Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Samsung’s Android app-signing key has leaked, is being used to sign malware

arstechnica.com

Post reply on HN
Print view View original

11–20 of 134 posts

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#11

Post by ThrowawayTestr »

mattl wrote: post #7
kyrra wrote: post #6

Fyi, this is related to the story from 2 days ago: https://news.ycombinator.com/item?id=33823946 An important comment from the original story: > OEMs have mitigated the issues above in previous updates. A new security update from Android is not required to mitigate these issues. Ensuring your device is running the latest version of Android is a general best security practice for users. Though the ars story says Samsu…

It’s my understanding that most Android devices don’t get OEM updates for very long

My S9 was getting updates as late as a few weeks ago.

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#12

Post by largepeepee »

I don't get it, the problem has been known for awhile so why hasn't the key been replaced?

Anyone can do a ELI5 on the app signing key replacement difficulty?

It isn't covered in the article and seems too high level for a layman like me.

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#13

Post by FeistySkink »

ThrowawayTestr wrote: post #11
mattl wrote: post #7

Earlier quoted context omitted.

It’s my understanding that most Android devices don’t get OEM updates for very long

My S9 was getting updates as late as a few weeks ago.

What's the latest security update? I just checked S9 I have in a drawer and it's from March 2022.

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#15

Post by themoonisachees »

brookst wrote: post #10
danuker wrote: post #3

It could also mean people signing their own firmware and freeing those devices.

It’s an app signing key. I don’t think it will work for firmware. But I’m not sure. Can someone more knowledgeable about Android’s chain of trust chime in?

Signing your app using this key would allow you to name your app system.uid.android, effectively giving you root for free. You probably won't be able to sign firmware in the Linux sense of the word, but in android world "firmware" is loosely defined and is often used to talk about the android ROM.

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#17

Post by dontbenebby »

carl_dr wrote: post #4

> “Samsung takes the security of Galaxy devices seriously. We have issued security patches since 2016 upon being made aware of the issue“ They’ve known about it since 2016!?!

Who's in charge of certificate stuff in these situations?

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#18

Post by gjsman-1000 »

neodymiumphish wrote: post #9
everyone wrote: post #5

I mean considering the level of shitware samsung install on their phones (and make difficult to remove or disable) it will be hard to tell the difference between the official stuff and straight up honest malware.

I used to feel that way, but since the S10 series, there are very few things built into the Galaxy line that fall in the description of shitware anymore. McAfee's device protection shit definitely, but other than that, I can't think of any forced crapware on my last 3 unlocked Galaxy devices.

You are lucky to have an Unlocked device. Most people don’t and get the carrier’s kitchen sink of added bloat.

Re: Samsung’s Android app-signing key has leaked, is being used to sign malware

#20

Post by hnra »

neodymiumphish wrote: post #8
mattl wrote: post #7

Earlier quoted context omitted.

It’s my understanding that most Android devices don’t get OEM updates for very long

This is true in the sense that most android devices are small/cheap off brand or Chinese devices sold across low-income markets, like Africa and the Middle East. Any mid- or top-tier Android devices, such as Pixels and Galaxy devices which compete directly with Apple, are usually on a monthly security update cadence for at least 3 years.

3 years of support sounds like the bare minimum you can expect, and that is what the most expensive brand offer?
Post reply on HN