Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Void captures over a million Android TV boxes

news.drweb.com

Post reply on HN
Print view View original

61–70 of 113 posts

Re: Void captures over a million Android TV boxes

#61

Post by donkeybeer »

F7F7F7 wrote: post #58
donkeybeer wrote: post #51

Earlier quoted context omitted.

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

Fragmentation used to be touted as a feature of Android, not a … well, you know. “Freedom”, I believe they called it. Also, hardware standardization in the PC world is pretty much a thing. Not so much in the mobile (and mobile offshoot) world.

Fragmentation is not the problem. The problem is inability to change os or firmware. If control of upgrading or changing os wasn't solely with the maker there wouldn't have been an issue in the first place. I bet for example many of these bugs might be due to the much older linux kernels in use in phones. Again something easily solved by making the os easily changeable and not presenting cryptographic etc roadblocks to reverse engineering, if they don't even want to open source the firmwares at least. At the end of the day these are software bugs not hardware bugs, so the solution as with any software is to be able to push fixes. It does not matter if there are a million different Android phone platforms, a fix to some bug in the Linux kernel for example should work the same on all of them. More importantly, as a piece of pure software this should be something anyone working on Linux or Android should be able to fix as happens in the more sane world of laptop, server etc hardware. If we weren't locked to the manufacturer for all operating system and software support this won't be a problem in the first place. Imagine how ridiculous it'd be if we had a Dell XPS 13 OS, a Lenovo Thinkpad T14 OS etc that went out of support the moment the model is discontinued instead of the sane and normal situation where your Debian or whatever os continues receiving software updates as long as Debian wants to support it.

Re: Void captures over a million Android TV boxes

#62

Post by donkeybeer »

F7F7F7 wrote: post #58
donkeybeer wrote: post #51

Earlier quoted context omitted.

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

Fragmentation used to be touted as a feature of Android, not a … well, you know. “Freedom”, I believe they called it. Also, hardware standardization in the PC world is pretty much a thing. Not so much in the mobile (and mobile offshoot) world.

And honestly I doubt 99.9% of these attacks are anything hardware specific but rather generic software bugs like buffer overflows in the kernel, so hardware is in any case a moot point.

Re: Void captures over a million Android TV boxes

#63

Post by tzs »

poikroequ wrote: post #37
MarcusE1W wrote: post #32

Earlier quoted context omitted.

That makes me think, will we have car theft in the future where someone hacks your self driving car and it makes off on itself in the night? The next day you wake up to notice that your car has left you for someone else?

Self driving cars aren't fully autonomous yet. They occasionally require human intervention to make decisions, which I would guess makes it difficult to steal these cars without being detected. They're constantly cloud connected and so they know where the car is at all times. I imagine these factors may deter theft of self driving cars for a while longer. Repossessing a self driving car, on the other hand...

The plan when having a self driving car help you steal it would not be to have it self-drive from the owner's home in, say, San Francisco, to a chop shop in Tijuana where you gang awaits, thus requiring it to make a long trip without human intervention.

It would be have it self-drive from the owner's home to someplace nearby not associated with the the thieves to get it out of sight from the owner's security cameras and whatever other security cameras in the neighborhood might be watching where the gang can disable the cloud connection and then transport it by truck or driving it in manual mode to their chop shop.

Re: Void captures over a million Android TV boxes

#64

Post by tannhaeuser »

jmyeet wrote: post #50
1oooqooq wrote: post #47

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a few years by now. In south america the median android version is 8. And phones are not optional as most countries already jumped into both digital government and money transfer.

Updates for Android continue to be a huge problem. Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way. One big problem with Android is the way driver updates work. It's a nontrivial process…

> Windows is way more stable than it was 20 years ago.

The problem with Windows today is more that it wants to opaquely update itself all the time, and the user gets undesired mandatory "updates" such as ads in menus and sending "telemetry" home (ie user activity data for MS' machine learning ambitions). But of course the most important thing is to keep fucking web browsers up-to-date with laughable and undesired CSS or WASM features (including subsequent exploit/fingerprinting fixes) all the time and even more often than actual content, or what's left of it anyway on the extant web.

Re: Void captures over a million Android TV boxes

#65

Post by afavour »

donkeybeer wrote: post #51
1oooqooq wrote: post #47

> such devices often run on outdated Android versions, Ah the new economical divide. Most "real people" also have phones which aren't receiving updates for a few years by now. In south america the median android version is 8. And phones are not optional as most countries already jumped into both digital government and money transfer.

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

The problem is that the “self” in that statement is not the consumer. They have no choice, yet the bear the burden. The people who made these choices benefit from it.

Re: Void captures over a million Android TV boxes

#66

Post by ajross »

TiredOfLife wrote: post #12

It's not Android TV boxes. It's TV boxes running Android.

So distressing to see this so far down. In fact "Android TV" is an OS product, and not related to this exploit. These are televisions that simply run "Android" as in an open source AOSP build unrelated to a Google product certification.

Re: Void captures over a million Android TV boxes

#67

Post by afavour »

tannhaeuser wrote: post #64
jmyeet wrote: post #50

Earlier quoted context omitted.

Updates for Android continue to be a huge problem. Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way. One big problem with Android is the way driver updates work. It's a nontrivial process…

> Windows is way more stable than it was 20 years ago. The problem with Windows today is more that it wants to opaquely update itself all the time, and the user gets undesired mandatory "updates" such as ads in menus and sending "telemetry" home (ie user activity data for MS' machine learning ambitions). But of course the most important thing is to keep fucking web browsers up-to-date with laughable and undesired CSS…

This just reads as a grab bag of complaints about modern tech with little relevance to the topic at hand

Re: Void captures over a million Android TV boxes

#68

Post by donkeybeer »

afavour wrote: post #65
donkeybeer wrote: post #51

Earlier quoted context omitted.

Its a self created problem of locked down user hostile devices. Operating system and software upgrades are not locked to the hardware manufacturer in the laptop world (not yet, for the most part). It is a pipe dream of mine that someday these attacks are used as an excuse by some government perhaps the EU to force opening up devices for install of other operating systems, maybe forced to open sourcing firmware etc.

The problem is that the “self” in that statement is not the consumer. They have no choice, yet the bear the burden. The people who made these choices benefit from it.

By "self" I meant the manufacturers of the device, not the end user.

Re: Void captures over a million Android TV boxes

#69

Post by beastman82 »

kuschku wrote: post #31
mrweasel wrote: post #24

> such devices often run on outdated Android versions, which have unpatched vulnerabilities and are no longer supported with updates. Many of them NEVER received a single update ever. There are so many shady companies producing TV boxes with no plan to ever provide any updates. Unless one of the larger brands make such a device, I don't see any reason to recommend anything but the ChromeCast or whatever Google calls…

Nvidia's SHIELD is also okay, probably better than Roku even so far.

I've had my shield for nearly a decade, gotten updates the whole time. Much faster and better than Roku in basically everything

Re: Void captures over a million Android TV boxes

#70

Post by secondcoming »

tannhaeuser wrote: post #64
jmyeet wrote: post #50

Earlier quoted context omitted.

Updates for Android continue to be a huge problem. Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way. One big problem with Android is the way driver updates work. It's a nontrivial process…

> Windows is way more stable than it was 20 years ago. The problem with Windows today is more that it wants to opaquely update itself all the time, and the user gets undesired mandatory "updates" such as ads in menus and sending "telemetry" home (ie user activity data for MS' machine learning ambitions). But of course the most important thing is to keep fucking web browsers up-to-date with laughable and undesired CSS…

Ubuntu and Debian both have unattended-uogrades running by default
Post reply on HN