Live data from Hacker News

More Than 1M Google Accounts Breached by Gooligan

blog.checkpoint.com

141–150 of 183 posts

Re: More Than 1M Google Accounts Breached by Gooligan

#141
post #99

Earlier quoted context omitted.

Google in most cases is not the device's manufacturer, and in a mobile device OS and application SW are tightly coupled, so you cannot really have OS updates separate from firmware updates, bypassing the actual manufacturer's own updates. Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own, and actually it is one of the selling points of their new phone. In additi…

> and in a mobile device OS and application SW are tightly coupled I call bullshit. There's no reason Google can't update everything AOSP-y in /system - libc, libart, libwebkit etc. > Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own That's a low bar. When you buy a Dell laptop, you continue to receive updates from Microsoft. This is the bar we should hold Googl…

Except it's not that simple in the Android world. Someone explained it really well a couple days ago: https://news.ycombinator.com/item?id=13057605

The basics are that every phone out there uses a forked Linux kernel patched to hell to get it working. Since none of the drives are upstreamed it's unmaintainable.

The linux kernel does not have a stable driver interface so shipping updates to phones is a LOT of work.

Re: More Than 1M Google Accounts Breached by Gooligan

#142
post #90

Earlier quoted context omitted.

Checkpoint has been notorious for this kind of exaggerated marketing, especially within the past few years. My theory is that their security appliance line has been suffering due to superior competitors (source: personal experience; could be wrong without global sales numbers), so I think they're trying to get their name back in people's minds. This research is definitely good and beneficial, but yes, it's threat int…

Years and years ago I went out searching for UMD devices vulnerable to CSRF. They universally were, but the only vendor that responded to my email was CheckPoint, who admitted it and said they were working on a fix. (They had the fix released soon, too.) Everyone else was 100% silent treatment.

What % of the devices you tested were security appliances? It's good Checkpoint did that, but you would expect most security companies to care a lot more about patching their devices relative to all of the other various network device manufacturers out there.

Re: More Than 1M Google Accounts Breached by Gooligan

#143

Earlier quoted context omitted.

I do not, just wanted to throw a couple that I know of out there. Hopefully neither of those third party stores because I like and use them both. I hope it was clear from the question marks in my post that those were just examples, certainly don't want to smear either one.

If you're going to name app stores, I would think places like Baidu would be more likely, given their size and popularity with users of lower-tier Android devices.

Agreed, however until you posted this, I didn't know Baidu had an app store.

Re: More Than 1M Google Accounts Breached by Gooligan

#144
post #78

Earlier quoted context omitted.

Funny, I use exactly the same apps on my Cyanogenmod phone - K9 + Fastmail, OSMAnd. There arnt that many good alternatives to Google, apparently. The only thing I'm still missing is public transit navigation. I do have the Play Store installed though - through OpenGApps pico - I only have the Play Store, none of the other Google stuff - with a dummy gmail account.

My city has a transit app they maintain, but I'm afraid that'll stop if Google gets too ubiquitous in this area. It's really too bad that information that should be released as clean openData sets is so difficult to acquire and parse easily. Really should be some regulation around what, how and how often public information should be published and maintained.

[deleted]

Re: More Than 1M Google Accounts Breached by Gooligan

#145
post #115

Earlier quoted context omitted.

It requires manual interaction and obviously not scalable.

It's pretty easy to automate an email harvester. Then again just @(gmail|yahoo|hotmail).com works for a lot of people.

I'm convinced adding my middle initial to my email has been the most effective spam prevention technique I've implemented.

Re: More Than 1M Google Accounts Breached by Gooligan

#146

Earlier quoted context omitted.

Google have an approval system before they allow a manufacturer to bundle Google services. Update mechanisms could easily be built into that approval process. I suspect that they haven't turned the screws too hard on manufacturers for fear of Samsung or LG making an Amazon-style fork. Google have already drawn their own roadmap with the Android One project - a number of low-end manufacturers have devices that get upd…

Exactly. Apple only has one set of hardware to support. Microsoft support the PC platform and you can usually do a fresh install on any machine and it will boot (driver support is a little different). Android is garbage in this regard. Google binds everyones' feet with the OHA so they are required to use the Google Play Store and services (and they can also never manufacture Amazon devices) yet they don't standardize…

> Part of this is the difficulty of ARM not really being an architecture, but even Microsoft was able to deal with this by requiring UEFI and some standardization on Windows devices (although they're more like Apple where there's limited hardware to support).

Well, the reason why PCs are a standardized platform is because the industry was built around cloning the AT. If anything wanted to be successful, it had to do everything the AT did the way the AT did it. Once the AT started getting long in the tooth, the industry got together to agree on further standards like the ISA bus (an extended version of the AT's bus), various ATA storage standards (again, derivative of the AT's storage protocol), the ATX form factor, the PC System Design Guide (PC 97/98/99/2001), etc.

The PC industry has a culture of working together and collaborating for the sake of compatibility. For part of this, Intel was involved with the standardization process (something ARM refuses to do), but even they didn't have the full authority to force anyone to adopt their standards. In fact, there were plenty of manufacturers of x86 machines who decided to skip out on PC compatibility entirely in order to do their own thing. Just go ahead and try to install Windows 3.1 on a WonderSwan, for example. It's x86, but not a PC or any kind of AT clone. The industry simply declined to see it as a PC and moved on.

It's a shame that nobody in the phone industry every attempted a hardware standardization effort. Google and Qualcomm could've worked together to come up with some real standards, but they dropped the ball.

I have to wonder if Google would've been able to force something through if they made Android run entirely on native code instead of shoving everything into a Java-based VM. If the industry couldn't take the shortcut of "let's just port Dalvik to our hardware and call it a day" and instead had to ensure compatibility for a wide array of native software, they might actually have developed some form of collaborative discipline.

What Google needs to do now is collaborate with Qualcomm and come up with their own standardized hardware platform. Create a phone equivalent to PCI, ATX, PC 98, etc. And then refuse to license Android to any device that isn't built on this platform. They should complete the process of moving AOSP into GApps, replace the Linux kernel with a closed-source BSD derivative, and then announce the closure of AOSP. They should do with Android exactly what Microsoft does with desktop Windows.

Re: More Than 1M Google Accounts Breached by Gooligan

#147
post #101
post #91

Earlier quoted context omitted.

I'm not exactly a fan of those, but I think MS is already doing that with UWP, which apps weren't exactly greeted with rejoice.

UWP apps can't be run outside of the MS store. So that's the lock-in he was talking about. It would be nice if Microsoft enabled "mini-VMs" for legacy x86 apps at least. That way it could shoot two birds with one stone - make x86 apps a little slower and more resource intensive, and thus give both users and developers a reason to switch to UWP, while at the same time it would also make legacy x86 apps vastly more sec…

Windows 10 allows you to turn on sideloading. Going through the Windows Store is no longer a requirement.

Re: More Than 1M Google Accounts Breached by Gooligan

#148
post #106

The difference between iOS and android could not be more clear in this regard. It's interesting to see the difference in security between the two. It's night and day. Google has some serious problems to address. But it seems like they don't care. Their track record is deplorable regarding android security. Is this really the best google can do?

Most android isn't stock and there are a ton of old versions out there so it's a little apple to oranges. I think if you would have a phone created by google and keep it up to date it would probably be pretty secure.

Re: More Than 1M Google Accounts Breached by Gooligan

#149
post #141

Earlier quoted context omitted.

> and in a mobile device OS and application SW are tightly coupled I call bullshit. There's no reason Google can't update everything AOSP-y in /system - libc, libart, libwebkit etc. > Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own That's a low bar. When you buy a Dell laptop, you continue to receive updates from Microsoft. This is the bar we should hold Googl…

Except it's not that simple in the Android world. Someone explained it really well a couple days ago: https://news.ycombinator.com/item?id=13057605 The basics are that every phone out there uses a forked Linux kernel patched to hell to get it working. Since none of the drives are upstreamed it's unmaintainable. The linux kernel does not have a stable driver interface so shipping updates to phones is a LOT of work.

[deleted]

Re: More Than 1M Google Accounts Breached by Gooligan

#150

Earlier quoted context omitted.

Exactly. Apple only has one set of hardware to support. Microsoft support the PC platform and you can usually do a fresh install on any machine and it will boot (driver support is a little different). Android is garbage in this regard. Google binds everyones' feet with the OHA so they are required to use the Google Play Store and services (and they can also never manufacture Amazon devices) yet they don't standardize…

> Part of this is the difficulty of ARM not really being an architecture, but even Microsoft was able to deal with this by requiring UEFI and some standardization on Windows devices (although they're more like Apple where there's limited hardware to support). Well, the reason why PCs are a standardized platform is because the industry was built around cloning the AT. If anything wanted to be successful, it had to do…

>What Google needs to do now is collaborate with Qualcomm and come up with their own standardized hardware platform. Create a phone equivalent to PCI, ATX, PC 98, etc. And then refuse to license Android to any device that isn't built on this platform. They should complete the process of moving AOSP into GApps, replace the Linux kernel with a closed-source BSD derivative, and then announce the closure of AOSP. They should do with Android exactly what Microsoft does with desktop Windows.

Making Android closed source won't do anything. Unless you're using Fire, all Android manufacturers in the US are not getting their code through AOSP. They get it through a side license with Google.

The problem is not that Google can't force security, it just doesn't want to.

Post reply on HN