11–20 of 171 posts
Earlier quoted context omitted.
If your Android OEM has pushed the July 2017 security update to your device, you're patched. https://source.android.com/security/bulletin/2017-07-01#broa...
Out of curiosity, what fraction of Android OEMs push these security updates promptly (or equivalently what fraction of Android phones receive these kind of updates regularly)?
There isn't any third party customization to re-validate.
> Broadpwn is a fully remote attack against Broadcom’s BCM43xx family of WiFi chipsets, which allows for code execution on the main application processor in both Android and iOS.
But it doesn't go into any details on this privilege escalation actually works for iOS and more specifically that it doesn't require additional exploits. Can anyone explain this in more detail? If this actually allows code execution on iOS application processor, that means we have a jailbreak right?
Earlier quoted context omitted.
Out of curiosity, what fraction of Android OEMs push these security updates promptly (or equivalently what fraction of Android phones receive these kind of updates regularly)?
This page has a table of OEMs/devices that, as of the end of May, were fewer than 60 days behind on patches. https://android-developers.googleblog.com/2017/06/2017-andro... To me, the takeaway from this is that unless you are using a "flagship" device, or one sold directly by Google, you're probably not getting updates in a timely manner.
BlackBerry: PRIV
Fujitsu: F-01J
General Mobile: GM5 Plus d, GM5 Plus, General Mobile 4G Dual,
General Mobile 4G
Gionee A1
Google: Pixel XL, Pixel, Nexus 6P, Nexus 6, Nexus 5X, Nexus 9
LGE: LG G6, V20, Stylo 2 V, GPAD 7.0 LTE
Motorola: Moto Z, Moto Z Droid
Oppo: CPH1613, CPH1605
Samsung: Galaxy S8+, Galaxy S8, Galaxy S7, Galaxy S7 Edge, Galaxy S7 Active, Galaxy S6 Active, Galaxy S5 Dual SIM, Galaxy C9 Pro, Galaxy C7, Galaxy J7, Galaxy On7 Pro, Galaxy J2, Galaxy A8, Galaxy Tab S2 9.7
Sharp: Android One S1, 507SH
Sony: Xperia XA1, Xperia X
Vivo: Vivo 1609, Vivo 1601, Vivo Y55
memcpy(current_wmm_ie, ie->data, ie->len);
This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?
C's lack of array size info strikes again: memcpy(current_wmm_ie, ie->data, ie->len); where "ie" points to data obtained from the net.
How could it possibly be detrimental for Broadcom to have free software drivers?
This article is a poignant example that it is detrimental for them to continue to keep their drivers proprietary.
Why does Broadcom insist on proprietary drivers? How could it possibly be detrimental for Broadcom to have free software drivers? This article is a poignant example that it is detrimental for them to continue to keep their drivers proprietary.
The article mentions > Broadpwn is a fully remote attack against Broadcom’s BCM43xx family of WiFi chipsets, which allows for code execution on the main application processor in both Android and iOS. But it doesn't go into any details on this privilege escalation actually works for iOS and more specifically that it doesn't require additional exploits. Can anyone explain this in more detail? If this actually allows co…
The other more obvious privilege escalation is that there is still a kernel driver on the application processor talking to the chipset. There is per se no reason to distrust data coming from the chipset, so these often aren't written as defensive as they should be and could contain trivially exploitable assumptions on what the chipset will send and do.