Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google urges Android phone users to switch off Wi-Fi calling

scrippsnews.com

Post reply on HN
Print view View original

131–140 of 178 posts

Re: Google urges Android phone users to switch off Wi-Fi calling

#131

Post by saagarjha »

ddod wrote: post #118

Four things of note: 1. I've not seen anyone explain whether this could be exploited by anyone with access to phone lines (i.e. Twilio users) or not and if it would be trivial to try the vuln with every phone number you could find in any DB. If those things are the case, it seems like the chances would be very high that this would be or has already been exploited and affecting every unpatched phone. 2. It seems like…

> Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker know the victim's phone number.

Re: Google urges Android phone users to switch off Wi-Fi calling

#132

Post by cookiengineer »

est31 wrote: post #22
jeffparsons wrote: post #4

Well, this was an awkward way to realise my phone hasn't been receiving security updates for years. Apparently Google quietly dropped support for it? The phone is otherwise in excellent condition. Any recommendations for a good third party OS that still supports Pixel 2?

I've been a (happy) Lineage OS user since 2013, and Pixel 2 is still supported by them, so you can check them out. But note that the security updates provided by Lineage OS only pertain to the Android part, not the modem part. This isn't something that a third party OS vendor can fix, as the modem/firmware updates are supplied by the device vendor. And even those are reliant on their suppliers, so ultimately unless t…

I am always diverged in my personal opinion about open source and the problems that come with it.

LineageOS has improved a lot over the years, and Android 12 (10+ with GSI images) finally has a working OTA update workflow.

But honestly, the "Android is not Android" problem is hard to communicate and endusers have so many pitfalls.

If you tell them "oh yeah I actually use RethinkDNS as an adblocker, combined with Fennec via F-Droid and its uBlock Origin extension that only somewhat works on mobile due to their messy UI" then you lost already 99% of users that will never figure out how to flash their device with the custom ROM, let alone understand what you just said.

It's so sad that you also have to tell them "but use only one of maybe 10 devices, all other Android devices are either totally outdated with their kernel or cannot be supported anymore"... and when I read your comment I kind of have to agree with your point.

iPhones have zero maintenance. It's a golden cage but it's a well built one, and most users just don't want to spend days and weeks learning how to maintain their smartphone.

Re: Google urges Android phone users to switch off Wi-Fi calling

#133

Post by saagarjha »

arsome wrote: post #67
prophesi wrote: post #65

Earlier quoted context omitted.

Android's security advisory page shows what vulnerabilities have been found in the wild. Security researcher Maddie Stone from Google's Project Zero: https://twitter.com/maddiestone/status/1395004346996248586 Not sure what to say about encouraging users to throw caution to the wind. We got to this point of such good exploit mitigation because it's good for everyone for these devices to be secured.

A bit silly to link a page about malware that Play Protect prevents, largely local privescs that are being detected by the OS or Google Play beforehand. An average user installing apps from Play Store has nothing to worry about for those. That's kind of the point. It's great for these devices to be patched - I'd love it if Google would take more control over the ecosystem to be able to patch this sort of thing, but i…

Google Play Protect has limited capabilities to protect against in-the-wild exploits of the kind Maddie described. It knows about certain packaged implementations, which means that it can offer some defense from off-the-shelf uses of an exploit, but it definitely does not reduce the risk to anywhere near zero. The only correct way to mitigate against exploits like this is a patch, end of story.

Re: Google urges Android phone users to switch off Wi-Fi calling

#134

Post by saagarjha »

londons_explore wrote: post #112
prophesi wrote: post #65

Earlier quoted context omitted.

Android's security advisory page shows what vulnerabilities have been found in the wild. Security researcher Maddie Stone from Google's Project Zero: https://twitter.com/maddiestone/status/1395004346996248586 Not sure what to say about encouraging users to throw caution to the wind. We got to this point of such good exploit mitigation because it's good for everyone for these devices to be secured.

I would like to see stats on what percentage of android phones were exploited in the wild for malicious purposes (ie. excluding cases where the user deliberately is jailbreaking them). Personally I have never seen any friends or relatives get malware on their phone that gets outside the app sandbox (ie. Uninstalling the bad app seems to solve the issue). Compare that to MS Windows where it seems common for regular us…

Generally the fraction is fairly low, because the bar for a full chain these days is pretty high. That said, it is important to not be lulled into a false sense of security because you don't seem like an attractive target. A chain worth $50k dollars can be a good purchase if you think you can bring in a million dollars home with it.

Re: Google urges Android phone users to switch off Wi-Fi calling

#135

Post by silisili »

flangola7 wrote: post #121
ddod wrote: post #118

Four things of note: 1. I've not seen anyone explain whether this could be exploited by anyone with access to phone lines (i.e. Twilio users) or not and if it would be trivial to try the vuln with every phone number you could find in any DB. If those things are the case, it seems like the chances would be very high that this would be or has already been exploited and affecting every unpatched phone. 2. It seems like…

I will still purchase Pixels because they isolate the modem.

If that were true, how could they be affected by a bug that allows full device compromise via the baseband?

Re: Google urges Android phone users to switch off Wi-Fi calling

#136

Post by ar9av »

Turning off VOLTE and WiFi calling on phones sold in the USA means using airplane mode - there is no VOLTE switch and most carriers in the USA no longer have 3G service anyway.

Edit: I mean Pixel phones sold in the USA, I'm not sure about the other ones on the list. My 6 Pro does not have a VOLTE toggle.

Re: Google urges Android phone users to switch off Wi-Fi calling

#137

Post by saagarjha »

mikepurvis wrote: post #77
ryukafalz wrote: post #43

Earlier quoted context omitted.

The iPod Touch Gen 7 lasted just under 3 years from release. They may be better than many others but I just got bit by that one.

That is unfortunate. Certainly the trend has been for them to lengthen the support window over time— see this article for a decent summary: https://www.macworld.com/article/675021/how-long-does-apple-... I wonder if Apple views the "iPod" branding as being more associated with gaming and consumption and therefore less important from a security standpoint. I don't think I necessarily would agree with such a stance whe…

No, it's more that Apple has always released iPod with older chips, and in this case it also decided to discontinue that product line, which meant that they dropped software support for it relatively soon.

Re: Google urges Android phone users to switch off Wi-Fi calling

#138

Post by prmoustache »

jhoechtl wrote: post #119
22c wrote: post #107

Earlier quoted context omitted.

It's also not crystal clear which Exynos chipsets are affected. I have a Samsung Galaxy S10e and a Samsung Galaxy S2 which both have Exynos chipsets, but I can't tell if there's simply no mention of these being affected because they're older models, or if it's explicitly only the newer models that are affected.

Just to be sure. A Samsung Galaxy S2? This phone is like 15? years old and still in use?

I guess with battery replacement over the years it could still be usable as a dumb phone.

Re: Google urges Android phone users to switch off Wi-Fi calling

#139

Post by saagarjha »

jeffparsons wrote: post #70
arsome wrote: post #42

Earlier quoted context omitted.

Not really - Android has for many versions now been updating the embedded webview component via play services.

Huh, that's somewhat comforting, I guess. And all image codecs etc. are statically linked?

Many are. However, you'd still be vulnerable via API calls to other things, like Binder exploits.

Re: Google urges Android phone users to switch off Wi-Fi calling

#140

Post by Arch-TK »

ggm wrote: post #87

This is extremely unhelpful headlinese 1) not all phones 2) chipsets in phones vary by where they are sold. 3) only exynos chipset phones are affected. in some economies. sold by some vendors. Not all models with a given name and code number (pixel 7, samsung 22) will be affected. "it depends" 4) not all manufacturers declare their chipset so 5) it is almost impossible for anyone but the cogniscenti to know if they a…

I believe the VoLTE toggle's presence is controlled by whether there is any fallback from VoLTE. Apparently a substantial number of carriers don't offer anything other than VoLTE at this point. Turning off VoLTE when you are with an affected carrier is equivalent, at that point, to just turning off calls altogether.
Post reply on HN