Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

thenextweb.com

Post reply on HN
Print view View original

171–180 of 236 posts

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#171

Post by xeromal »

wildmusings wrote: post #125
jumpingmice wrote: post #92

Earlier quoted context omitted.

The Linux kernel is a glaring example software malfunction due to its combination of moderate defect density and incredible extent, along with a culture intolerant of competence. People who became subsystem maintainers because they happened to be hanging around a mailing list in the 90s are still gatekeepers of important subsystems despite their now-decades-long records of continuous malfeasance. Patches that demonst…

You’re wrong that no one should ever use goto. Goto is a perfectly fine control flow operator IF AND WHEN you use it in a highly structured, well-understood way. This is how systems programming is done. A “goto cleanup” section at the end of a function is the best way to do exit-on-error in C, hands down. I hate that people keep peddling this nonsense because they wrote a little C and read a headline about “goto cons…

I'm sure some of the people parroting that got it from their professors in college. I know mine sure did.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#172

Post by kbenson »

kuzimoto wrote: post #140
pnako wrote: post #136

Earlier quoted context omitted.

If you submitted a huge patch to Linux that would really improve support for real-time audio, but break many other things like IO throughput, etc. but your argument for accepting it anyway was "yes, but it's for real-time audio support, so it's really important and more important than what everyone else is working on", you'd be laughed out of the mailing list. The fact you use the word "prioritize security" is indeed…

When you're developing such a crucial part of an operating system, wouldn't you want to put security pretty high at the top of the priorities list? If I were an average consumer, I would care much more about my device being secure, than having real time audio.

You act as if we don't have an experiment about exactly this going on for decades that says the exact opposite, but we do. It's called OpenBSD. The average consumer doesn't care, because it's less performant in some cases and certain software doesn't work or work as well.

It's not even a choice between better security and real-time audio, since the average consumer doesn't even know about that unless specifically called out by marketing. For phones it's about what looks better, both physically and digitally. It's about how the emojis look, how good the pictures the camera takes look (or how good you're told they look), and how responsive and smooth the screen movements are.

The average consumer goes off what they can immediately see and what they're told by marketing, and by what they feel social pressure to buy. The discerning technical expert goes off marketing (but a different set of claims), and a bit more of a discerning eye, and while far more knowledgeable than the average consumer, is still mostly driven by hearsay.

The number of people with enough knowledge to actually make a real data driven choice is probably much less than 0.0001% of people, and that's far from average. I'm not one of them, but I can look at the systems often affected, make some assumptions about how many people know enough about them to speak usefully on risks they actually have, and do some napkin statistics to know almost nobody else is either, even here.

It's easy to call out the average consumer, but truthfully, the last time you bought a phone or computer, how deeply did you analyze the actual security considerations to do with the different aspects of the system, and how much did you rely on what some site told you, trusted recommendations, what you already preferred, and your hunch was which was better? How many millions of lines of code are involved in these systems now? How could you, or any of us actually do anything other than that?

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#173

Post by lucb1e »

dmix wrote: post #102
typical182 wrote: post #74

To me, the biggest part of this story is: 1. Over two years ago, this was apparently detected automatically by the syzkaller kernel fuzzer, and automatically reported on its public mailing list. [1] 2. Over a year and a half ago, it was apparently fixed in the upstream kernel. [2] 3. It was apparently never merged back to various "stable" kernels, leading to the recent CVE. [3] So you might read that and think "Ok, p…

The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…

> failures of the Linux core team

But isn't the issue that Android didn't merge it? Linux patched it.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#175

Post by justinjlynn »

westmeal wrote: post #137
dmix wrote: post #120

Earlier quoted context omitted.

I personally wouldn't trust a company that openly bragged it built a system to provide local police and Intel agencies with real time access to Blackberry messaging flowing across an entire city in 2010 for G20. In addition to sharing their "master" encryption key for a number of years: https://www.theverge.com/2016/4/14/11434926/blackberry-encry... Also AFAIK Blackberry only provided a hardened kernel with a single…

The new Android devices also have hardened kernels but it doesn't really matter phones are insecure as fuck in other ways.

Indeed. Who the hell thought it was a great idea for the modem baseband device to have unlimited direct memory access to the host processor memory space? I mean, especially when the baseband firmware can usually be remotely updated by the network with zero user interaction?!

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#176

Post by rnhmjoj »

iliketosleep wrote: post #134
markmark wrote: post #79

Earlier quoted context omitted.

In Android land you can buy a phone where the bootloader can be unlocked and directly flash a pre-rooted ROM rather than relying on people exploiting security vulnerabilities like this.

From my experience, this is not necessarily true, even when a phone is advertised as unlockable. I know that Huawei phones, for instance, had two different unlock modes. One called USER Lock, and the other FB Lock. The unlock codes given to users only applied to USER Lock, which means only some partitions could be modified (e.g. recovery could be modified, but fastboot was restricted). I'm not sure whether or not oth…

Huawei doesn't even gives aways the unlock codes anymore, but it's for your own safety, mind you.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#177

Post by girvo »

kuzimoto wrote: post #151
pnako wrote: post #150

Earlier quoted context omitted.

>If I were an average consumer If you were, you would behave like one, i.e. not care that much (if at all) about security. What you are saying is "I do care about my device being secure".

Yes, I suppose that's true. I should have worded it differently. Perhaps, the average person would be more upset/notice if they were negatively impacted as the result of a security issue, than if some feature, e.g. real time audio were missing, which I'm sure no one would even notice.

You’d think no one would notice real time audio being missing on android devices, but that discounts the huge amount of music creation thats done on mobile platforms these days. It’s a way bigger market than you’d think!

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#178

Post by panpanna »

fooker wrote: post #170
dmix wrote: post #102

Earlier quoted context omitted.

The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…

There is no 'Linux core team'

There is one, but they have nothing to do with this.

This falls pretty much on Google and people in charge of the backports

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#179

Post by panpanna »

ebiggers wrote: post #100
yjftsjthsd-h wrote: post #91

Earlier quoted context omitted.

So should we be fuzzing the stable branches separately?

syzbot is already fuzzing the latest two stable kernels and has found hundreds of bugs, including lots of use-after-frees. All these bugs are listed here: - https://syzkaller.appspot.com/linux-4.14 - https://syzkaller.appspot.com/linux-4.19 As far as I know, no one is doing anything with the syzbot bugs against stable kernels directly, since no company using Linux is paying anyone to do it as their job. But some are…

How complex it is to test all known issues against all current kernels?

A weekly report with some easy to understand graphs would probably convince more people to work on these bugs.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#180

Post by panpanna »

oefrha wrote: post #156
Thorrez wrote: post #154

Earlier quoted context omitted.

>This one gets a bug tracker entry. For now. A comment from the reporter on the bug tracker entry: >A more detailed explanation of this bug and the methodology to identify it will be written up in a forthcoming blog post when I find the time.

The iOS “deep dive” was a timed media push of a months-old problem right before a major Android release. They didn’t even try to obfuscate the timing or narrative. Blog post or not it’s pretty hard to top that.

You are paranoid.

Apple has started multiple keynotes by talking about Android security issues. Pointing fingers and ridiculing Google, Samsung and others.

Then a few weeks later, a Google keynote would demo something on an iPad and praise its beautiful hi-def screen.

I have _never_ heard Google officially talk crap about Apple.

Post reply on HN