Author: alienbd

Beginning with the Galaxy S24 series, Samsung has been offering up to seven years of mobile security updates.¹ As one of the longest periods of security support available for mobile devices, these updates mean customers can safely use their phones for longer.

This peace of mind is important when navigating our hyperconnected age as cyber threats become more common than you think and are often undetectable until too late. The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.² Therefore, it is critical to use a device that benefits from an ecosystem of protective measures — such as security updates.

But where do these updates come from, and why do they pop up on your phone so regularly? Deep at the heart of Samsung’s Mobile eXperience Business lies Samsung Project Infinity, a classified operation. Samsung Newsroom met the specialist units within Samsung Project Infinity who safeguard Galaxy devices and users around the clock.

Deep Diving for Unknown Dangers

The Cyber Threat Intelligence (CTI) taskforce is a reconnaissance unit within Samsung Project Infinity along with the Red (RED), Blue (BLUE) and Purple (PURPLE) Teams that go beyond lab conditions to identify real-world dangers. RED and BLUE perform proactive attack and defense functions, seeking out vulnerabilities and taking measures against them. PURPLE is a special operations unit that acts as both a sword and shield for specific critical areas. These teams are strategically deployed in various countries all over the world including Vietnam, Poland, Ukraine and Brazil.

They work covertly. The only time you’ll ever feel their presence is when you get an update containing a security patch.

CTI is dedicated to identifying potential threats and stopping hackers from taking control of your device by staying on top of the latest risks. They work to prevent malicious actions, address threats involving the trade of stolen information and ensure your smartphone or tablet stays securely under your control.

The taskforce protects Galaxy’s internal infrastructure — safeguarding customer data and employee information such as access credentials — since any confidential information stolen by a hacker could be sold or abused for further attacks.

To identify potential threats and deploy countermeasures, CTI regularly explores the Deep Web and the Dark Web — bustling markets for security exploits, spyware, malware, ransomware, illicit tools and confidential corporate and customer information.

Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics, leads CTI. With over 20 years of experience in the U.S. tech industry as a cybersecurity authority and ethical hacker, Choi has collaborated globally to fortify security for major financial and tech firms. His expertise in identifying and mitigating zero-day threats drives the development of advanced security measures that protect over a billion Galaxy users around the world.

“Occasionally, we engage in security research by simulating real-world transactions,” said Choi. “We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration.”

As an ethical or “white hat” hacker — whose deep understanding of hacking helps to identify and address vulnerabilities — Choi explained that any hint of suspicious behavior within the system is swiftly traced to its origin.

For example, request for excessive privileges, unexpected behavior, and network traffic with unknown servers could point to a potential breach, at which point CTI traces Indicators of Compromise to identify the threat actors and the purpose of the attacks.

“Once we spot these kinds of threats, we collaborate with developers and operators to lock everything down for preventing attacks,” said Ranger, a CTI member. (Samsung Project Infinity staff protect their identities with aliases to avoid being personally targeted by hackers.) “We even communicate with other departments and partners on private channels to avoid taking any chances.”

CTI also studies threat actors to decipher their behavioral patterns. Understanding their motivations and objectives can help reveal their attack methods and provide insights for fortification.

“Sometimes, an attack is financially or politically motivated,” added Tower, another CTI member. “Sometimes, they just like to show off.”

Eliminating Threats Before They Become Real

While real-time threat detection is crucial, a robust offensive security policy is equally vital. RED and BLUE are inspired by military practices in which a red team simulates enemy attacks and a blue team creates defenses to ensure safety in the face of ever-changing threats. In Samsung’s approach, RED simulates hacker attacks and designs new attack scenarios to identify potential vulnerabilities, whereas BLUE develops and implements patches to protect against them.

Specializing in combating zero-day attacks, the teams address vulnerabilities before they can be exploited to prevent unauthorized access or data breaches. One notable data breach is the Pegasus incident in 2020 that left an operating system vulnerable.

The RED taskforce initiates their project by investigating Galaxy devices. They continuously use and analyze new features in Galaxy and delve into recently disclosed vulnerabilities, while envisioning potential security threats against users. By conducting diverse research, once they select a target that presents any potential risks to actual Galaxy users, the RED taskforce begins their quest to detect 0-day vulnerabilities in the target.

“One thing we do is fuzzing,” said Arrowhead, a RED member. “That throws all kinds of unexpected data at software to uncover any hidden flaws.”

Other methods such as code auditing as well as static and dynamic analyses help develop a comprehensive understanding of a system’s health and safety. The team contextualizes each threat in everyday scenarios to prevent threats to Galaxy devices.

“It’s not so urgent if there’s a flaw with the alarm clock, but a glitch in location data could lead to somebody being unknowingly followed through their device,” added Gate, a BLUE member. “Once we discover a hypothetical weakness, we hurry to patch it and roll out an update to the relevant models.”

The Specialists Among Specialists

PURPLE acts as both aggressor and protector to ensure the security of critical areas, the key features of Galaxy devices. As the name suggests, PURPLE combines elements of RED and BLUE’s skillsets — however, an extra in-depth knowledge of the security measures built into the mobile devices sets this team apart.

“Samsung collaborates with external security researchers to uncover vulnerabilities, but our own intimate knowledge of Galaxy systems allows for more effective targeting of potential weak spots,” said Sphinx, a PURPLE member.

“The better you know a system, the better you can protect it,” added Oracle, another PURPLE member.

Occasionally, PURPLE is called upon to address issues nobody else can including formulating new security requirements, designs and features. Though, it isn’t just about keeping Galaxy devices and the Samsung Knox security platform in good shape. Samsung also advises and proposes solutions to chipset and network vendors depending on their requirements.

Samsung’s position as a hardware leader means the company can not only scale its security innovations but also cover its secure supply chain. In this way, Galaxy is contributing to the security of next generation of chips.

Perhaps surprisingly, the motivation behind this work sometimes has nothing to do with technology. PURPLE members perform with a sense of duty to keep people safe, and they feel a certain pride and satisfaction in finding and addressing vulnerabilities.

“It’s not just me but also my family and friends who use Galaxy,” continued Oracle. “So, let’s make it safe!”

The bar for entry is high, and technical skills alone are not enough. To join the team, one must also demonstrate strength of character since any vulnerabilities discovered by the team could be very profitable in the wrong hands.

“They must be tenacious and moral,” said Choi. “One must be responsible and put users before their personal interests.”

“Being an early adopter and a big reader of tech trends is also useful,” added Sphinx.

A System of Safeguards

CTI, RED, BLUE and PURPLE are critical components of Galaxy’s security strategy — but Samsung Project Infinity juggles many initiatives including the Samsung Mobile Security Rewards Program which works with the wider security community to further scrutinize Galaxy’s defenses.

This year, Samsung has boosted this program with a maximum reward amount of $1 million — its highest cash incentive yet for those who are able to identify the most severe attack scenarios within Galaxy devices.

“It’s crucial to encourage participation from the security community in identifying potential vulnerabilities,” said Choi. “Especially in a world where cyberattacks are increasingly intelligent and disruptive.”

All of this goes hand in hand with Samsung’s longstanding model of collaboration with hundreds of partners including carriers, service providers, chipset vendors and more. While regularly working with these partners as well as the wider community to identify threats and develop patches, Samsung Project Infinity ensures Samsung proactively takes initiative and responsibility for reinforcing its own areas of weakness.

“Just because we have internal specialists, this doesn’t mean we don’t work with others,” added Choi. “Having more eyes gives us a better chance at spotting any vulnerabilities and helps us keep users safe.”

So, are you still ignoring that notification now that you know it is from a team deeply committed to your security? Each of those notifications represents Samsung’s ongoing effort in keeping your data safe.

The next time you see an update, don’t hesitate. Hit “install” and continue your online journey with peace of mind, knowing that there’s a whole team looking out for you.

¹ Timing and availability of security maintenance releases for Samsung Galaxy devices may vary by market, network provider and/or model.
² Statista Market Insight, “Cybercrime Expected To Skyrocket in Coming Years,” Chart: Cybercrime Expected To Skyrocket in Coming YeaBeginning with the Galaxy S24 series, Samsung has been offering up to seven years of mobile security updates.¹ As one of the longest periods of security support available for mobile devices, these updates mean customers can safely use their phones for longer.

This peace of mind is important when navigating our hyperconnected age as cyber threats become more common than you think and are often undetectable until too late. The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.² Therefore, it is critical to use a device that benefits from an ecosystem of protective measures — such as security updates.

But where do these updates come from, and why do they pop up on your phone so regularly? Deep at the heart of Samsung’s Mobile eXperience Business lies Samsung Project Infinity, a classified operation. Samsung Newsroom met the specialist units within Samsung Project Infinity who safeguard Galaxy devices and users around the clock.

Deep Diving for Unknown Dangers

The Cyber Threat Intelligence (CTI) taskforce is a reconnaissance unit within Samsung Project Infinity along with the Red (RED), Blue (BLUE) and Purple (PURPLE) Teams that go beyond lab conditions to identify real-world dangers. RED and BLUE perform proactive attack and defense functions, seeking out vulnerabilities and taking measures against them. PURPLE is a special operations unit that acts as both a sword and shield for specific critical areas. These teams are strategically deployed in various countries all over the world including Vietnam, Poland, Ukraine and Brazil.

They work covertly. The only time you’ll ever feel their presence is when you get an update containing a security patch.

CTI is dedicated to identifying potential threats and stopping hackers from taking control of your device by staying on top of the latest risks. They work to prevent malicious actions, address threats involving the trade of stolen information and ensure your smartphone or tablet stays securely under your control.

The taskforce protects Galaxy’s internal infrastructure — safeguarding customer data and employee information such as access credentials — since any confidential information stolen by a hacker could be sold or abused for further attacks.

To identify potential threats and deploy countermeasures, CTI regularly explores the Deep Web and the Dark Web — bustling markets for security exploits, spyware, malware, ransomware, illicit tools and confidential corporate and customer information.

Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics, leads CTI. With over 20 years of experience in the U.S. tech industry as a cybersecurity authority and ethical hacker, Choi has collaborated globally to fortify security for major financial and tech firms. His expertise in identifying and mitigating zero-day threats drives the development of advanced security measures that protect over a billion Galaxy users around the world.

“Occasionally, we engage in security research by simulating real-world transactions,” said Choi. “We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration.”

As an ethical or “white hat” hacker — whose deep understanding of hacking helps to identify and address vulnerabilities — Choi explained that any hint of suspicious behavior within the system is swiftly traced to its origin.

For example, request for excessive privileges, unexpected behavior, and network traffic with unknown servers could point to a potential breach, at which point CTI traces Indicators of Compromise to identify the threat actors and the purpose of the attacks.

“Once we spot these kinds of threats, we collaborate with developers and operators to lock everything down for preventing attacks,” said Ranger, a CTI member. (Samsung Project Infinity staff protect their identities with aliases to avoid being personally targeted by hackers.) “We even communicate with other departments and partners on private channels to avoid taking any chances.”

CTI also studies threat actors to decipher their behavioral patterns. Understanding their motivations and objectives can help reveal their attack methods and provide insights for fortification.

“Sometimes, an attack is financially or politically motivated,” added Tower, another CTI member. “Sometimes, they just like to show off.”

Eliminating Threats Before They Become Real

While real-time threat detection is crucial, a robust offensive security policy is equally vital. RED and BLUE are inspired by military practices in which a red team simulates enemy attacks and a blue team creates defenses to ensure safety in the face of ever-changing threats. In Samsung’s approach, RED simulates hacker attacks and designs new attack scenarios to identify potential vulnerabilities, whereas BLUE develops and implements patches to protect against them.

Specializing in combating zero-day attacks, the teams address vulnerabilities before they can be exploited to prevent unauthorized access or data breaches. One notable data breach is the Pegasus incident in 2020 that left an operating system vulnerable.

The RED taskforce initiates their project by investigating Galaxy devices. They continuously use and analyze new features in Galaxy and delve into recently disclosed vulnerabilities, while envisioning potential security threats against users. By conducting diverse research, once they select a target that presents any potential risks to actual Galaxy users, the RED taskforce begins their quest to detect 0-day vulnerabilities in the target.

“One thing we do is fuzzing,” said Arrowhead, a RED member. “That throws all kinds of unexpected data at software to uncover any hidden flaws.”

Other methods such as code auditing as well as static and dynamic analyses help develop a comprehensive understanding of a system’s health and safety. The team contextualizes each threat in everyday scenarios to prevent threats to Galaxy devices.

“It’s not so urgent if there’s a flaw with the alarm clock, but a glitch in location data could lead to somebody being unknowingly followed through their device,” added Gate, a BLUE member. “Once we discover a hypothetical weakness, we hurry to patch it and roll out an update to the relevant models.”

The Specialists Among Specialists

PURPLE acts as both aggressor and protector to ensure the security of critical areas, the key features of Galaxy devices. As the name suggests, PURPLE combines elements of RED and BLUE’s skillsets — however, an extra in-depth knowledge of the security measures built into the mobile devices sets this team apart.

“Samsung collaborates with external security researchers to uncover vulnerabilities, but our own intimate knowledge of Galaxy systems allows for more effective targeting of potential weak spots,” said Sphinx, a PURPLE member.

“The better you know a system, the better you can protect it,” added Oracle, another PURPLE member.

Occasionally, PURPLE is called upon to address issues nobody else can including formulating new security requirements, designs and features. Though, it isn’t just about keeping Galaxy devices and the Samsung Knox security platform in good shape. Samsung also advises and proposes solutions to chipset and network vendors depending on their requirements.

Samsung’s position as a hardware leader means the company can not only scale its security innovations but also cover its secure supply chain. In this way, Galaxy is contributing to the security of next generation of chips.

Perhaps surprisingly, the motivation behind this work sometimes has nothing to do with technology. PURPLE members perform with a sense of duty to keep people safe, and they feel a certain pride and satisfaction in finding and addressing vulnerabilities.

“It’s not just me but also my family and friends who use Galaxy,” continued Oracle. “So, let’s make it safe!”

The bar for entry is high, and technical skills alone are not enough. To join the team, one must also demonstrate strength of character since any vulnerabilities discovered by the team could be very profitable in the wrong hands.

“They must be tenacious and moral,” said Choi. “One must be responsible and put users before their personal interests.”

“Being an early adopter and a big reader of tech trends is also useful,” added Sphinx.

A System of Safeguards

CTI, RED, BLUE and PURPLE are critical components of Galaxy’s security strategy — but Samsung Project Infinity juggles many initiatives including the Samsung Mobile Security Rewards Program which works with the wider security community to further scrutinize Galaxy’s defenses.

This year, Samsung has boosted this program with a maximum reward amount of $1 million — its highest cash incentive yet for those who are able to identify the most severe attack scenarios within Galaxy devices.

“It’s crucial to encourage participation from the security community in identifying potential vulnerabilities,” said Choi. “Especially in a world where cyberattacks are increasingly intelligent and disruptive.”

All of this goes hand in hand with Samsung’s longstanding model of collaboration with hundreds of partners including carriers, service providers, chipset vendors and more. While regularly working with these partners as well as the wider community to identify threats and develop patches, Samsung Project Infinity ensures Samsung proactively takes initiative and responsibility for reinforcing its own areas of weakness.

“Just because we have internal specialists, this doesn’t mean we don’t work with others,” added Choi. “Having more eyes gives us a better chance at spotting any vulnerabilities and helps us keep users safe.”

So, are you still ignoring that notification now that you know it is from a team deeply committed to your security? Each of those notifications represents Samsung’s ongoing effort in keeping your data safe.

The next time you see an update, don’t hesitate. Hit “install” and continue your online journey with peace of mind, knowing that there’s a whole team looking out for you.

¹ Timing and availability of security maintenance releases for Samsung Galaxy devices may vary by market, network provider and/or model.
² Statista Market Insight, “Cybercrime Expected To Skyrocket in Coming Years,” Chart: Cybercrime Expected To Skyrocket in Coming YeaBeginning with the Galaxy S24 series, Samsung has been offering up to seven years of mobile security updates.¹ As one of the longest periods of security support available for mobile devices, these updates mean customers can safely use their phones for longer.

This peace of mind is important when navigating our hyperconnected age as cyber threats become more common than you think and are often undetectable until too late. The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.² Therefore, it is critical to use a device that benefits from an ecosystem of protective measures — such as security updates.

But where do these updates come from, and why do they pop up on your phone so regularly? Deep at the heart of Samsung’s Mobile eXperience Business lies Samsung Project Infinity, a classified operation. Samsung Newsroom met the specialist units within Samsung Project Infinity who safeguard Galaxy devices and users around the clock.

Deep Diving for Unknown Dangers

The Cyber Threat Intelligence (CTI) taskforce is a reconnaissance unit within Samsung Project Infinity along with the Red (RED), Blue (BLUE) and Purple (PURPLE) Teams that go beyond lab conditions to identify real-world dangers. RED and BLUE perform proactive attack and defense functions, seeking out vulnerabilities and taking measures against them. PURPLE is a special operations unit that acts as both a sword and shield for specific critical areas. These teams are strategically deployed in various countries all over the world including Vietnam, Poland, Ukraine and Brazil.

They work covertly. The only time you’ll ever feel their presence is when you get an update containing a security patch.

CTI is dedicated to identifying potential threats and stopping hackers from taking control of your device by staying on top of the latest risks. They work to prevent malicious actions, address threats involving the trade of stolen information and ensure your smartphone or tablet stays securely under your control.

The taskforce protects Galaxy’s internal infrastructure — safeguarding customer data and employee information such as access credentials — since any confidential information stolen by a hacker could be sold or abused for further attacks.

To identify potential threats and deploy countermeasures, CTI regularly explores the Deep Web and the Dark Web — bustling markets for security exploits, spyware, malware, ransomware, illicit tools and confidential corporate and customer information.

Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics, leads CTI. With over 20 years of experience in the U.S. tech industry as a cybersecurity authority and ethical hacker, Choi has collaborated globally to fortify security for major financial and tech firms. His expertise in identifying and mitigating zero-day threats drives the development of advanced security measures that protect over a billion Galaxy users around the world.

“Occasionally, we engage in security research by simulating real-world transactions,” said Choi. “We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration.”

As an ethical or “white hat” hacker — whose deep understanding of hacking helps to identify and address vulnerabilities — Choi explained that any hint of suspicious behavior within the system is swiftly traced to its origin.

For example, request for excessive privileges, unexpected behavior, and network traffic with unknown servers could point to a potential breach, at which point CTI traces Indicators of Compromise to identify the threat actors and the purpose of the attacks.

“Once we spot these kinds of threats, we collaborate with developers and operators to lock everything down for preventing attacks,” said Ranger, a CTI member. (Samsung Project Infinity staff protect their identities with aliases to avoid being personally targeted by hackers.) “We even communicate with other departments and partners on private channels to avoid taking any chances.”

CTI also studies threat actors to decipher their behavioral patterns. Understanding their motivations and objectives can help reveal their attack methods and provide insights for fortification.

“Sometimes, an attack is financially or politically motivated,” added Tower, another CTI member. “Sometimes, they just like to show off.”

Eliminating Threats Before They Become Real

While real-time threat detection is crucial, a robust offensive security policy is equally vital. RED and BLUE are inspired by military practices in which a red team simulates enemy attacks and a blue team creates defenses to ensure safety in the face of ever-changing threats. In Samsung’s approach, RED simulates hacker attacks and designs new attack scenarios to identify potential vulnerabilities, whereas BLUE develops and implements patches to protect against them.

Specializing in combating zero-day attacks, the teams address vulnerabilities before they can be exploited to prevent unauthorized access or data breaches. One notable data breach is the Pegasus incident in 2020 that left an operating system vulnerable.

The RED taskforce initiates their project by investigating Galaxy devices. They continuously use and analyze new features in Galaxy and delve into recently disclosed vulnerabilities, while envisioning potential security threats against users. By conducting diverse research, once they select a target that presents any potential risks to actual Galaxy users, the RED taskforce begins their quest to detect 0-day vulnerabilities in the target.

“One thing we do is fuzzing,” said Arrowhead, a RED member. “That throws all kinds of unexpected data at software to uncover any hidden flaws.”

Other methods such as code auditing as well as static and dynamic analyses help develop a comprehensive understanding of a system’s health and safety. The team contextualizes each threat in everyday scenarios to prevent threats to Galaxy devices.

“It’s not so urgent if there’s a flaw with the alarm clock, but a glitch in location data could lead to somebody being unknowingly followed through their device,” added Gate, a BLUE member. “Once we discover a hypothetical weakness, we hurry to patch it and roll out an update to the relevant models.”

The Specialists Among Specialists

PURPLE acts as both aggressor and protector to ensure the security of critical areas, the key features of Galaxy devices. As the name suggests, PURPLE combines elements of RED and BLUE’s skillsets — however, an extra in-depth knowledge of the security measures built into the mobile devices sets this team apart.

“Samsung collaborates with external security researchers to uncover vulnerabilities, but our own intimate knowledge of Galaxy systems allows for more effective targeting of potential weak spots,” said Sphinx, a PURPLE member.

“The better you know a system, the better you can protect it,” added Oracle, another PURPLE member.

Occasionally, PURPLE is called upon to address issues nobody else can including formulating new security requirements, designs and features. Though, it isn’t just about keeping Galaxy devices and the Samsung Knox security platform in good shape. Samsung also advises and proposes solutions to chipset and network vendors depending on their requirements.

Samsung’s position as a hardware leader means the company can not only scale its security innovations but also cover its secure supply chain. In this way, Galaxy is contributing to the security of next generation of chips.

Perhaps surprisingly, the motivation behind this work sometimes has nothing to do with technology. PURPLE members perform with a sense of duty to keep people safe, and they feel a certain pride and satisfaction in finding and addressing vulnerabilities.

“It’s not just me but also my family and friends who use Galaxy,” continued Oracle. “So, let’s make it safe!”

The bar for entry is high, and technical skills alone are not enough. To join the team, one must also demonstrate strength of character since any vulnerabilities discovered by the team could be very profitable in the wrong hands.

“They must be tenacious and moral,” said Choi. “One must be responsible and put users before their personal interests.”

“Being an early adopter and a big reader of tech trends is also useful,” added Sphinx.

A System of Safeguards

CTI, RED, BLUE and PURPLE are critical components of Galaxy’s security strategy — but Samsung Project Infinity juggles many initiatives including the Samsung Mobile Security Rewards Program which works with the wider security community to further scrutinize Galaxy’s defenses.

This year, Samsung has boosted this program with a maximum reward amount of $1 million — its highest cash incentive yet for those who are able to identify the most severe attack scenarios within Galaxy devices.

“It’s crucial to encourage participation from the security community in identifying potential vulnerabilities,” said Choi. “Especially in a world where cyberattacks are increasingly intelligent and disruptive.”

All of this goes hand in hand with Samsung’s longstanding model of collaboration with hundreds of partners including carriers, service providers, chipset vendors and more. While regularly working with these partners as well as the wider community to identify threats and develop patches, Samsung Project Infinity ensures Samsung proactively takes initiative and responsibility for reinforcing its own areas of weakness.

“Just because we have internal specialists, this doesn’t mean we don’t work with others,” added Choi. “Having more eyes gives us a better chance at spotting any vulnerabilities and helps us keep users safe.”

So, are you still ignoring that notification now that you know it is from a team deeply committed to your security? Each of those notifications represents Samsung’s ongoing effort in keeping your data safe.

The next time you see an update, don’t hesitate. Hit “install” and continue your online journey with peace of mind, knowing that there’s a whole team looking out for you.

¹ Timing and availability of security maintenance releases for Samsung Galaxy devices may vary by market, network provider and/or model.
² Statista Market Insight, “Cybercrime Expected To Skyrocket in Coming Years,” Chart: Cybercrime Expected To Skyrocket in Coming YeaBeginning with the Galaxy S24 series, Samsung has been offering up to seven years of mobile security updates.¹ As one of the longest periods of security support available for mobile devices, these updates mean customers can safely use their phones for longer.

This peace of mind is important when navigating our hyperconnected age as cyber threats become more common than you think and are often undetectable until too late. The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.² Therefore, it is critical to use a device that benefits from an ecosystem of protective measures — such as security updates.

But where do these updates come from, and why do they pop up on your phone so regularly? Deep at the heart of Samsung’s Mobile eXperience Business lies Samsung Project Infinity, a classified operation. Samsung Newsroom met the specialist units within Samsung Project Infinity who safeguard Galaxy devices and users around the clock.

Deep Diving for Unknown Dangers

The Cyber Threat Intelligence (CTI) taskforce is a reconnaissance unit within Samsung Project Infinity along with the Red (RED), Blue (BLUE) and Purple (PURPLE) Teams that go beyond lab conditions to identify real-world dangers. RED and BLUE perform proactive attack and defense functions, seeking out vulnerabilities and taking measures against them. PURPLE is a special operations unit that acts as both a sword and shield for specific critical areas. These teams are strategically deployed in various countries all over the world including Vietnam, Poland, Ukraine and Brazil.

They work covertly. The only time you’ll ever feel their presence is when you get an update containing a security patch.

CTI is dedicated to identifying potential threats and stopping hackers from taking control of your device by staying on top of the latest risks. They work to prevent malicious actions, address threats involving the trade of stolen information and ensure your smartphone or tablet stays securely under your control.

The taskforce protects Galaxy’s internal infrastructure — safeguarding customer data and employee information such as access credentials — since any confidential information stolen by a hacker could be sold or abused for further attacks.

To identify potential threats and deploy countermeasures, CTI regularly explores the Deep Web and the Dark Web — bustling markets for security exploits, spyware, malware, ransomware, illicit tools and confidential corporate and customer information.

Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics, leads CTI. With over 20 years of experience in the U.S. tech industry as a cybersecurity authority and ethical hacker, Choi has collaborated globally to fortify security for major financial and tech firms. His expertise in identifying and mitigating zero-day threats drives the development of advanced security measures that protect over a billion Galaxy users around the world.

“Occasionally, we engage in security research by simulating real-world transactions,” said Choi. “We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration.”

As an ethical or “white hat” hacker — whose deep understanding of hacking helps to identify and address vulnerabilities — Choi explained that any hint of suspicious behavior within the system is swiftly traced to its origin.

For example, request for excessive privileges, unexpected behavior, and network traffic with unknown servers could point to a potential breach, at which point CTI traces Indicators of Compromise to identify the threat actors and the purpose of the attacks.

“Once we spot these kinds of threats, we collaborate with developers and operators to lock everything down for preventing attacks,” said Ranger, a CTI member. (Samsung Project Infinity staff protect their identities with aliases to avoid being personally targeted by hackers.) “We even communicate with other departments and partners on private channels to avoid taking any chances.”

CTI also studies threat actors to decipher their behavioral patterns. Understanding their motivations and objectives can help reveal their attack methods and provide insights for fortification.

“Sometimes, an attack is financially or politically motivated,” added Tower, another CTI member. “Sometimes, they just like to show off.”

Eliminating Threats Before They Become Real

While real-time threat detection is crucial, a robust offensive security policy is equally vital. RED and BLUE are inspired by military practices in which a red team simulates enemy attacks and a blue team creates defenses to ensure safety in the face of ever-changing threats. In Samsung’s approach, RED simulates hacker attacks and designs new attack scenarios to identify potential vulnerabilities, whereas BLUE develops and implements patches to protect against them.

Specializing in combating zero-day attacks, the teams address vulnerabilities before they can be exploited to prevent unauthorized access or data breaches. One notable data breach is the Pegasus incident in 2020 that left an operating system vulnerable.

The RED taskforce initiates their project by investigating Galaxy devices. They continuously use and analyze new features in Galaxy and delve into recently disclosed vulnerabilities, while envisioning potential security threats against users. By conducting diverse research, once they select a target that presents any potential risks to actual Galaxy users, the RED taskforce begins their quest to detect 0-day vulnerabilities in the target.

“One thing we do is fuzzing,” said Arrowhead, a RED member. “That throws all kinds of unexpected data at software to uncover any hidden flaws.”

Other methods such as code auditing as well as static and dynamic analyses help develop a comprehensive understanding of a system’s health and safety. The team contextualizes each threat in everyday scenarios to prevent threats to Galaxy devices.

“It’s not so urgent if there’s a flaw with the alarm clock, but a glitch in location data could lead to somebody being unknowingly followed through their device,” added Gate, a BLUE member. “Once we discover a hypothetical weakness, we hurry to patch it and roll out an update to the relevant models.”

The Specialists Among Specialists

PURPLE acts as both aggressor and protector to ensure the security of critical areas, the key features of Galaxy devices. As the name suggests, PURPLE combines elements of RED and BLUE’s skillsets — however, an extra in-depth knowledge of the security measures built into the mobile devices sets this team apart.

“Samsung collaborates with external security researchers to uncover vulnerabilities, but our own intimate knowledge of Galaxy systems allows for more effective targeting of potential weak spots,” said Sphinx, a PURPLE member.

“The better you know a system, the better you can protect it,” added Oracle, another PURPLE member.

Occasionally, PURPLE is called upon to address issues nobody else can including formulating new security requirements, designs and features. Though, it isn’t just about keeping Galaxy devices and the Samsung Knox security platform in good shape. Samsung also advises and proposes solutions to chipset and network vendors depending on their requirements.

Samsung’s position as a hardware leader means the company can not only scale its security innovations but also cover its secure supply chain. In this way, Galaxy is contributing to the security of next generation of chips.

Perhaps surprisingly, the motivation behind this work sometimes has nothing to do with technology. PURPLE members perform with a sense of duty to keep people safe, and they feel a certain pride and satisfaction in finding and addressing vulnerabilities.

“It’s not just me but also my family and friends who use Galaxy,” continued Oracle. “So, let’s make it safe!”

The bar for entry is high, and technical skills alone are not enough. To join the team, one must also demonstrate strength of character since any vulnerabilities discovered by the team could be very profitable in the wrong hands.

“They must be tenacious and moral,” said Choi. “One must be responsible and put users before their personal interests.”

“Being an early adopter and a big reader of tech trends is also useful,” added Sphinx.

A System of Safeguards

CTI, RED, BLUE and PURPLE are critical components of Galaxy’s security strategy — but Samsung Project Infinity juggles many initiatives including the Samsung Mobile Security Rewards Program which works with the wider security community to further scrutinize Galaxy’s defenses.

This year, Samsung has boosted this program with a maximum reward amount of $1 million — its highest cash incentive yet for those who are able to identify the most severe attack scenarios within Galaxy devices.

“It’s crucial to encourage participation from the security community in identifying potential vulnerabilities,” said Choi. “Especially in a world where cyberattacks are increasingly intelligent and disruptive.”

All of this goes hand in hand with Samsung’s longstanding model of collaboration with hundreds of partners including carriers, service providers, chipset vendors and more. While regularly working with these partners as well as the wider community to identify threats and develop patches, Samsung Project Infinity ensures Samsung proactively takes initiative and responsibility for reinforcing its own areas of weakness.

“Just because we have internal specialists, this doesn’t mean we don’t work with others,” added Choi. “Having more eyes gives us a better chance at spotting any vulnerabilities and helps us keep users safe.”

So, are you still ignoring that notification now that you know it is from a team deeply committed to your security? Each of those notifications represents Samsung’s ongoing effort in keeping your data safe.

The next time you see an update, don’t hesitate. Hit “install” and continue your online journey with peace of mind, knowing that there’s a whole team looking out for you.

¹ Timing and availability of security maintenance releases for Samsung Galaxy devices may vary by market, network provider and/or model.
² Statista Market Insight, “Cybercrime Expected To Skyrocket in Coming Years,” Chart: Cybercrime Expected To Skyrocket in Coming YeaBeginning with the Galaxy S24 series, Samsung has been offering up to seven years of mobile security updates.¹ As one of the longest periods of security support available for mobile devices, these updates mean customers can safely use their phones for longer.

This peace of mind is important when navigating our hyperconnected age as cyber threats become more common than you think and are often undetectable until too late. The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.² Therefore, it is critical to use a device that benefits from an ecosystem of protective measures — such as security updates.

But where do these updates come from, and why do they pop up on your phone so regularly? Deep at the heart of Samsung’s Mobile eXperience Business lies Samsung Project Infinity, a classified operation. Samsung Newsroom met the specialist units within Samsung Project Infinity who safeguard Galaxy devices and users around the clock.

Deep Diving for Unknown Dangers

The Cyber Threat Intelligence (CTI) taskforce is a reconnaissance unit within Samsung Project Infinity along with the Red (RED), Blue (BLUE) and Purple (PURPLE) Teams that go beyond lab conditions to identify real-world dangers. RED and BLUE perform proactive attack and defense functions, seeking out vulnerabilities and taking measures against them. PURPLE is a special operations unit that acts as both a sword and shield for specific critical areas. These teams are strategically deployed in various countries all over the world including Vietnam, Poland, Ukraine and Brazil.

They work covertly. The only time you’ll ever feel their presence is when you get an update containing a security patch.

CTI is dedicated to identifying potential threats and stopping hackers from taking control of your device by staying on top of the latest risks. They work to prevent malicious actions, address threats involving the trade of stolen information and ensure your smartphone or tablet stays securely under your control.

The taskforce protects Galaxy’s internal infrastructure — safeguarding customer data and employee information such as access credentials — since any confidential information stolen by a hacker could be sold or abused for further attacks.

To identify potential threats and deploy countermeasures, CTI regularly explores the Deep Web and the Dark Web — bustling markets for security exploits, spyware, malware, ransomware, illicit tools and confidential corporate and customer information.

Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics, leads CTI. With over 20 years of experience in the U.S. tech industry as a cybersecurity authority and ethical hacker, Choi has collaborated globally to fortify security for major financial and tech firms. His expertise in identifying and mitigating zero-day threats drives the development of advanced security measures that protect over a billion Galaxy users around the world.

“Occasionally, we engage in security research by simulating real-world transactions,” said Choi. “We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration.”

As an ethical or “white hat” hacker — whose deep understanding of hacking helps to identify and address vulnerabilities — Choi explained that any hint of suspicious behavior within the system is swiftly traced to its origin.

For example, request for excessive privileges, unexpected behavior, and network traffic with unknown servers could point to a potential breach, at which point CTI traces Indicators of Compromise to identify the threat actors and the purpose of the attacks.

“Once we spot these kinds of threats, we collaborate with developers and operators to lock everything down for preventing attacks,” said Ranger, a CTI member. (Samsung Project Infinity staff protect their identities with aliases to avoid being personally targeted by hackers.) “We even communicate with other departments and partners on private channels to avoid taking any chances.”

CTI also studies threat actors to decipher their behavioral patterns. Understanding their motivations and objectives can help reveal their attack methods and provide insights for fortification.

“Sometimes, an attack is financially or politically motivated,” added Tower, another CTI member. “Sometimes, they just like to show off.”

Eliminating Threats Before They Become Real

While real-time threat detection is crucial, a robust offensive security policy is equally vital. RED and BLUE are inspired by military practices in which a red team simulates enemy attacks and a blue team creates defenses to ensure safety in the face of ever-changing threats. In Samsung’s approach, RED simulates hacker attacks and designs new attack scenarios to identify potential vulnerabilities, whereas BLUE develops and implements patches to protect against them.

Specializing in combating zero-day attacks, the teams address vulnerabilities before they can be exploited to prevent unauthorized access or data breaches. One notable data breach is the Pegasus incident in 2020 that left an operating system vulnerable.

The RED taskforce initiates their project by investigating Galaxy devices. They continuously use and analyze new features in Galaxy and delve into recently disclosed vulnerabilities, while envisioning potential security threats against users. By conducting diverse research, once they select a target that presents any potential risks to actual Galaxy users, the RED taskforce begins their quest to detect 0-day vulnerabilities in the target.

“One thing we do is fuzzing,” said Arrowhead, a RED member. “That throws all kinds of unexpected data at software to uncover any hidden flaws.”

Other methods such as code auditing as well as static and dynamic analyses help develop a comprehensive understanding of a system’s health and safety. The team contextualizes each threat in everyday scenarios to prevent threats to Galaxy devices.

“It’s not so urgent if there’s a flaw with the alarm clock, but a glitch in location data could lead to somebody being unknowingly followed through their device,” added Gate, a BLUE member. “Once we discover a hypothetical weakness, we hurry to patch it and roll out an update to the relevant models.”

The Specialists Among Specialists

PURPLE acts as both aggressor and protector to ensure the security of critical areas, the key features of Galaxy devices. As the name suggests, PURPLE combines elements of RED and BLUE’s skillsets — however, an extra in-depth knowledge of the security measures built into the mobile devices sets this team apart.

“Samsung collaborates with external security researchers to uncover vulnerabilities, but our own intimate knowledge of Galaxy systems allows for more effective targeting of potential weak spots,” said Sphinx, a PURPLE member.

“The better you know a system, the better you can protect it,” added Oracle, another PURPLE member.

Occasionally, PURPLE is called upon to address issues nobody else can including formulating new security requirements, designs and features. Though, it isn’t just about keeping Galaxy devices and the Samsung Knox security platform in good shape. Samsung also advises and proposes solutions to chipset and network vendors depending on their requirements.

Samsung’s position as a hardware leader means the company can not only scale its security innovations but also cover its secure supply chain. In this way, Galaxy is contributing to the security of next generation of chips.

Perhaps surprisingly, the motivation behind this work sometimes has nothing to do with technology. PURPLE members perform with a sense of duty to keep people safe, and they feel a certain pride and satisfaction in finding and addressing vulnerabilities.

“It’s not just me but also my family and friends who use Galaxy,” continued Oracle. “So, let’s make it safe!”

The bar for entry is high, and technical skills alone are not enough. To join the team, one must also demonstrate strength of character since any vulnerabilities discovered by the team could be very profitable in the wrong hands.

“They must be tenacious and moral,” said Choi. “One must be responsible and put users before their personal interests.”

“Being an early adopter and a big reader of tech trends is also useful,” added Sphinx.

A System of Safeguards

CTI, RED, BLUE and PURPLE are critical components of Galaxy’s security strategy — but Samsung Project Infinity juggles many initiatives including the Samsung Mobile Security Rewards Program which works with the wider security community to further scrutinize Galaxy’s defenses.

This year, Samsung has boosted this program with a maximum reward amount of $1 million — its highest cash incentive yet for those who are able to identify the most severe attack scenarios within Galaxy devices.

“It’s crucial to encourage participation from the security community in identifying potential vulnerabilities,” said Choi. “Especially in a world where cyberattacks are increasingly intelligent and disruptive.”

All of this goes hand in hand with Samsung’s longstanding model of collaboration with hundreds of partners including carriers, service providers, chipset vendors and more. While regularly working with these partners as well as the wider community to identify threats and develop patches, Samsung Project Infinity ensures Samsung proactively takes initiative and responsibility for reinforcing its own areas of weakness.

“Just because we have internal specialists, this doesn’t mean we don’t work with others,” added Choi. “Having more eyes gives us a better chance at spotting any vulnerabilities and helps us keep users safe.”

So, are you still ignoring that notification now that you know it is from a team deeply committed to your security? Each of those notifications represents Samsung’s ongoing effort in keeping your data safe.

The next time you see an update, don’t hesitate. Hit “install” and continue your online journey with peace of mind, knowing that there’s a whole team looking out for you.

¹ Timing and availability of security maintenance releases for Samsung Galaxy devices may vary by market, network provider and/or model.
² Statista Market Insight, “Cybercrime Expected To Skyrocket in Coming Years,” Chart: Cybercrime Expected To Skyrocket in Coming YeaBeginning with the Galaxy S24 series, Samsung has been offering up to seven years of mobile security updates.¹ As one of the longest periods of security support available for mobile devices, these updates mean customers can safely use their phones for longer.

This peace of mind is important when navigating our hyperconnected age as cyber threats become more common than you think and are often undetectable until too late. The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.² Therefore, it is critical to use a device that benefits from an ecosystem of protective measures — such as security updates.

But where do these updates come from, and why do they pop up on your phone so regularly? Deep at the heart of Samsung’s Mobile eXperience Business lies Samsung Project Infinity, a classified operation. Samsung Newsroom met the specialist units within Samsung Project Infinity who safeguard Galaxy devices and users around the clock.

Deep Diving for Unknown Dangers

The Cyber Threat Intelligence (CTI) taskforce is a reconnaissance unit within Samsung Project Infinity along with the Red (RED), Blue (BLUE) and Purple (PURPLE) Teams that go beyond lab conditions to identify real-world dangers. RED and BLUE perform proactive attack and defense functions, seeking out vulnerabilities and taking measures against them. PURPLE is a special operations unit that acts as both a sword and shield for specific critical areas. These teams are strategically deployed in various countries all over the world including Vietnam, Poland, Ukraine and Brazil.

They work covertly. The only time you’ll ever feel their presence is when you get an update containing a security patch.

CTI is dedicated to identifying potential threats and stopping hackers from taking control of your device by staying on top of the latest risks. They work to prevent malicious actions, address threats involving the trade of stolen information and ensure your smartphone or tablet stays securely under your control.

The taskforce protects Galaxy’s internal infrastructure — safeguarding customer data and employee information such as access credentials — since any confidential information stolen by a hacker could be sold or abused for further attacks.

To identify potential threats and deploy countermeasures, CTI regularly explores the Deep Web and the Dark Web — bustling markets for security exploits, spyware, malware, ransomware, illicit tools and confidential corporate and customer information.

Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics, leads CTI. With over 20 years of experience in the U.S. tech industry as a cybersecurity authority and ethical hacker, Choi has collaborated globally to fortify security for major financial and tech firms. His expertise in identifying and mitigating zero-day threats drives the development of advanced security measures that protect over a billion Galaxy users around the world.

“Occasionally, we engage in security research by simulating real-world transactions,” said Choi. “We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration.”

As an ethical or “white hat” hacker — whose deep understanding of hacking helps to identify and address vulnerabilities — Choi explained that any hint of suspicious behavior within the system is swiftly traced to its origin.

For example, request for excessive privileges, unexpected behavior, and network traffic with unknown servers could point to a potential breach, at which point CTI traces Indicators of Compromise to identify the threat actors and the purpose of the attacks.

“Once we spot these kinds of threats, we collaborate with developers and operators to lock everything down for preventing attacks,” said Ranger, a CTI member. (Samsung Project Infinity staff protect their identities with aliases to avoid being personally targeted by hackers.) “We even communicate with other departments and partners on private channels to avoid taking any chances.”

CTI also studies threat actors to decipher their behavioral patterns. Understanding their motivations and objectives can help reveal their attack methods and provide insights for fortification.

“Sometimes, an attack is financially or politically motivated,” added Tower, another CTI member. “Sometimes, they just like to show off.”

Eliminating Threats Before They Become Real

While real-time threat detection is crucial, a robust offensive security policy is equally vital. RED and BLUE are inspired by military practices in which a red team simulates enemy attacks and a blue team creates defenses to ensure safety in the face of ever-changing threats. In Samsung’s approach, RED simulates hacker attacks and designs new attack scenarios to identify potential vulnerabilities, whereas BLUE develops and implements patches to protect against them.

Specializing in combating zero-day attacks, the teams address vulnerabilities before they can be exploited to prevent unauthorized access or data breaches. One notable data breach is the Pegasus incident in 2020 that left an operating system vulnerable.

The RED taskforce initiates their project by investigating Galaxy devices. They continuously use and analyze new features in Galaxy and delve into recently disclosed vulnerabilities, while envisioning potential security threats against users. By conducting diverse research, once they select a target that presents any potential risks to actual Galaxy users, the RED taskforce begins their quest to detect 0-day vulnerabilities in the target.

“One thing we do is fuzzing,” said Arrowhead, a RED member. “That throws all kinds of unexpected data at software to uncover any hidden flaws.”

Other methods such as code auditing as well as static and dynamic analyses help develop a comprehensive understanding of a system’s health and safety. The team contextualizes each threat in everyday scenarios to prevent threats to Galaxy devices.

“It’s not so urgent if there’s a flaw with the alarm clock, but a glitch in location data could lead to somebody being unknowingly followed through their device,” added Gate, a BLUE member. “Once we discover a hypothetical weakness, we hurry to patch it and roll out an update to the relevant models.”

The Specialists Among Specialists

PURPLE acts as both aggressor and protector to ensure the security of critical areas, the key features of Galaxy devices. As the name suggests, PURPLE combines elements of RED and BLUE’s skillsets — however, an extra in-depth knowledge of the security measures built into the mobile devices sets this team apart.

“Samsung collaborates with external security researchers to uncover vulnerabilities, but our own intimate knowledge of Galaxy systems allows for more effective targeting of potential weak spots,” said Sphinx, a PURPLE member.

“The better you know a system, the better you can protect it,” added Oracle, another PURPLE member.

Occasionally, PURPLE is called upon to address issues nobody else can including formulating new security requirements, designs and features. Though, it isn’t just about keeping Galaxy devices and the Samsung Knox security platform in good shape. Samsung also advises and proposes solutions to chipset and network vendors depending on their requirements.

Samsung’s position as a hardware leader means the company can not only scale its security innovations but also cover its secure supply chain. In this way, Galaxy is contributing to the security of next generation of chips.

Perhaps surprisingly, the motivation behind this work sometimes has nothing to do with technology. PURPLE members perform with a sense of duty to keep people safe, and they feel a certain pride and satisfaction in finding and addressing vulnerabilities.

“It’s not just me but also my family and friends who use Galaxy,” continued Oracle. “So, let’s make it safe!”

The bar for entry is high, and technical skills alone are not enough. To join the team, one must also demonstrate strength of character since any vulnerabilities discovered by the team could be very profitable in the wrong hands.

“They must be tenacious and moral,” said Choi. “One must be responsible and put users before their personal interests.”

“Being an early adopter and a big reader of tech trends is also useful,” added Sphinx.

A System of Safeguards

CTI, RED, BLUE and PURPLE are critical components of Galaxy’s security strategy — but Samsung Project Infinity juggles many initiatives including the Samsung Mobile Security Rewards Program which works with the wider security community to further scrutinize Galaxy’s defenses.

This year, Samsung has boosted this program with a maximum reward amount of $1 million — its highest cash incentive yet for those who are able to identify the most severe attack scenarios within Galaxy devices.

“It’s crucial to encourage participation from the security community in identifying potential vulnerabilities,” said Choi. “Especially in a world where cyberattacks are increasingly intelligent and disruptive.”

All of this goes hand in hand with Samsung’s longstanding model of collaboration with hundreds of partners including carriers, service providers, chipset vendors and more. While regularly working with these partners as well as the wider community to identify threats and develop patches, Samsung Project Infinity ensures Samsung proactively takes initiative and responsibility for reinforcing its own areas of weakness.

“Just because we have internal specialists, this doesn’t mean we don’t work with others,” added Choi. “Having more eyes gives us a better chance at spotting any vulnerabilities and helps us keep users safe.”

So, are you still ignoring that notification now that you know it is from a team deeply committed to your security? Each of those notifications represents Samsung’s ongoing effort in keeping your data safe.

The next time you see an update, don’t hesitate. Hit “install” and continue your online journey with peace of mind, knowing that there’s a whole team looking out for you.

¹ Timing and availability of security maintenance releases for Samsung Galaxy devices may vary by market, network provider and/or model.
² Statista Market Insight, “Cybercrime Expected To Skyrocket in Coming Years,” Chart: Cybercrime Expected To Skyrocket in Coming YeaBeginning with the Galaxy S24 series, Samsung has been offering up to seven years of mobile security updates.¹ As one of the longest periods of security support available for mobile devices, these updates mean customers can safely use their phones for longer.

This peace of mind is important when navigating our hyperconnected age as cyber threats become more common than you think and are often undetectable until too late. The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.² Therefore, it is critical to use a device that benefits from an ecosystem of protective measures — such as security updates.

But where do these updates come from, and why do they pop up on your phone so regularly? Deep at the heart of Samsung’s Mobile eXperience Business lies Samsung Project Infinity, a classified operation. Samsung Newsroom met the specialist units within Samsung Project Infinity who safeguard Galaxy devices and users around the clock.

Deep Diving for Unknown Dangers

The Cyber Threat Intelligence (CTI) taskforce is a reconnaissance unit within Samsung Project Infinity along with the Red (RED), Blue (BLUE) and Purple (PURPLE) Teams that go beyond lab conditions to identify real-world dangers. RED and BLUE perform proactive attack and defense functions, seeking out vulnerabilities and taking measures against them. PURPLE is a special operations unit that acts as both a sword and shield for specific critical areas. These teams are strategically deployed in various countries all over the world including Vietnam, Poland, Ukraine and Brazil.

They work covertly. The only time you’ll ever feel their presence is when you get an update containing a security patch.

CTI is dedicated to identifying potential threats and stopping hackers from taking control of your device by staying on top of the latest risks. They work to prevent malicious actions, address threats involving the trade of stolen information and ensure your smartphone or tablet stays securely under your control.

The taskforce protects Galaxy’s internal infrastructure — safeguarding customer data and employee information such as access credentials — since any confidential information stolen by a hacker could be sold or abused for further attacks.

To identify potential threats and deploy countermeasures, CTI regularly explores the Deep Web and the Dark Web — bustling markets for security exploits, spyware, malware, ransomware, illicit tools and confidential corporate and customer information.

Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics, leads CTI. With over 20 years of experience in the U.S. tech industry as a cybersecurity authority and ethical hacker, Choi has collaborated globally to fortify security for major financial and tech firms. His expertise in identifying and mitigating zero-day threats drives the development of advanced security measures that protect over a billion Galaxy users around the world.

“Occasionally, we engage in security research by simulating real-world transactions,” said Choi. “We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration.”

As an ethical or “white hat” hacker — whose deep understanding of hacking helps to identify and address vulnerabilities — Choi explained that any hint of suspicious behavior within the system is swiftly traced to its origin.

For example, request for excessive privileges, unexpected behavior, and network traffic with unknown servers could point to a potential breach, at which point CTI traces Indicators of Compromise to identify the threat actors and the purpose of the attacks.

“Once we spot these kinds of threats, we collaborate with developers and operators to lock everything down for preventing attacks,” said Ranger, a CTI member. (Samsung Project Infinity staff protect their identities with aliases to avoid being personally targeted by hackers.) “We even communicate with other departments and partners on private channels to avoid taking any chances.”

CTI also studies threat actors to decipher their behavioral patterns. Understanding their motivations and objectives can help reveal their attack methods and provide insights for fortification.

“Sometimes, an attack is financially or politically motivated,” added Tower, another CTI member. “Sometimes, they just like to show off.”

Eliminating Threats Before They Become Real

While real-time threat detection is crucial, a robust offensive security policy is equally vital. RED and BLUE are inspired by military practices in which a red team simulates enemy attacks and a blue team creates defenses to ensure safety in the face of ever-changing threats. In Samsung’s approach, RED simulates hacker attacks and designs new attack scenarios to identify potential vulnerabilities, whereas BLUE develops and implements patches to protect against them.

Specializing in combating zero-day attacks, the teams address vulnerabilities before they can be exploited to prevent unauthorized access or data breaches. One notable data breach is the Pegasus incident in 2020 that left an operating system vulnerable.

The RED taskforce initiates their project by investigating Galaxy devices. They continuously use and analyze new features in Galaxy and delve into recently disclosed vulnerabilities, while envisioning potential security threats against users. By conducting diverse research, once they select a target that presents any potential risks to actual Galaxy users, the RED taskforce begins their quest to detect 0-day vulnerabilities in the target.

“One thing we do is fuzzing,” said Arrowhead, a RED member. “That throws all kinds of unexpected data at software to uncover any hidden flaws.”

Other methods such as code auditing as well as static and dynamic analyses help develop a comprehensive understanding of a system’s health and safety. The team contextualizes each threat in everyday scenarios to prevent threats to Galaxy devices.

“It’s not so urgent if there’s a flaw with the alarm clock, but a glitch in location data could lead to somebody being unknowingly followed through their device,” added Gate, a BLUE member. “Once we discover a hypothetical weakness, we hurry to patch it and roll out an update to the relevant models.”

The Specialists Among Specialists

PURPLE acts as both aggressor and protector to ensure the security of critical areas, the key features of Galaxy devices. As the name suggests, PURPLE combines elements of RED and BLUE’s skillsets — however, an extra in-depth knowledge of the security measures built into the mobile devices sets this team apart.

“Samsung collaborates with external security researchers to uncover vulnerabilities, but our own intimate knowledge of Galaxy systems allows for more effective targeting of potential weak spots,” said Sphinx, a PURPLE member.

“The better you know a system, the better you can protect it,” added Oracle, another PURPLE member.

Occasionally, PURPLE is called upon to address issues nobody else can including formulating new security requirements, designs and features. Though, it isn’t just about keeping Galaxy devices and the Samsung Knox security platform in good shape. Samsung also advises and proposes solutions to chipset and network vendors depending on their requirements.

Samsung’s position as a hardware leader means the company can not only scale its security innovations but also cover its secure supply chain. In this way, Galaxy is contributing to the security of next generation of chips.

Perhaps surprisingly, the motivation behind this work sometimes has nothing to do with technology. PURPLE members perform with a sense of duty to keep people safe, and they feel a certain pride and satisfaction in finding and addressing vulnerabilities.

“It’s not just me but also my family and friends who use Galaxy,” continued Oracle. “So, let’s make it safe!”

The bar for entry is high, and technical skills alone are not enough. To join the team, one must also demonstrate strength of character since any vulnerabilities discovered by the team could be very profitable in the wrong hands.

“They must be tenacious and moral,” said Choi. “One must be responsible and put users before their personal interests.”

“Being an early adopter and a big reader of tech trends is also useful,” added Sphinx.

A System of Safeguards

CTI, RED, BLUE and PURPLE are critical components of Galaxy’s security strategy — but Samsung Project Infinity juggles many initiatives including the Samsung Mobile Security Rewards Program which works with the wider security community to further scrutinize Galaxy’s defenses.

This year, Samsung has boosted this program with a maximum reward amount of $1 million — its highest cash incentive yet for those who are able to identify the most severe attack scenarios within Galaxy devices.

“It’s crucial to encourage participation from the security community in identifying potential vulnerabilities,” said Choi. “Especially in a world where cyberattacks are increasingly intelligent and disruptive.”

All of this goes hand in hand with Samsung’s longstanding model of collaboration with hundreds of partners including carriers, service providers, chipset vendors and more. While regularly working with these partners as well as the wider community to identify threats and develop patches, Samsung Project Infinity ensures Samsung proactively takes initiative and responsibility for reinforcing its own areas of weakness.

“Just because we have internal specialists, this doesn’t mean we don’t work with others,” added Choi. “Having more eyes gives us a better chance at spotting any vulnerabilities and helps us keep users safe.”

So, are you still ignoring that notification now that you know it is from a team deeply committed to your security? Each of those notifications represents Samsung’s ongoing effort in keeping your data safe.

The next time you see an update, don’t hesitate. Hit “install” and continue your online journey with peace of mind, knowing that there’s a whole team looking out for you.

¹ Timing and availability of security maintenance releases for Samsung Galaxy devices may vary by market, network provider and/or model.
² Statista Market Insight, “Cybercrime Expected To Skyrocket in Coming Years,” Chart: Cybercrime Expected To Skyrocket in Coming YeaBeginning with the Galaxy S24 series, Samsung has been offering up to seven years of mobile security updates.¹ As one of the longest periods of security support available for mobile devices, these updates mean customers can safely use their phones for longer.

This peace of mind is important when navigating our hyperconnected age as cyber threats become more common than you think and are often undetectable until too late. The global cost of cybercrime is expected to surge in the next four years, rising from $9.22 trillion in 2024 to $13.82 trillion by 2028.² Therefore, it is critical to use a device that benefits from an ecosystem of protective measures — such as security updates.

But where do these updates come from, and why do they pop up on your phone so regularly? Deep at the heart of Samsung’s Mobile eXperience Business lies Samsung Project Infinity, a classified operation. Samsung Newsroom met the specialist units within Samsung Project Infinity who safeguard Galaxy devices and users around the clock.

Deep Diving for Unknown Dangers

The Cyber Threat Intelligence (CTI) taskforce is a reconnaissance unit within Samsung Project Infinity along with the Red (RED), Blue (BLUE) and Purple (PURPLE) Teams that go beyond lab conditions to identify real-world dangers. RED and BLUE perform proactive attack and defense functions, seeking out vulnerabilities and taking measures against them. PURPLE is a special operations unit that acts as both a sword and shield for specific critical areas. These teams are strategically deployed in various countries all over the world including Vietnam, Poland, Ukraine and Brazil.

They work covertly. The only time you’ll ever feel their presence is when you get an update containing a security patch.

CTI is dedicated to identifying potential threats and stopping hackers from taking control of your device by staying on top of the latest risks. They work to prevent malicious actions, address threats involving the trade of stolen information and ensure your smartphone or tablet stays securely under your control.

The taskforce protects Galaxy’s internal infrastructure — safeguarding customer data and employee information such as access credentials — since any confidential information stolen by a hacker could be sold or abused for further attacks.

To identify potential threats and deploy countermeasures, CTI regularly explores the Deep Web and the Dark Web — bustling markets for security exploits, spyware, malware, ransomware, illicit tools and confidential corporate and customer information.

Justin Choi, Vice President and Head of the Security Team, Mobile eXperience Business at Samsung Electronics, leads CTI. With over 20 years of experience in the U.S. tech industry as a cybersecurity authority and ethical hacker, Choi has collaborated globally to fortify security for major financial and tech firms. His expertise in identifying and mitigating zero-day threats drives the development of advanced security measures that protect over a billion Galaxy users around the world.

“Occasionally, we engage in security research by simulating real-world transactions,” said Choi. “We closely monitor forums and marketplaces for mentions of zero-day or N-day exploits targeting Galaxy devices, as well as any leaked intelligence that could potentially serve as an entry point for system infiltration.”

As an ethical or “white hat” hacker — whose deep understanding of hacking helps to identify and address vulnerabilities — Choi explained that any hint of suspicious behavior within the system is swiftly traced to its origin.

For example, request for excessive privileges, unexpected behavior, and network traffic with unknown servers could point to a potential breach, at which point CTI traces Indicators of Compromise to identify the threat actors and the purpose of the attacks.

“Once we spot these kinds of threats, we collaborate with developers and operators to lock everything down for preventing attacks,” said Ranger, a CTI member. (Samsung Project Infinity staff protect their identities with aliases to avoid being personally targeted by hackers.) “We even communicate with other departments and partners on private channels to avoid taking any chances.”

CTI also studies threat actors to decipher their behavioral patterns. Understanding their motivations and objectives can help reveal their attack methods and provide insights for fortification.

“Sometimes, an attack is financially or politically motivated,” added Tower, another CTI member. “Sometimes, they just like to show off.”

Eliminating Threats Before They Become Real

While real-time threat detection is crucial, a robust offensive security policy is equally vital. RED and BLUE are inspired by military practices in which a red team simulates enemy attacks and a blue team creates defenses to ensure safety in the face of ever-changing threats. In Samsung’s approach, RED simulates hacker attacks and designs new attack scenarios to identify potential vulnerabilities, whereas BLUE develops and implements patches to protect against them.

Specializing in combating zero-day attacks, the teams address vulnerabilities before they can be exploited to prevent unauthorized access or data breaches. One notable data breach is the Pegasus incident in 2020 that left an operating system vulnerable.

The RED taskforce initiates their project by investigating Galaxy devices. They continuously use and analyze new features in Galaxy and delve into recently disclosed vulnerabilities, while envisioning potential security threats against users. By conducting diverse research, once they select a target that presents any potential risks to actual Galaxy users, the RED taskforce begins their quest to detect 0-day vulnerabilities in the target.

“One thing we do is fuzzing,” said Arrowhead, a RED member. “That throws all kinds of unexpected data at software to uncover any hidden flaws.”

Other methods such as code auditing as well as static and dynamic analyses help develop a comprehensive understanding of a system’s health and safety. The team contextualizes each threat in everyday scenarios to prevent threats to Galaxy devices.

“It’s not so urgent if there’s a flaw with the alarm clock, but a glitch in location data could lead to somebody being unknowingly followed through their device,” added Gate, a BLUE member. “Once we discover a hypothetical weakness, we hurry to patch it and roll out an update to the relevant models.”

The Specialists Among Specialists

PURPLE acts as both aggressor and protector to ensure the security of critical areas, the key features of Galaxy devices. As the name suggests, PURPLE combines elements of RED and BLUE’s skillsets — however, an extra in-depth knowledge of the security measures built into the mobile devices sets this team apart.

“Samsung collaborates with external security researchers to uncover vulnerabilities, but our own intimate knowledge of Galaxy systems allows for more effective targeting of potential weak spots,” said Sphinx, a PURPLE member.

“The better you know a system, the better you can protect it,” added Oracle, another PURPLE member.

Occasionally, PURPLE is called upon to address issues nobody else can including formulating new security requirements, designs and features. Though, it isn’t just about keeping Galaxy devices and the Samsung Knox security platform in good shape. Samsung also advises and proposes solutions to chipset and network vendors depending on their requirements.

Samsung’s position as a hardware leader means the company can not only scale its security innovations but also cover its secure supply chain. In this way, Galaxy is contributing to the security of next generation of chips.

Perhaps surprisingly, the motivation behind this work sometimes has nothing to do with technology. PURPLE members perform with a sense of duty to keep people safe, and they feel a certain pride and satisfaction in finding and addressing vulnerabilities.

“It’s not just me but also my family and friends who use Galaxy,” continued Oracle. “So, let’s make it safe!”

The bar for entry is high, and technical skills alone are not enough. To join the team, one must also demonstrate strength of character since any vulnerabilities discovered by the team could be very profitable in the wrong hands.

“They must be tenacious and moral,” said Choi. “One must be responsible and put users before their personal interests.”

“Being an early adopter and a big reader of tech trends is also useful,” added Sphinx.

A System of Safeguards

CTI, RED, BLUE and PURPLE are critical components of Galaxy’s security strategy — but Samsung Project Infinity juggles many initiatives including the Samsung Mobile Security Rewards Program which works with the wider security community to further scrutinize Galaxy’s defenses.

This year, Samsung has boosted this program with a maximum reward amount of $1 million — its highest cash incentive yet for those who are able to identify the most severe attack scenarios within Galaxy devices.

“It’s crucial to encourage participation from the security community in identifying potential vulnerabilities,” said Choi. “Especially in a world where cyberattacks are increasingly intelligent and disruptive.”

All of this goes hand in hand with Samsung’s longstanding model of collaboration with hundreds of partners including carriers, service providers, chipset vendors and more. While regularly working with these partners as well as the wider community to identify threats and develop patches, Samsung Project Infinity ensures Samsung proactively takes initiative and responsibility for reinforcing its own areas of weakness.

“Just because we have internal specialists, this doesn’t mean we don’t work with others,” added Choi. “Having more eyes gives us a better chance at spotting any vulnerabilities and helps us keep users safe.”

So, are you still ignoring that notification now that you know it is from a team deeply committed to your security? Each of those notifications represents Samsung’s ongoing effort in keeping your data safe.

The next time you see an update, don’t hesitate. Hit “install” and continue your online journey with peace of mind, knowing that there’s a whole team looking out for you.

¹ Timing and availability of security maintenance releases for Samsung Galaxy devices may vary by market, network provider and/or model.
² Statista Market Insight, “Cybercrime Expected To Skyrocket in Coming Years,” Chart: Cybercrime Expected To Skyrocket in Coming Yea

Samsung is expanding its partnership with Art Basel to Art Basel Miami Beach. Following the debut as Art Basel’s first-ever Official Visual Display partner in Basel, Switzerland earlier this year, complete with an immersive Collectors Lounge experience. Through this unique partnership, Samsung is also launching a new initiative with Art Basel to bring curated collections of contemporary artworks from Art Basel’s renowned exhibiting galleries exclusively to the Samsung Art Store. A new collection will be shared once a quarter with the first collection launching today.

The Samsung Art Store is available on The Frame, the best-selling lifestyle TV from Samsung that doubles as a piece of art. Subscribers around the world can experience gallery highlights from Art Basel, which joins other renowned collections such as those from The Metropolitan Museum of Art, The Museum of Modern Art and The Musée d’Orsay available on the Samsung Art Store. The latest partnership with Art Basel underscores Samsung’s commitment to making world-class art accessible to anyone with The Frame through its innovative platform. 

Samsung Art Store Subscribers Get an Exclusive Look

Art Basel Miami Beach is the premier global art fair of the Americas with cultural significance attracting thousands of art enthusiasts every year. For the first time, this exclusive experience is being delivered directly to the screens of millions of people through The Frame.

Ahead of Art Basel Miami Beach, Samsung Art Store subscribers will have access to a curated collection of 15+ select works from Art Basel’s galleries, some of which will be displayed at the highly anticipated fair, taking place from December 6-8, 2024 at the Miami Beach Convention Center. The collection features pieces from international contemporary galleries, including James Cohan, Kasmin, moniquemeloche, mor charpentier, Nara Roesler, Roberts Projects and Tina Kim, offering subscribers a unique, front-row look at some of Art Basel’s incredible works of art.

▲ Candida Alvarez’s Mostly Clear (detail) (2023) shown on The Frame by Samsung. Photo: Samsung

Founded in 1970 by gallerists from Basel, Art Basel is the world’s premier art fair for modern and contemporary art. This year in Miami Beach, Art Basel will bring together 286 leading international galleries from 38 countries to present artworks of the highest quality across all media — from painting and sculpture to photography and digital works. Art Basel will once again reaffirm its unparalleled position as a platform for discovery and encounters that drive the art world.

“Art Basel’s mission is to power the world of art by connecting leading artists and galleries with art loving audiences,” said Noah Horowitz, CEO of Art Basel. “Our collaboration with Samsung allows us to extend that reach like never before by broadening access to leading galleries and significant works from established artists to a new generation of emerging talents.”

Yong Su Kim, EVP and Global Head of Video Services and Partnerships at Samsung, echoed the excitement surrounding this partnership. “Art Basel represents the pinnacle of contemporary art, and we are thrilled to amplify that experience with leading display technology that brings art to millions of people,” Kim said. “Through the Samsung Art Store and the lifelike visuals of The Frame, we are making it possible for anyone to experience Art Basel and take part in an iconic cultural moment.”

Samsung Art Store Collectors Lounge To Feature Industry Panels, Interactive Activation and More

As the Official Display Partner of Art Basel Miami Beach, Samsung is hosting a dedicated Samsung Art Store Collectors Lounge from December 4-8 under the concept, “Bringing Art Home,” where attendees can enjoy remarkable artworks on The Frame’s museum-worthy display. In addition, visitors will see The Frame showcased with unique bezels in various colors and designs from DecoTVFrames, an official Samsung partner exclusively available for The Frame.

The Frame will also be installed throughout the fair to present visitors with a variety of vivid screen experiences.

In addition to its dynamic Collectors Lounge experience, Samsung is hosting a series of panel discussions featuring influential voices from the contemporary art world. These sessions include:

• Celebrating Women in Art and Technology — Innovation and Expression
  An engaging panel led by Daria Greene, Head of Global Curation at Samsung. This discussion celebrates the journey of female artists and innovators who are redefining the intersection of art and technology. Gain insights into how digital platforms are amplifying voices and breaking new ground in contemporary art.
• The Future of Digital Art — Innovation, Rights and Connectivity
  Explore the future of digital art in this thought-provoking panel, moderated by Maya Harris, Head of Business Development and Strategic Partnerships at Samsung. This session delves into how technology is reshaping artistic rights, accessibility and the ways institutions and artists connect with global audiences.

As the home for Samsung Art Store, The Frame has been refreshed in 2024 to deliver an even more complete artistic and aesthetic experience. That includes Pantone Validated ArtfulColor Certification,¹ the industry leading color experts. The Frame is the world’s first and only art TV to achieve this validation, ensuring natural and realistic visuals that wouldn’t look out of place in a gallery. It also sports an Anti-Reflection with Matte Display, helping you limit light distractions so your artwork appears even more true-to-life. The Frame hangs just like a picture flush against the wall and is available in class sizes ranging from 32 to 85 inches.

The Frame also delivers value-add features that you can only find from Samsung — the #1 global TV brand for 18 years and counting.² Samsung technology makes everything you watch look clearer and crisper, while you enjoy access to 2,700+ free channels, including 400+ premium channels on Samsung TV Plus.³ You can also game without a console through Samsung Gaming Hub,⁴ use your TV as your smart home hub and ensure your personal data is protected by Samsung Knox security.

¹ Pantone company provides a universal language of color, called Pantone Matching System, that enables color-critical decisions through every stage of the workflow for brands and manufacturers.
² Source: Omdia, Jan 2024. Results are not an endorsement of Samsung. Any reliance on these results is at the third party’s own risk.
³ Available for free on Samsung Smart TVs released after 2016, Galaxy devices, Smart Monitors, Family Hub refrigerators and the web.
⁴ Available games and content may vary by country and model and are subject to change without notice. Certain games require a separate controller. Internet connection and subscription may be required. Requires a Samsung account.