Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Void captures over a million Android TV boxes

news.drweb.com

Post reply on HN
Print view View original

51–60 of 113 posts

Re: Void captures over a million Android TV boxes

#51

Post by donkeybeer »

1oooqooq wrote: post #47

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a few years by now. In south america the median android version is 8. And phones are not optional as most countries already jumped into both digital government and money transfer.

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

Re: Void captures over a million Android TV boxes

#52

Post by photonthug »

There’s always one thread where we are discussing how everything needs to auto-update for security/stability forever, and another thread (currently crowdstrike) where that approach has caused the problem we wanted to avoid. Would be nice to see more discussion of this basic tension in the abstract since $current_issue is often just a distraction.

Auto updates also have a reputation for harming the user at least as often as helping (removing features, adding ads, whatever) and so trust in that is declining while the need for decent security (smart cars/homes) is increasing. Not sure what to conclude from this except that we need more focus on secure-by-design systems and maybe immutability guarantees rather than autoupdates, app stores, and plugin/extension frameworks but these things are sometimes impractical fundamentally and sometimes just inconvenient for surveillance capitalism.

Re: Void captures over a million Android TV boxes

#53

Post by ThatMedicIsASpy »

donkeybeer wrote: post #51
1oooqooq wrote: post #47

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a few years by now. In south america the median android version is 8. And phones are not optional as most countries already jumped into both digital government and money transfer.

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

It is the reason why I have Windows tablets not Android ones. I know there are OS updates. And once they are dead I have options for Linux tablets now.

Re: Void captures over a million Android TV boxes

#54

Post by ThatMedicIsASpy »

kuschku wrote: post #31
mrweasel wrote: post #24

> such devices often run on outdated Android versions, which have unpatched vulnerabilities and are no longer supported with updates. Many of them NEVER received a single update ever. There are so many shady companies producing TV boxes with no plan to ever provide any updates. Unless one of the larger brands make such a device, I don't see any reason to recommend anything but the ChromeCast or whatever Google calls…

Nvidia's SHIELD is also okay, probably better than Roku even so far.

Shields have the best upscalers and will always be the better option for media

Re: Void captures over a million Android TV boxes

#55

Post by 1oooqooq »

jmyeet wrote: post #50
1oooqooq wrote: post #47

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a few years by now. In south america the median android version is 8. And phones are not optional as most countries already jumped into both digital government and money transfer.

Updates for Android continue to be a huge problem. Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way. One big problem with Android is the way driver updates work. It's a nontrivial process…

Fuchsia was a backup plan.

Google is now the only option for phone manufacturers. No backup needed. Plan A worked.

Re: Void captures over a million Android TV boxes

#56

Post by happyopossum »

Given the nature of some (most?) of the generic tv boxes running random AOSP, I would not be at all surprised if these didn’t ship with so basic C&C malware already installed.

This was apparently found due to seeing some changed files, so they didn’t ship with void, but it wouldn’t have been hard to push it out to pre-comprised boxes.

Re: Void captures over a million Android TV boxes

#57

Post by wappieslurkz »

jmyeet wrote: post #50
1oooqooq wrote: post #47

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a few years by now. In south america the median android version is 8. And phones are not optional as most countries already jumped into both digital government and money transfer.

Updates for Android continue to be a huge problem. Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way. One big problem with Android is the way driver updates work. It's a nontrivial process…

May I ask what mobile OS you use?

Re: Void captures over a million Android TV boxes

#58

Post by F7F7F7 »

donkeybeer wrote: post #51
1oooqooq wrote: post #47

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a few years by now. In south america the median android version is 8. And phones are not optional as most countries already jumped into both digital government and money transfer.

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

Fragmentation used to be touted as a feature of Android, not a … well, you know.

“Freedom”, I believe they called it.

Also, hardware standardization in the PC world is pretty much a thing. Not so much in the mobile (and mobile offshoot) world.

Re: Void captures over a million Android TV boxes

#59

Post by TiredOfLife »

photonthug wrote: post #52

There’s always one thread where we are discussing how everything needs to auto-update for security/stability forever, and another thread (currently crowdstrike) where that approach has caused the problem we wanted to avoid. Would be nice to see more discussion of this basic tension in the abstract since $current_issue is often just a distraction. Auto updates also have a reputation for harming the user at least as of…

The problem with Crowdstrike was that they DID NOT TEST before release.

Re: Void captures over a million Android TV boxes

#60

Post by shakna »

ThatMedicIsASpy wrote: post #53
donkeybeer wrote: post #51

Earlier quoted context omitted.

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

It is the reason why I have Windows tablets not Android ones. I know there are OS updates. And once they are dead I have options for Linux tablets now.

Windows 8 stopped receiving updates in January last year, which killed my Surface for me.
Post reply on HN