Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google confirms Android attacks; no fix for most Samsung users

forbes.com

Post reply on HN
Print view View original

131–140 of 177 posts

Re: Google confirms Android attacks; no fix for most Samsung users

#131

Post by orbital-decay »

ActorNightly wrote: post #81
RadiozRadioz wrote: post #56

I'm really struggling to find any concrete information about what this vulnerability actually is. Does anyone know where to look for a good summary?

Search CVE numbers. https://www.cve.org/CVERecord?id=CVE-2025-48633 Basically, just like most things these days, its all just local privilege escalation. This means that you have to install/run an app that has these exploits built in. Soif you usage profile doesn't include downloading apps from untrusted sources, you don't need to worry.

In other words, if you ever need to install anything on your device, you do need to worry. What even could be trusted, a random app from Play Store?

Re: Google confirms Android attacks; no fix for most Samsung users

#132

Post by snailmailman »

rs186 wrote: post #100
freitasm wrote: post #59

Earlier quoted context omitted.

We have an OS security update that is only release to users of a specific hardware, once approved by their mobile operator. It may be added to vendor-specific OS versions some time later (weeks, month or never). The vendor-specific may not be approved by a telco if the vendor doesn't have a relationship with that telco. Now think that millions of people use the same OS on many different flavours, on different hardwar…

I never understood why a mobile operator has any say in when to apply security patches? Does it happen with iPhones?

Nope. When a new iOS update comes out, all supported devices may immediately install the update if they seek it out. Or it will usually auto update on its own, or at least nag the user to update.

It’s gotten slightly more confusing with the major updates now being optional. You get a choice between getting a feature update or just security patches. Unless I missed it, my phone never really asked me to update to the latest iOS 26. But I can, it’s there. I’m instead on the latest version of iOS 18. (They changed number schemes. 18 is last years major update)

Apple also does security updates for quite a long time. iOS 15, from 2021, got a security patch in September of this year, and works on the iPhone 6s from 2015.

Re: Google confirms Android attacks; no fix for most Samsung users

#133

Post by [deleted] »

darkwater wrote: post #96
School-Cotton wrote: post #48

Earlier quoted context omitted.

The beginning of the English word "fuchsia" is not pronounced like the German word Fuchs, so indeed the spelling does not match the pronunciation. This is independent of the fact that it comes from that word. Plenty of things in English (and, in fact, loanwords in every language) sound different from the words they're derived from; that doesn't mean trying to imitate the source language is the "right" pronunciation.…

> If you pronounce fuchsia like "fuksia" nobody will understand you. TIL and yet another case of "English is fucking weird".

[deleted]

Re: Google confirms Android attacks; no fix for most Samsung users

#134

Post by JohnTHaller »

defanor wrote: post #95
JohnTHaller wrote: post #80

Earlier quoted context omitted.

Google Pixel 7 and Pixel 7 Pro are still stuck on the October patches.

Pixel 6a used to show a September patch as the latest, but tapping "check for updates" found a new one. As mentioned in other comments here, apparently tapping those buttons twice may help.

I was clicking "Check for Updates" every few hours. Finally started working a bit ago.

Fun fact: Pixel 7 and Pixel 7 Pro didn't get a November update

Re: Google confirms Android attacks; no fix for most Samsung users

#136

Post by gucci-on-fleek »

JohnTHaller wrote: post #80
ptx wrote: post #68

Never mind the December security patches, Samsung haven't even released the November patches yet, the ones for the critical severity RCE. Unless you have a "major flagship model" [1], because apparently only the richest users deserve to be secure. [1] https://security.samsungmobile.com/securityUpdate.smsb

Google Pixel 7 and Pixel 7 Pro are still stuck on the October patches.

The December updates for Pixel 7 and Pixel 7 Pro are available to manually download on Google's website [0], so the updates do exist, although Google might not be rolling them out to the general public quite yet. But the December update for Pixel 7a are completely missing from that website, and trying to update from the Settings app also shows no updates available.

[0]: https://developers.google.com/android/ota

Re: Google confirms Android attacks; no fix for most Samsung users

#137

Post by chii »

homebrewer wrote: post #119
riedel wrote: post #98

Earlier quoted context omitted.

Why would you want security, if you get 'play integrity' for phones that received no updates since 2 years. Google's current security practices are more than dubious IMHO. Now they are not releasing any source for security patches for 3 month, to 'protect' vendors that are too slow updating. As if there is no chance for bad actors to reverse engineer those patch sets.

I have the strongest level of "Play Integrity" on a Xiaomi phone that hasn't received any updates since the beginning of 2020. Google Pay and co work fine. It makes sense when you remember that PI is not about security at all, that's just an excuse.

The "integrity" refers to googles bottomline!

Re: Google confirms Android attacks; no fix for most Samsung users

#139

Post by mschuster91 »

AnthonyMouse wrote: post #93
ifh-hn wrote: post #76

Earlier quoted context omitted.

Are apples drivers open source?

No. Which is why "the only exception is macOS" is also false. At some point Apple drops support for that model and then that hardware not only gets no more driver updates, because the whole system is tied to the rest of it, it gets no more updates at all. So the only exception is systems with open source drivers. Those are basically supported as long as the hardware architecture is and enthusiasts even have the optio…

My point is that with macOS, Apple writes the drivers which means at least as long as the hardware is supported you can be pretty sure that there will be prompt fixes for any issue. With Android, Windows or closed-source Linux drivers (cough NVIDIA) you're left entirely at the mercy of whoever made the tiny little component controlled by the driver to provide a fix, which then has to bubble up through the ODM/OEM until it finally appears in an update you can install.

If you want fast responses to driver bugs, you only have Apple or a fully open-source Linux systems as an option.

Re: Google confirms Android attacks; no fix for most Samsung users

#140

Post by TiredOfLife »

knorker wrote: post #122

Why anybody would buy a Samsung product at this point I don't understand. Every single Samsung product I've had to use is actively user hostile. Like a petty kind of hostile.

They are the only ones that makes phones with usable stylus.
Post reply on HN