Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

community.rapid7.com

Post reply on HN
Print view View original

151–160 of 232 posts

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#151

Post by xorcist »

blocke wrote: post #97
autism_hurts wrote: post #51

Earlier quoted context omitted.

You're not the only one. I'm sorry, but the Android issue has devolved into a holy war but... .. support is terrible on the Android side. Really terrible.

People need to stop buying terrible phones. Consumers keep rewarding companies who don't keep up with their promises and thus no one ends up giving a crap. In my opinion if you're not going to buy a Nexus device or a Moto E/G/X then you might as well buy Apple. The Android One program will hopefully add more to that.

But the Nexus devices are just as bad as the others. If you had bought the latest model last year you'd be screwed on updates by now.

I'd love to buy an iPhone but I want to run Android software so Android it is.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#152

Post by ClashTheBunny »

joev_ wrote: post #75
seccess wrote: post #33

Does anyone know if WebView is similarly susceptible?

I wish I had tested this sooner, but yes, Webview is vulnerable (use document.write(document.domain) instead of alert() to test). So afaict apps that embed webview/ads on < 4.4 are at risk.

How would this be exploited? Can you read the contents of a webview in another process? Your users would have to navigate somehow to an exploited page (via an ad)?

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#153

Post by NickNameNick »

gsnedders wrote: post #89
mbq wrote: post #78

Earlier quoted context omitted.

Just switch to CyanogenMod or other custom compilation; there is a gain from Nexus brand in the ease of unlocking bootloader (;

I'm not convinced CyanogenMod (or any other variant) is actually that great; I have a Samsung Galaxy S2 (i9100 model), the last non-nightly CyanogenMod update was over a year ago now. There have been a number of CVEs issued for Android (and likely numerous others cover Android as a platform, covering OpenSSL for example) over that time period, so there's no way the phone is anywhere near up-to-date with security fixe…

It looks like there were snapshot builds in august and july. (although how they differ from nightlies, I don't know) I thought I was on a snapshot from April, but it turns out I'm on a nightly.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#154

Post by sucramb »

TD-Linux wrote: post #71
yeahforbes wrote: post #22

Earlier quoted context omitted.

I have a browser called InBrowser and it gives an alert on your test page. Maybe it wraps AOSP? I don't have "Browser" in my list of apps though, it came with Chrome instead and I installed InBrowser myself. (Android 4.1.2)

Almost all third-party browsers on the Play Store wrap the Android WebView, which is vulnerable. You'll need to use a browser that includes its own rendering engine, such as Firefox, to remain secure.

The Android WebView uses since quite some time the same rendering and javascript engines as Chrome. Thus I would expect third party browsers to be no more vulnerable with regard to this bug than Chrome.

Edit: since 4.4 [https://developer.chrome.com/multidevice/webview/overview]

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#155

Post by allegory »

girvo wrote: post #83
allegory wrote: post #10

It's this sort of thing that puts me off Android as a platform. Even my mother got sold a 2.2 handset recently (Samsung Galaxy Ace) that hasn't been patched for the best part of 3 years. You never know when you're going to end up with a lemon on your hands. Big jump to this conclusion but I'm more inclined to trust Microsoft at the moment as they have a better reputation for lifetime (unlike Android), have a very pub…

Microsoft may update their older devices (well, once we moved to WP8 anyway, WP7 can go jump apparently), but my girlfriend's HTC 8X is half broken because her carrier refused to let the update go through. Absolutely frustrating... that's one thing I am happy about with my 4S, for sure. Screw carriers.

WP7 was a different OS (CE vs NT kernel). The NT kernel wasn't portable to a couple of the SoC's they used on those devices. I suspect that's why it went and jumped.

You're right though about carriers. I always buy non-carrier locked devices here in the UK for that precise reason. Nokia sell "country variant" devices which are usually updated first.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#156

Post by allegory »

kllrnohj wrote: post #132
jamesisaac wrote: post #112

Earlier quoted context omitted.

The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies? Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartph…

> The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies? It became beyond the expected lifespan when it became normal to buy a new one every 2 years thanks to contract pricing and carriers pushing people to upgrade.

That works apart from in Europe. We do a lot of non contract pay as you go stuff where the handset may last 4-5 years. I have a couple of Nokias that are still good after 8 years and Microsoft have a 11-12 year lifecycle for desktop OS for example.

2 years is just a cost cutting exercise and inexcusable.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#157

Post by allegory »

wernercd wrote: post #122
jamesisaac wrote: post #112

Earlier quoted context omitted.

The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies? Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartph…

Since when has anything over 2 years, for a phone, had support? Anything over that is the exception, not the rule. Apple has better support than most, but even their phones degrade with features missing on older phones AND included new features run like ass (every time my fiance upgrades old phone to new iOS she hate life until upgrade). A 2 year old phone really is ancient... much less three or four... Who actually…

My 2 year old Lumia 820 just got Windows Phone 8.1 and is as good as new in every way even though it has been dropped hundreds of times. It's getting the next 8.1 update next month as well.

That's what I expect.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#158

Post by allegory »

judk wrote: post #134
jamesisaac wrote: post #112

Earlier quoted context omitted.

The Galaxy Nexus was released only 3 years ago. Since when was that beyond the expected lifespan of a flagship product from one of the world's largest tech companies? Don't think I've ever owned anything with such a serious planned obscolence issue. Windows supports its OS releases for 12 years (and doesn't lock you in, so you can usually follow official upgrade procedure anyway). And anything "dumber" than a smartph…

The GN wasn't planned obsolescence so much as "Google doesn't actually own the hardware, so they can't update drivers"

Do the drivers need updating? There is a kernel ABI and API that should isolate that from the rest of the OS so the OS should continue to evolve.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#159

Post by scintill76 »

hamburglar wrote: post #143
fencepost wrote: post #56

Replaced by Chrome ("that giant hog"). I'm on a slightly older phone, but I actually removed Chrome from it not long ago. I started having problems with updating apps due to insufficient space, and while I have a fair amount of crap installed, I also have ~2.5GB of "Phone" storage for apps so I started investigating (this is separate from "sdcard" data storage which is ~8GB). Turns out Chrome, at least on the HTC Ama…

I guess I'm going to be forced to switch to Chrome now for safety's sake, but I've been avoiding it because it has some major usability problems that Android Browser doesn't. In particular, not reflowing a web page when you zoom in is infuriating because I invariably end up zooming in order to be able to read an article, then I have to pan side to side for every line of text. Font sizing is bizarre too. Web pages sud…

> Font sizing is bizarre too. Web pages suddenly have font sizes increasing and decreasing seemingly at random, and to the point of illegibility

I haven't tried Chrome, but I see this in CyanogenMod's stock browser (probably close to AOSP) and Firefox. In Firefox's case at least, my research pointed to "font boosting" being the cause of increasing/decreasing, but I haven't found a good fix.

Re: Major Android Bug Is a Privacy Disaster (CVE-2014-6041)

#160

Post by hnha »

megablast wrote: post #116
hnha wrote: post #65

Earlier quoted context omitted.

I am running out of space because Play Store and Google Framework get bigger and bigger. It fills me with rage how Google actively makes my old phone less capable over time for no benefit to me.

Don't get too raged, this has been happening on almost every computer for the last 20 years. The more you use it, there more there is to store, the more apps you use, the more data is placed everywhere.

That's not what I said. I actually use my phone less as I found the apps and data I "need". Google is forcing software updates (silently even!) that leech away significant amounts of space away from me.
Post reply on HN