Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google urges Android phone users to switch off Wi-Fi calling

scrippsnews.com

Post reply on HN
Print view View original

111–120 of 178 posts

Re: Google urges Android phone users to switch off Wi-Fi calling

#111

Post by mlyle »

ryukafalz wrote: post #43
mikepurvis wrote: post #21

Earlier quoted context omitted.

I guess, but it sure is nice that on Apple hardware you generally don’t need to worry about doing this calculus because they deliver updates in a timely manner to even five year old devices. It bums me out that them doing this hasn’t been effective in shaming everyone else into following suit.

The iPod Touch Gen 7 lasted just under 3 years from release. They may be better than many others but I just got bit by that one.

> The iPod Touch Gen 7 lasted just under 3 years from release.

It was released May 2019, and it just received its latest security update (15.7.3) January 23, 2023. Presumably that is not the last security update for iOS 15.

Re: Google urges Android phone users to switch off Wi-Fi calling

#112

Post by londons_explore »

prophesi wrote: post #65
arsome wrote: post #46

Earlier quoted context omitted.

Yes, it exists, but is it actively exploitable? A cursory search turns up no working exploit code. Given modern exploit mitigations many theoretical vulnerabilities turn out to be nothing-burgers, as far as I can see there's certainly no worm running around popping phones with it. For sure, if you're paranoid or a high-value target, update, buy a new phone. But normal users don't need to care unless there's actually…

Android's security advisory page shows what vulnerabilities have been found in the wild. Security researcher Maddie Stone from Google's Project Zero: https://twitter.com/maddiestone/status/1395004346996248586 Not sure what to say about encouraging users to throw caution to the wind. We got to this point of such good exploit mitigation because it's good for everyone for these devices to be secured.

I would like to see stats on what percentage of android phones were exploited in the wild for malicious purposes (ie. excluding cases where the user deliberately is jailbreaking them).

Personally I have never seen any friends or relatives get malware on their phone that gets outside the app sandbox (ie. Uninstalling the bad app seems to solve the issue). Compare that to MS Windows where it seems common for regular users to have malware infested systems.

Re: Google urges Android phone users to switch off Wi-Fi calling

#114

Post by cat_plus_plus »

Very nice for people who have reliable cell coverage at home and everywhere they go. I am not going to effectively disable my phone living on the hills, my family may need to reach me. Come up with a fix, VoLTE presumably goes through some server that can do data validation.

Re: Google urges Android phone users to switch off Wi-Fi calling

#115

Post by wodenokoto »

ggm wrote: post #87

This is extremely unhelpful headlinese 1) not all phones 2) chipsets in phones vary by where they are sold. 3) only exynos chipset phones are affected. in some economies. sold by some vendors. Not all models with a given name and code number (pixel 7, samsung 22) will be affected. "it depends" 4) not all manufacturers declare their chipset so 5) it is almost impossible for anyone but the cogniscenti to know if they a…

Given 5, it sounds pretty reasonable to recommend everyone to turn it off. Given 6, it sounds difficult to follow that advice.

Re: Google urges Android phone users to switch off Wi-Fi calling

#118

Post by ddod »

Four things of note:

1. I've not seen anyone explain whether this could be exploited by anyone with access to phone lines (i.e. Twilio users) or not and if it would be trivial to try the vuln with every phone number you could find in any DB. If those things are the case, it seems like the chances would be very high that this would be or has already been exploited and affecting every unpatched phone.

2. It seems like Project Zero mistakenly thought that Google devices were already patched when they made their announcement ("affected Pixel devices have received a fix"). Whoops! Thanks for giving attackers a heads up.

3. When contacting Google support (specifically Fi) multiple CS reps told me repeatedly this was all fake news and that Project Zero was unaffiliated with Google. They assured me there was no problem, and if there was a vulnerability, it would be communicated on the Fi website (which has no service status or security pages and has never published any outages or vulnerabilities in the past).

4. The delayed March update for Pixel 6 phones doesn't even show up when you open the software update panel (which shows a checking animation that I assume does nothing). You have to manually check again. Who knows when the folks who are unaware of this vulnerability will actually be prompted to install the patch.

Google have guaranteed at least one person and their family to never purchase another Google product or service.

Re: Google urges Android phone users to switch off Wi-Fi calling

#119

Post by jhoechtl »

22c wrote: post #107
ggm wrote: post #87

This is extremely unhelpful headlinese 1) not all phones 2) chipsets in phones vary by where they are sold. 3) only exynos chipset phones are affected. in some economies. sold by some vendors. Not all models with a given name and code number (pixel 7, samsung 22) will be affected. "it depends" 4) not all manufacturers declare their chipset so 5) it is almost impossible for anyone but the cogniscenti to know if they a…

It's also not crystal clear which Exynos chipsets are affected. I have a Samsung Galaxy S10e and a Samsung Galaxy S2 which both have Exynos chipsets, but I can't tell if there's simply no mention of these being affected because they're older models, or if it's explicitly only the newer models that are affected.

Just to be sure. A Samsung Galaxy S2? This phone is like 15? years old and still in use?

Re: Google urges Android phone users to switch off Wi-Fi calling

#120

Post by smaudet »

wodenokoto wrote: post #115
ggm wrote: post #87

This is extremely unhelpful headlinese 1) not all phones 2) chipsets in phones vary by where they are sold. 3) only exynos chipset phones are affected. in some economies. sold by some vendors. Not all models with a given name and code number (pixel 7, samsung 22) will be affected. "it depends" 4) not all manufacturers declare their chipset so 5) it is almost impossible for anyone but the cogniscenti to know if they a…

Given 5, it sounds pretty reasonable to recommend everyone to turn it off. Given 6, it sounds difficult to follow that advice.

This is exactly why kill switches an user-unlock-able boot-loaders should be the norm, not the exotic edge case.

Phones (as they are today) are a massive exercise in insecurity and privacy violation, to the point where they are actually banned in some settings.

Post reply on HN