“It’s advisable that you don’t install apps from non-trustworthy sources, ” Unpopular opinion but this is why I prefer walled garden apple for my family then alternative.
In case of 0-days, the Google play store is a non-trustworthy source.
Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
101–110 of 236 posts
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#102To me, the biggest part of this story is: 1. Over two years ago, this was apparently detected automatically by the syzkaller kernel fuzzer, and automatically reported on its public mailing list. [1] 2. Over a year and a half ago, it was apparently fixed in the upstream kernel. [2] 3. It was apparently never merged back to various "stable" kernels, leading to the recent CVE. [3] So you might read that and think "Ok, p…
The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things.
I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark and dismissiveness from the Linux team towards them and others. And GRSEC does actively bring in CVEs into their kernel patches all the time and get paid via sponsors to do so.
I'm sure going through old CVEs is a great way to find "zero days" and/or relapses after old patches. Or even just following the work GRSec does there's probably plenty of stuff for a highly motivated company like NSO to exploit.
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#103To me, the biggest part of this story is: 1. Over two years ago, this was apparently detected automatically by the syzkaller kernel fuzzer, and automatically reported on its public mailing list. [1] 2. Over a year and a half ago, it was apparently fixed in the upstream kernel. [2] 3. It was apparently never merged back to various "stable" kernels, leading to the recent CVE. [3] So you might read that and think "Ok, p…
The Linux kernel is a glaring example software malfunction due to its combination of moderate defect density and incredible extent, along with a culture intolerant of competence. People who became subsystem maintainers because they happened to be hanging around a mailing list in the 90s are still gatekeepers of important subsystems despite their now-decades-long records of continuous malfeasance. Patches that demonst…
it's fairly well known that small kmallocs do not fail, and that there are many, many instances in the filesystem code which assume that small kmallocs do not fail. there have been two LWN articles on this exact subject.
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#104Earlier quoted context omitted.
Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?
When you say 'authorities' that includes countries that persecute civil right activists. Amnesty International has specifically criticized NSO specifically regarding UAE activist Ahmed Mansoor. He is currently serving 10 years in jail. UN human rights experts considered his arrest and imprisonment "a direct attack on the legitimate work of human rights defenders". He was monitored by the UAE using NSO technologies. A…
This is supposed to justify putting millions of more people at an even larger risk of getting hacked?
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#105After the recent disclosures about Apple vulnerabilities, I've seen a lot of (unwarranted, in my opinion) criticism from HN of Project Zero, specifically the accusation of non-Google bias. For those who hold this position, does this affect your stance?
[deleted]
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#106> The researchers speculate the bug is being used by NSO, an Isreal-based group known to sell tools to authorities to exploit iOS and Android. > Due to evidence of in the wild exploit, we are now de-restricting this bug 7 days after reporting to Android. Why is this a good idea?
Well, Google are themselves the vendor here. Also seems it's fixed and this might encourage manufacturers to push out an update.
I just received an system update notification on my Galaxy S9. I can't help but wonder if it is related to this news.
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#107“It’s advisable that you don’t install apps from non-trustworthy sources, ” Unpopular opinion but this is why I prefer walled garden apple for my family then alternative.
The actual bug talks about "untrusted app code execution". As in, code in any app, regardless of where it was installed from. So you're relying on review by the walled garden as protection. And of course, "untrusted sources" is not the same as "all side-loading". I use sources to sideload from that I trust more than the average app developer.
Would you have trusted Epic?
https://www.pcmag.com/news/363357/google-irks-epic-games-by-...
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#108Earlier quoted context omitted.
The Linux kernel is a glaring example software malfunction due to its combination of moderate defect density and incredible extent, along with a culture intolerant of competence. People who became subsystem maintainers because they happened to be hanging around a mailing list in the 90s are still gatekeepers of important subsystems despite their now-decades-long records of continuous malfeasance. Patches that demonst…
it's fairly well known that small kmallocs do not fail, and that there are many, many instances in the filesystem code which assume that small kmallocs do not fail. there have been two LWN articles on this exact subject.
And goto being used for error handling is pretty stock standard across most C codebases I’ve worked on or seen over the years, so I’m not sure what the particular gripe is there
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#109Earlier quoted context omitted.
And your chance to share this complete control with every installed app. Phones should be like desktop computers. You install an app, you give it access to everything your account can touch on the computer.
Nobody would willingly run outdated, vulnerable software if there was an easy, direct, and supported way to root your phone. Sell phones locked for security or whatever, I couldn't care less, but give people the option to root when they want. So many iPhone users knowingly refuse to upgrade to newer versions of the operating system just so they can keep their jailbreak.
“Many” users?
Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access
#110Earlier quoted context omitted.
Absolutely not. It's an outdated concept from the days where all the software you run was either preinstalled or you created it yourself and the only security consideration was stopping you from messing up another users setup on the shared computer.
My desktop environment doesn't associate data with particular programs. Data is ideally in standard file formats and multiple programs can interact with it. I can see that tying data to a particular program may improve security, but it would also be extremely inconvenient.
Multiple programs can interact with data on iOS - but you have to explicitly give the app access to the file.