read anything else that’s being synchronised, and they can also read the contents of the tablet’s internal memory."

The other serious security issue concerned the Samsung Dive service, which is similar to Apple’s "Find My iPad" system. "If you’ve lot your Tab, you can log in to Dive, where it’s got location services on it, you can remote lock it, remote wipe it, change the password, and you can also remotely unlock it," Roach explains.

"All these features are provided by a couple of services running in the tablet, and we found that one of those services would accept commands from any app running on the device," he says. "That means any app could initiate a wipe or change the passcode or unlock the device."

Furthermore, the vulnerability was such that apps could carry out these commands without asking for the requisite permissions – usually a restriction on Android apps, Context claims.  

Samsung told Context that it has fixed the vulnerabilities that it identified, Roach says, although Context has yet to test whether this is the case. Samsung has yet to respond to Information Age‘s requests for comment.

Nevertheless, Roach said that discovery of these security flaws, combined with the fact that the Android operating system allows unauthorised apps to be run, means that he would recommend against using a Galaxy Tab for business use.

Context also looked at the iPad and the BlackBerry PlayBook. Both were given a relatively clean bill of health, although Context did find that running a ‘jailbroken’ kernel of the iOS operating system, freely available online, would allow someone to access the encrypted data on an iPad by simply cracking the 4-digit access code. They found this code could be cracked in about 18 minutes.

Roach said that using mobile device management software for any of the devices would certainly improve security, but added that he was not aware of any that could prevent devices from being jailbroken. "And once they’ve been jailbroken, all bets are off."