Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

More Than 1M Google Accounts Breached by Gooligan

blog.checkpoint.com

Post reply on HN
Print view View original

161–170 of 183 posts

Re: More Than 1M Google Accounts Breached by Gooligan

#161

Post by mortehu »

kyrra wrote: post #141
archivator wrote: post #122

Earlier quoted context omitted.

> and in a mobile device OS and application SW are tightly coupled I call bullshit. There's no reason Google can't update everything AOSP-y in /system - libc, libart, libwebkit etc. > Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own That's a low bar. When you buy a Dell laptop, you continue to receive updates from Microsoft. This is the bar we should hold Googl…

Except it's not that simple in the Android world. Someone explained it really well a couple days ago: https://news.ycombinator.com/item?id=13057605 The basics are that every phone out there uses a forked Linux kernel patched to hell to get it working. Since none of the drives are upstreamed it's unmaintainable. The linux kernel does not have a stable driver interface so shipping updates to phones is a LOT of work.

This doesn't explain why they can't upgrade user-space applications and libraries. It's very rare for a user-space application upgrade to require a kernel update on any major operating system.

Re: More Than 1M Google Accounts Breached by Gooligan

#162

Post by TenOhms »

JamesSwift wrote: post #100
curt15 wrote: post #85

Earlier quoted context omitted.

>Looks like it only works on the older Android 4 Jellybean software (and some Android 5 Lollipop) and below, so mostly concentrated in Asia where there are lower-end phones. But devices running Android 5 and below "only" comprise the vast majority of devices out there https://developer.android.com/about/dashboards/index.html

Yep, I'm stuck on 4.4.2 because verizon doesn't provide OTA updates any more and the 4.4 update ensures that the phone bricks if you go through the process of installing cyanogenmod.

Was the same, went for an Iphone 7. I'll never blindly buy a locked Verizon phone ever again. Damn them, damn them to hell.

Re: More Than 1M Google Accounts Breached by Gooligan

#163

Post by danudey »

myowncrapulence wrote: post #118
sqeaky wrote: post #114

Earlier quoted context omitted.

> Being able to buy a new computing device from a store that will receive no security updates is terrible, and is fairly common in Android devices. This seems like the kind of problem the free market could solve. Just get one phone vendor to guarantee secruity updates for a few years and then some customers will start buying those phones. After a while other vendors will start promising it or losing sales.

the kind of problem the free market could solve Yet the free market doesn't solve this problem.

The market obviously isn't free enough. Maybe we should stop taxing rich people.

Re: More Than 1M Google Accounts Breached by Gooligan

#164

Post by matt_wulfeck »

s_q_b wrote: post #131
matt_wulfeck wrote: post #124

Earlier quoted context omitted.

I never heard that about voting machines. Do you have a source for that? I'm not sure why that's more surprising than hearing that they run Windows XP...

These are the certified electronic voting machines (DREs) for Pennsylvania: http://www.dos.pa.gov/VotingElections/OtherServicesEvents/Pa... The Android device in use is the EA Tablet. The certification tests are listed in "EA TABLET FOR ANDROID WITH JELLYBEAN 4.2.1 ELECTRONIC Test Report," dating from 2013. To be fair, it's probably the best of the horrible lot in security, but that ain't saying much. For example, th…

That sounds so... horrendously awful.

Re: More Than 1M Google Accounts Breached by Gooligan

#165

Post by zepto »

FT_intern wrote: post #103
zepto wrote: post #77

Earlier quoted context omitted.

The fact that most consumers aren't aware they most Android devices are susceptible to these kind of vulnerability argues for more noise about these issues - not calming press releases talking about how the issues are moot with the latest build.

> The fact that most consumers aren't aware they most Android devices are susceptible Are they really? I've assumed that I'm taking the same risks installing an app on Android as running a .exe on Windows.

Do you think that most of the other billion Android users know what an .exe is?

Re: More Than 1M Google Accounts Breached by Gooligan

#166

Post by heisenbit »

sqeaky wrote: post #114
Pxtl wrote: post #84

Earlier quoted context omitted.

That's not to say Google has no responsibility in this. Google's OS has a terrible security-update policy. Being able to buy a new computing device from a store that will receive no security updates is terrible, and is fairly common in Android devices. Now, there are valid technical reasons that Google can't be as good as Microsoft at pushing out updates to every device running their OS, but still, it's hard to say t…

> Being able to buy a new computing device from a store that will receive no security updates is terrible, and is fairly common in Android devices. This seems like the kind of problem the free market could solve. Just get one phone vendor to guarantee secruity updates for a few years and then some customers will start buying those phones. After a while other vendors will start promising it or losing sales.

That economic fiction requires an ideal rationale actor and a different time horizon.

1) Noble price researchers (Kahnemann & Tversky) showed that economic actors are not rationale.

2) Taking a long term view tends to require sufficient funding to allow to worry about the long term. People with lower level funds intensely worry about the short term and for them this is totally rationale.

Re: More Than 1M Google Accounts Breached by Gooligan

#167

Post by zigzigzag »

nradov wrote: post #133
Kurtz79 wrote: post #99

Earlier quoted context omitted.

Google in most cases is not the device's manufacturer, and in a mobile device OS and application SW are tightly coupled, so you cannot really have OS updates separate from firmware updates, bypassing the actual manufacturer's own updates. Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own, and actually it is one of the selling points of their new phone. In additi…

That is specifically a design flaw in the AOSP. Right now manufacturers have to integrate their custom device drivers into every new OS build, leading to long delays and fragmentation. The device drivers should be separate, and the OS should expose a stable API and integration points. That way OS upgrades could be pushed out without breaking everything, just like with desktop OSs.

That's not Google's policy, it's Linux. What you suggest would mean abandoning Linux as a kernel. I'd be all for it - the industry needs some more open source kernel competition.

Re: More Than 1M Google Accounts Breached by Gooligan

#168

Post by UniversalBlue »

danudey wrote: post #163
myowncrapulence wrote: post #118

Earlier quoted context omitted.

the kind of problem the free market could solve Yet the free market doesn't solve this problem.

The market obviously isn't free enough. Maybe we should stop taxing rich people.

Yeah, poor rich people, being taxed to death. How can they afford their gold iPhones now?

Re: More Than 1M Google Accounts Breached by Gooligan

#169

Post by Normal_gaussian »

Filligree wrote: post #160
Normal_gaussian wrote: post #154

Earlier quoted context omitted.

This is one of the reasons we may need to look into self-regulation. Name them?

Never mind self-regulation, what he described is outright illegal. In most countries, so is not reporting them to the police once you know about it.

Absolutely, however with self regulation and a standards body they will find it much harder to get Engineers in the first place.

Re: More Than 1M Google Accounts Breached by Gooligan

#170

Post by Kurtz79 »

archivator wrote: post #122
Kurtz79 wrote: post #99

Earlier quoted context omitted.

Google in most cases is not the device's manufacturer, and in a mobile device OS and application SW are tightly coupled, so you cannot really have OS updates separate from firmware updates, bypassing the actual manufacturer's own updates. Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own, and actually it is one of the selling points of their new phone. In additi…

> and in a mobile device OS and application SW are tightly coupled I call bullshit. There's no reason Google can't update everything AOSP-y in /system - libc, libart, libwebkit etc. > Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own That's a low bar. When you buy a Dell laptop, you continue to receive updates from Microsoft. This is the bar we should hold Googl…

> and in a mobile device OS and application SW are tightly coupled I call bullshit. There's no reason Google can't update everything AOSP-y in /system - libc, libart, libwebkit etc.

That's not the point. Even if it were so, it's still responsibility of the manufacturer to integrate it in its own firmware and push the update with the carrier's approval.

You are comparing a laptop to a smartphone, which makes no sense, the smartphone has to connect to cellular network to be useful, and it's the carrier that establishes the rules for the update process.

I agree that it should work as you say for devices with no cellular connectivity, such as WiFi only tablets, where no other parties other than the OS and device manufacturers are involved.

Post reply on HN