Earlier quoted context omitted.
The sorry state of IOT security combined with V2V/V2X really worries me.
ever tried shutting down a botnet with wheels?
We'll just need to set an orange traffic cone on every hood, if Cruise is any indication.
Void captures over a million Android TV boxes
91–100 of 113 posts
Re: Void captures over a million Android TV boxes
#92Given the nature of some (most?) of the generic tv boxes running random AOSP, I would not be at all surprised if these didn’t ship with so basic C&C malware already installed. This was apparently found due to seeing some changed files, so they didn’t ship with void, but it wouldn’t have been hard to push it out to pre-comprised boxes.
Not sure why this is downvoted. It is well documented that most cheap android tv boxes have more or less the same trojan preinstalled. Is it due to malice of the manufacturer or most of them seemingly all taking the same pre-infected android base , who knows.
Linus Tech Tips made a full video on the subject. They seem to lean to the second option.
Re: Void captures over a million Android TV boxes
#93Earlier quoted context omitted.
Updates for Android continue to be a huge problem. Android OEMs have historically been terrible at releasing timely updates (it can take months), releasing updates at all (particularly cheap Android phones get EOLed long before an admittedly way more expensive iPhone would) and such updates aren't typically pushed in the same way. One big problem with Android is the way driver updates work. It's a nontrivial process…
> Updates for Android continue to be a huge problem. As is being pointed out elsewhere, this isn't a vulnerability in an "Android" product. These are TVs running vendor-maintained AOSP builds. They get updates when and how the vendor decides to do it. It's not related to the (fairly reasonable, though often spun) arguments about updates in the phone licensee ecosystem.
This is a distinction without a difference. It's not like you can take your Android hardware and move to a different software supplier. You're stuck with whatever your OEM chooses to do or not do.
It's also something you don't necessarily have knowledge of when you purchase a phone.
It's one reason why people (myself include) prefer Apple. You know you're going to get 4-5+ years of updates.
Re: Void captures over a million Android TV boxes
#94Earlier quoted context omitted.
It's easy to complain since they're the only manufacturer who opens up your car as an API
None of the issues I mentioned where discovered via API. The flash wear issue was discovered by bricked cars. Security researchers are pretty good at publishing about remote unlock mechanisms for all manufacturers, though Tesla's bounty program has helped. The UDS implementation issues are non user facing and were discovered by reverse engineering. Ford, as an interesting point of comparison, published a competent (i…
I wanted to say thank you, searching for that phrase[1] produced a ton of fascinating reading, including https://mpese.com/publication/uds_fuzzing/SAE_UDS_Paper.pdf "Comparing Open-Source UDS Implementations Through Fuzz Testing" from Apr 2024 which itself linked to a lot of GH repos of the tools they used
I didn't find the Ford one specifically, but I also didn't go surfing through the many pages of results
Re: Void captures over a million Android TV boxes
#95Earlier quoted context omitted.
Androids are less locked-down than iOS devices. The problem is that Google used to not have the ability to require long term support from device OEMs and now that it has the market power to demand long term support they seem reluctant to prioritize that in license agreements. Then there are devices, like in China, where Google Mobile Services is not on many phones so Google has no leverage at all re supporting update…
There is nothing in principle requiring Android phones be locked down, but its a de facto reality that manufacturers of almost all phones have made them locked down and you have to research to even know beforehand if you can even do something as little as a bootloader unlock or a rooting. Why is os and phone model so tightly integrated and locked together, when in the pc world you can generally install any os on any…
> Why is os and phone model so tightly integrated and locked together, when in the pc world you can generally install any os on any computer?
Qualcomm is the reason. Qualcomm wants OEMs to buy new chips every year, and for that to happen, consumers have to buy new phones every year. To upgrade Android (across kernel versions), OEMs need Qualcomm to provide updated drivers, which Qualcomm has been reluctant to do, because their sales will be undercut by chips they sold years ago. Android phones are closer to Mac than PCs, as there's one hardware-maker who determines which models become obsolete, and when, based on the software they choose to update (or not).
Re: Void captures over a million Android TV boxes
#96Earlier quoted context omitted.
> Updates for Android continue to be a huge problem. As is being pointed out elsewhere, this isn't a vulnerability in an "Android" product. These are TVs running vendor-maintained AOSP builds. They get updates when and how the vendor decides to do it. It's not related to the (fairly reasonable, though often spun) arguments about updates in the phone licensee ecosystem.
This is a distinction without a difference. It's not like you can take your Android hardware and move to a different software supplier. You're stuck with whatever your OEM chooses to do or not do. It's also something you don't necessarily have knowledge of when you purchase a phone. It's one reason why people (myself include) prefer Apple. You know you're going to get 4-5+ years of updates.
> This is a distinction without a difference.
No? For a licensed Android phone there's a clean split between OEM and OS updates, a clear declaration for support period and a OS-managed tracking of updates with clear visibility to the customer. I get that there are constant platforms flames about whether this is acceptable or inferior to Apple's offering, yada yada yada.
But the point is that none of that is relevant here, because these aren't phones and aren't running a licensed "Android" variant. They're just TVs running vendor-custom firmware that happens to be based on AOSP, and clearly can't be expected to conform to any update regime except whatever the integrator put together.
Basically, the story here is saying "I hacked product A" and you're trying to have an argument like "That's because this unrelated product B is bad". It's a non-sequitur.
Re: Void captures over a million Android TV boxes
#97Earlier quoted context omitted.
There is nothing in principle requiring Android phones be locked down, but its a de facto reality that manufacturers of almost all phones have made them locked down and you have to research to even know beforehand if you can even do something as little as a bootloader unlock or a rooting. Why is os and phone model so tightly integrated and locked together, when in the pc world you can generally install any os on any…
> Why is os and phone model so tightly integrated and locked together, when in the pc world you can generally install any os on any computer? Qualcomm is the reason. Qualcomm wants OEMs to buy new chips every year, and for that to happen, consumers have to buy new phones every year. To upgrade Android (across kernel versions), OEMs need Qualcomm to provide updated drivers, which Qualcomm has been reluctant to do, bec…
That's something that I've found really notable about Linux, compared to Windows. Windows drivers seem to work across versions, whereas binary Linux drivers are typically specific to a kernel minor release.
Does Microsoft just maintain broad kernel backward compatibility, or are driver authors doing more work to support more Windows versions? Is it a fundamental architecture difference with how each OS implements their kernel APIs?
Re: Void captures over a million Android TV boxes
#98This is the result of giving your Android TV WIFI access. Use it like a dumb monitor and such exploits go away.
These aren't monitors, they're little sticks with just an HDMI plug and microusb power you buy at the bogeda for $20. Android TV is an operating system name (often fake, some very outdated AOSP build, preinstalled with bootleg soccer streaming apps, and some skins/hacks/tweaks to make it look like the newest Android TV OS)
Re: Void captures over a million Android TV boxes
#99Earlier quoted context omitted.
> Why is os and phone model so tightly integrated and locked together, when in the pc world you can generally install any os on any computer? Qualcomm is the reason. Qualcomm wants OEMs to buy new chips every year, and for that to happen, consumers have to buy new phones every year. To upgrade Android (across kernel versions), OEMs need Qualcomm to provide updated drivers, which Qualcomm has been reluctant to do, bec…
That's something that I've found really notable about Linux, compared to Windows. Windows drivers seem to work across versions, whereas binary Linux drivers are typically specific to a kernel minor release. Does Microsoft just maintain broad kernel backward compatibility, or are driver authors doing more work to support more Windows versions? Is it a fundamental architecture difference with how each OS implements the…
Linux intentionally has an unstable driver ABI in part to make life a living hell for vendors who don't want to upstream their drivers.
Windows on the other hand maintains a very stable interface and has no desire to maintain vendor drivers.
Re: Void captures over a million Android TV boxes
#100Some of my hard requirements for a media device are that it must not share any of my personal information with any third party and it must fully cache the full-resolution and complete media content prior to beginning playback. If it's going to be connected to the Internet it must receive regular security updates for anything that's not written in a memory- and type-safe language like Go or Rust. While Go and Rust are…
Learn to set up vlans.
I use openwrt for my routers/switches, and when I first set up a "home jail" network, it was the best.
next step was to set up privoxy, so I could point devices at a proxy for updates, and privoxy could whitelist the machines to proxy to.