3

My Samsung Galaxy S23 was stolen while in Rome on vacation. I used the Google Account Management / Security / Your devices screen to indicate what devices have connected to my Google account since the theft 10 days ago. I'm seeing a Linux device repeatedly showing up, but I have no Linux devices in my possession. For example, I see

Where you're signed in
1 session on Linux computer

and

History
2 sessions on Linux computer(s)

I see an entry as follows, marked 'new':

Linux
Rome, Italy
Sep 8
Samsung Browser

I've seen several entries like this over the past few days, and it tends to be associated with the Samsung Browser. In one case, the timestamp seemed to correlate to the time I tried to issue a device lock/wipe using the Samsung tool, so I'm wondering if there is some way that the Samsung Browser (on my Samsung Android tablet) is somehow being recognized as a Linux device. I've been issuing 'Sign out' commands whenever I see this.

I've changed the password on my Samsung account and on my Google account more than once since the theft.

Is it normal to see Linux devices showing up in this manner?

Improve this question

1 Answer 1

Reset to default
5

If you use Samsung Browser and log in into google.com then this login activity will be shown in the security relevant activity log as "Login on Linux".

I section "My Devices" this session is shown as

  • Linux
  • [the country you are in]
  • Samsung Browser

The reason for this behavior is the User Agent string used by Samsung Browser:

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Safari/537.36

This user Agent was used on an Android arm64 device, but it claims to be from an x86_64 device. The same I saw using Chrome web browser on Android.

In the end I found out that this "faked user agent" regarding the OS is used if you enable the "Desktop web site" option. If this option is disabled or set to "Mobile web site" then Samsung Browser and Chrome correctly identify themselves as running on Android und the device model "K" (Android version is always "10" and device model "K" no matter what Android version is installed - see Chromium User-Agent reduction).

User agent string of Samsung Browser showing the website as "Mobile web Site": Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Safari/537.36

Tested with Samsung Browser 26.0.3.7 on an Android 14 Samsung tablet.

Improve this answer
13
  • Thanks for the info. In your testing, using chrome, did the access show as coming from Linux? In my testing Chrome and edge seem to be reported as Android or the actual tablet name. Could you possibly tell me where to view this string? I'm stuck traveling at the moment with only my tablet but I'm trying to make sense of these access logs to better understand what kind of trouble I'm in. Commented Sep 11, 2024 at 12:38
  • @Steerpike I haven't tested Chrome, but the user agent is the same it may also be listed as "Linux". BTW: see my edit, the reason for the browser using the faking OS string in user agent is the mobile/desktop option for the selected web site. Commented Sep 11, 2024 at 12:51
  • I just tried in chrome, and was not able to get a 'linux' entry in the log, even switching between desktop and mobile. But I was immediately able to get the Linux entry with the Samsung browser. I hate the way Samsung switches between desktop and mobile; there's a button that says 'mobile' which I THINK means you are currently in desktop. Touch it and the icon changes to say desktop, which I THINK means switch to desktop. The sites I tested with all showed similar info in both modes so very unclear what's going on. Where can I see this string for Samsung browser? Commented Sep 11, 2024 at 20:24
  • @Steerpike simply search at Google for "show my user agent". Then Google will display it directly and show you online pages that do the same. Commented Sep 11, 2024 at 21:13
  • Thanks. Interesting! chrome, desktop view - Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 chrome, mobile view - Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Samsung, desktop site - Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Safari/537.36 Samsung, mobile site - Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/26.0 Chrome/122.0.0.0 Safari/537.36 Commented Sep 12, 2024 at 10:22

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.