Samsung Galaxy S3 Easy phone for Hacking

Dutch hackers have found two serious errors in SIII

 

Impact
MWR showed an exploit against a previously undiscovered vulnerability on a Samsung Galaxy S3 phone running Android 4.0.4. ThroughNFC it was possible to upload a malicious file to the device, which allowed us to gain code execution on the device and subsequently get full control over the device using a second vulnerability for privilege escalation.
The same vulnerability could also be exploited through other attack vectors, such as malicious websites or e-mail attachments.
The Vulnerabilities
The first vulnerability was a memory corruption that allowed us to gain limited control over the phone. We triggered this vulnerability 185 times in our exploit code in order to overcome some of the limitations placed on us by the vulnerability.
We used the second vulnerability to escalate our privileges on the device and undermine the application sandbox model. We used this to install a customised version of Mercury, our Android assessment framework. We could then use Mercury’s capabilities to exfiltrate user data from the device to a remote listener, including dumping SMS and contact databases, or initiating a call to a premium rate number.
Mobile Pwn2Own at EuSecWest 2012 - MWR Labs