Earlier quoted context omitted.
With a buffer overflow, you can write your own code into a chunk of memory that ends up being run by the application. In this case, since WhatsApp already had SMS read privileges as part of the signup auth flow, the attacker also had those privileges. The article has some detail about the remote code execution part of this exploit. “What this means is that there was a software flaw in the WhatsApp code for handling M…
So the payload would be some corrupted video file sent to Bezo's phone. Would the attack look something like: 1) Discover/buy/steal Bezo's Whatsapp number (how did they do that...) 2) Discover/buy/steal a 0-day bug in Whatsapp. 3) Write and compile a program that reads SMS from the OS and beacons it to some server you control. 4) Create a corrupted video file that would trigger the video parsing bug, and within that…
Amazon says email banning TikTok from employee phones was ‘sent in error’
351–360 of 496 posts
Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#352I feel like this TikTok backlash is so overblown. I don't think TikTok is spying on US consumers/business, and I don't think TikTok is sharing any US private data with CCP... I believe this because there's no evidence to the contrary, and out of principle you shouldn't assume malintent. In fact, TikTok explicitly left Hong Kong because if they didn't they would have to share private data with CCP to comply with new l…
Suggesting that TikTok is leaving MAU on the table to keep users' data safe is laughable when ByteDance's other Party-controlled app, DouYin, is remaining in Hong Kong with a captive audience (as helpfully confirmed by Global Times [2], a well-known mouthpiece of the Party). To even suggest that it's a sign of good intentions would ignore extremely important current events and ByteDance's self-proclaimed devotion to the Party. As we speak, the Party is aggressively assimilating Hong Kong into the mainland by banning public expressions of dissent, controlling educational curriculum, and yes, good old censorship. Forcing HK residents to use only Party-controlled tools that the rest of the mainland uses, like DouYin made by ByteDance, only serves to further the "work of Party construction".
TikTok is political because it is wholly owned by a self-proclaimed political entity: ByteDance. It's disingenuous to suggest there is no reason to assume malintent when ByteDance has a history of censorship and propaganda in its flagship app: DouYin. Your glib dismissal of "China bad" has no substance behind it, while China's ample human rights and totalitarian abuses speak for themselves. Putting the actions of independent private corporations in a free-speech democracy on the same level as the actions of a publicly-proclaimed ally of an authoritarian human rights abuser is plain nonsense. Context matters.
[1] https://chinamediaproject.org/2018/04/11/tech-shame-in-the-n...
[2] https://twitter.com/globaltimesnews/status/12803650546557911...
Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#353Earlier quoted context omitted.
One can successfully sue Facebook, etc. for violating privacy rights - https://techcrunch.com/2020/01/29/facebook-will-pay-550-mill...
Facebook had net income over $60 billion dollars in the 5 years that lawsuit was going on. At that rate they can continue violating people's rights indefinitely, so I really don't see the difference.
The difference between "some" recourse and "no" recourse is not insignificant. It is exponentially harder to move the needle from "no recourse" to "some" than it is from "some" to "more."
Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#354The email sent to Amazon employees was a mistake. https://variety.com/2020/digital/news/amazon-bans-tiktok-emp...
Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#355Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#356Earlier quoted context omitted.
If any company expects me to access my work email while mobile, they have to provide a phone. I never mix work and personal. I've also never had a company say no to that.
Adding another anecdote, when I said I did not want to let work control my mobile phone, my boss told me I could figure out whether I wanted to keep the job or not
I personally just bought the cheapest $60-80 Android phone from a random Amazon seller.
Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#357Earlier quoted context omitted.
I don't think any mid-large company allows 2 anymore. Access to company resources always comes with an MDM policy.
I don't get why people are OK with a company being able to wipe a personal device on a whim. If you want full control of my mobile, then provide a mobile.
Of course most companies provide phones, but many users prefer to use their own, both for the benefit of having to carry only one, and because they have more choice.
Another big benefit of work profile is that you can switch all work stuff and notifications off with one click! I really like it overall, it gives great separation.
Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#358Earlier quoted context omitted.
I don't get why people are OK with a company being able to wipe a personal device on a whim. If you want full control of my mobile, then provide a mobile.
My understanding is that they can only wipe the work profile. Is that not true? (Android).
In other modes (COBO, COPE) it's not but those are much more difficult to enrol, as you have to do it from the setup wizard on a new phone or after a factory reset. So you don't happen to get into this mode by accident. They're only used for company owned phones (this is what the CO part stands for).
Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#359The email sent to Amazon employees was a mistake. https://variety.com/2020/digital/news/amazon-bans-tiktok-emp...
I suspect Amazon realized late what a legal mess it is to ban an app on their employee's cell phone when they have no clear legal basis or governmental guidance. They banned employee using Huawei phones when I was working there, for some things -- don't remember exactly. But in that case, US government already banned it for its employees, so there is precedence Amazon can claim as legal basis.
Re: Amazon says email banning TikTok from employee phones was ‘sent in error’
#360Earlier quoted context omitted.
Apple earns a lot of money from China, so difficult for them to do something which irritates the Chinese government. Google behaves the same way, even though they have no income from China right now, but I think they are secretly hopefully of dragonfly.
Dragonfly was canned after Google employees revolted. I'd be surprised if Google could even get a project like that resourced again without more leaks.
I think enough money can buy silence from a lot of people, plus it's clear google already has the tech, as they show a banner on every thing relating to covid (search results, YouTube) and do a quite impressive job at that. So I guess they can just tweak it for dragonfly, or even get their Chinese employees to do the tweak, since they already hire in China.
Once the growth slows, companies look for alternative revenue sources, like Apple is doing with services. The problem is that google has shown itself to be wildly incompetent at non engineering parts of their businesses other than search. e.g, Google cloud might be the only cloud to raise prices for anything so far(Google Kubernetes Engine price update)
It will be interesting to see what they choose. I don't think dragonfly can make them much money anyways, since Baidu too isn't making a lot of money in China.(When compared to how much Google makes in the US). I guess mostly due to closed mini app ecosystem on wechat, and probably a smaller internet eco system outside wechat.