Google Pixel pwned in 60 seconds • Hacker News Board

Re: Google Pixel pwned in 60 seconds

#21

Post by ddispaltro » Sat, Nov 12, 2016, 6:03 AM UTC

paulryanrogers wrote: post #19

kijin wrote: post #17

Earlier quoted context omitted.

Nexus kinda ran out of numbers, since they already used 7 for the tablet. Google experimented for a while with weird model numbers like 5X and 6P, but seems to have decided against continuing it. It's the version wars all over again. Who wants to be stuck at 5 and 6 when Apple is at 7, Samsung will soon return with an 8, and Microsoft already played the "we'll skip ahead to 10" card?

Where is SemVer for hardware models?

SemVar is alive and well for hardware, every revision is incompatible with the previous.

Re: Google Pixel pwned in 60 seconds

#22

Post by drieddust » Sat, Nov 12, 2016, 6:31 AM UTC

Kudos to team but these events demonstrate how broken the security is and why we should be scared.

A complete redesign is required but it won't happen unless it causes major catastrophy and losses.

Re: Google Pixel pwned in 60 seconds

#23

Post by yincrash » Sat, Nov 12, 2016, 6:34 AM UTC

drieddust wrote: post #22

Kudos to team but these events demonstrate how broken the security is and why we should be scared. A complete redesign is required but it won't happen unless it causes major catastrophy and losses.

Is there a source for why a complete redesign would be needed?

Re: Google Pixel pwned in 60 seconds

#24

Post by [deleted] » Sat, Nov 12, 2016, 6:48 AM UTC

anondon wrote: post #9

It looks like these exploits require either shell access or installing an app that contains the exploit code. Apart from the Flash vulnerability, did any of the exploits use Chrome to gain all permissions on the Pixel? That would be scary, because the user would just have to be served Javascript containing malicious code or visit an affected website. Why isn't Linux or the BSDs usually included in these pawn competit…

[deleted]

Re: Google Pixel pwned in 60 seconds

#25

Post by drieddust » Sat, Nov 12, 2016, 7:04 AM UTC

yincrash wrote: post #23

drieddust wrote: post #22

Kudos to team but these events demonstrate how broken the security is and why we should be scared. A complete redesign is required but it won't happen unless it causes major catastrophy and losses.

Is there a source for why a complete redesign would be needed?

Yes if an user program like flash results in pwning the device, security model is broken. Ideally when a user level program is compromised it should not be able to impact OS in any condition if security architecture was adhered to as it was envisioned. But every single OS out there have chosen the easyway out.

On hardware level CPU rings exist to protect kernel from rogue programs and each other but in reality all that protection is either completely or partially circumvented.

I read a paper on this a year back. I will try to find the link and post it here.

Re: Google Pixel pwned in 60 seconds

#26

Post by corecoder » Sat, Nov 12, 2016, 7:24 AM UTC

anondon wrote: post #9

It looks like these exploits require either shell access or installing an app that contains the exploit code. Apart from the Flash vulnerability, did any of the exploits use Chrome to gain all permissions on the Pixel? That would be scary, because the user would just have to be served Javascript containing malicious code or visit an affected website. Why isn't Linux or the BSDs usually included in these pawn competit…

> Why isn't Linux or the BSDs usually included in these pawn competitions?

I think that there are not many companies willing to pay to find vulnerabilities in Linux and BSD.

Re: Google Pixel pwned in 60 seconds

#27

Post by talsit » Sat, Nov 12, 2016, 7:27 AM UTC

pgodzin wrote: post #7

So they spend weeks developing the exploits and when they present it the headline is that it took 4 or 60 seconds? They even used the phrase "breached Adobe Flash with a flick of the finger" as if anyone could hack it with a finger gesture.

True that the headline is grabby, but if you are trying to pwn someone's phone, the speed of execution is important, right? "Hi, can I use your phone to call my mum? My phone's battery has died. I'll be back in 45 minutes..."

Re: Google Pixel pwned in 60 seconds

#28

Post by guitarbill » Sat, Nov 12, 2016, 7:34 AM UTC

seanp2k2 wrote: post #15

pgodzin wrote: post #7

So they spend weeks developing the exploits and when they present it the headline is that it took 4 or 60 seconds? They even used the phrase "breached Adobe Flash with a flick of the finger" as if anyone could hack it with a finger gesture.

Yeah, it's pretty disingenuous reporting / [intentional] misunderstanding to sensationalize headlines. I'm sure many dozens of hours of work went into each of these, more likely hundreds. It only impresses people with no familiarity with this type of thing.

No it's not. The timings represent a good proxy for how easy it is to pull off the (weaponised) exploit in the wild.

For example Flash, even when sandboxed, continues to be an extremely easy and lucrative attack vector (relatively speaking). Four seconds puts the exploit in drive-by territory.

A sixty second web exploit is not so useful for "cyber" criminals. But if you can "compromise all aspects of the phone including contacts, photos, messages, and phone calls" in 60 seconds, this is probably worth it.

Re: Google Pixel pwned in 60 seconds

#29

Post by yincrash » Sat, Nov 12, 2016, 8:06 AM UTC

drieddust wrote: post #25

yincrash wrote: post #23

Earlier quoted context omitted.

Is there a source for why a complete redesign would be needed?

Yes if an user program like flash results in pwning the device, security model is broken. Ideally when a user level program is compromised it should not be able to impact OS in any condition if security architecture was adhered to as it was envisioned. But every single OS out there have chosen the easyway out. On hardware level CPU rings exist to protect kernel from rogue programs and each other but in reality all th…

Okay, apologies, I thought you were talking about the Pixel. After watching the video, it's unclear whether or not the exploit was in a user mode application or one with system permissions.

Re: Google Pixel pwned in 60 seconds

#30

Post by pjmlp » Sat, Nov 12, 2016, 8:17 AM UTC

anondon wrote: post #9

It looks like these exploits require either shell access or installing an app that contains the exploit code. Apart from the Flash vulnerability, did any of the exploits use Chrome to gain all permissions on the Pixel? That would be scary, because the user would just have to be served Javascript containing malicious code or visit an affected website. Why isn't Linux or the BSDs usually included in these pawn competit…

At least for GNU/Linux, because it would be too easy given the current state of affairs as discussed this year's Linux Security Summit.

http://arstechnica.com/security/2016/09/linux-kernel-securit...

Given its use across the industry, and being written in C, GNU/Linux has become the target they used to joke about Windows since its existence.

For the BSDs, I imagine only OpenBSD would be an hard nut to crack given their focus on security. Then again, it isn't an OS that has much desktop visibility like the systems that are part of this competition.