Live data from Hacker News

Samsung embeds IronSource spyware app on phones across WANA

smex.org

171–180 of 500 posts

Re: Samsung embeds IronSource spyware app on phones across WANA

#171

Earlier quoted context omitted.

How is the security risk propaganda?

It's not (only) propaganda. Rooting disables or bypasses verified boot, allowing exploits to persist across a reboot.

Malware van persist across reboots regardless of verified boot. What it can't do is persist through a factory reset.

But if you really want a thorough reset, simply re-lock the bootloader and flash stock firmware from there. Nothing can persist through that without an exploit in the verification chain and if you have that kind of exploit, you don't need the bootloader to be unlocked in the first place.

Also, there are devices out there that let you enroll your own keys, like the Google Pixel series.

Re: Samsung embeds IronSource spyware app on phones across WANA

#172

Samsung currently has an unremovable spyware app on North American phones that pastes (records) everything copied to the clipboard by any app. It is the Samsung Keyboard app. It cannot be removed. It doesn't matter if you're using any other keyboard app. Samsung Keyboard pastes (records) everything that gets copied to the clipboard by any app. The Samsung Keyboard app cannot even be disabled from Android. As an aside…

https://www.reddit.com/r/samsunggalaxy/comments/mtakqq/how_t... Yeah, all Samsung software is a liability. Don't even get me started on the Samsung smart TVs. Just horrible all-around.

Thats why my Samsung TV has no internet access and I'm using Apple TV instead.

Re: Samsung embeds IronSource spyware app on phones across WANA

#173

Earlier quoted context omitted.

I'm pretty sure the recent switch 2 "license to use the hardware" has entirely killed any notion that you actually own the hardware and are free to do anything with it. Especially in Africa, where privacy and consumer rights are probably less relevant than the US/EU.

""license to use the hardware"…." Well, then it's high time the laws of ownership in just about evey country in the world were updated. As it stands, if I buy something then I own it.

> if I buy something then I own it.

That's the point: you can't buy it, only license.

Re: Samsung embeds IronSource spyware app on phones across WANA

#174
post #8

The "unremovable" part is inaccurate. While you can't completely remove it because it resides on the system partition, you most probably can still disable it with an adb command: adb shell pm uninstall --user 0 com.package.name This command is very powerful as it works for any app, even those that have "disable" greyed out in the settings. I disabled the Galaxy Store on my S9 this way for example.

I had a OnePlus whatever as a work phone in my last job. Every time I used adb to purge the OnePlus crap, it would somehow find its way back. Eventually I settled on disabling autoupdates from the play store, so it was stuck at whatever outdated, and hopefully broken, version the phone shipped with.

Re: Samsung embeds IronSource spyware app on phones across WANA

#176

Earlier quoted context omitted.

This is a good point. While there is nothing factually incorrect in the statement “rooting your phone can void your warranty and pose a security risk”, if you imagine factual statements are the same thing as value judgments it becomes very problematic. Similarly it is pretty messed up when people say stuff like “fire can burn you if you aren’t careful” because so many people rely on fire for food and warmth.

Having your vehicle serviced by someone other than the dealer could void your warranty and poses a safety risk. Cooking animal products at home poses a health risk. You should be sure to only ever consume animal products prepared by a duly licensed establishment. The chauffeur's union would like to take this opportunity to remind you that amateurs operating their own motor vehicles risk serious injury and even death.…

You make an interesting point here. While “rooting your phone can void your warranty and pose a security risk“ may be a factually true statement, we must also consider some entirely unrelated and possibly untrue statements that could be theoretically uttered in another reality.

We can get so bogged down with “things that are real” and “exist in this universe” that we completely fail to focus on the vital stuff like “Bigfoot is circumcised” and “Who did it?” and “Why?”

Re: Samsung embeds IronSource spyware app on phones across WANA

#177

Earlier quoted context omitted.

"How can you hold a manufacturer liable if the user was given unsupervised time as root?" PCs had root access by default, so why wasn't it a significant problem for them? Banking is possible on a PC without a banking app. As Noam Chomsky has said, as in politics, manufacturers and OS vendors such as Google and Microsoft have been deliberately "manufacturing concent" — a widespread belief in the population of users th…

> PCs had root access by default, so why wasn't it a significant problem for them? They weren't networked. They were notoriously buggy. And most importantly, they weren't warrantied [1]. Root should always be an option. But once you root, it's fair for the warranty to be voided. > OS vendors such as Google and Microsoft have been deliberately "manufacturing concent" Nitpick, the propaganda model [2] attempts to descr…

Uh? My PCs and corporate PCs I've been responsible for are networked including the internet (they always have been). Moreover, they were warranted with no conditions about what software was run on them.

Where on earth did you get that notion from? Just because some vendor [your links] has conned the unfortunate client into an unacceptable contract doesn't mean it's commonplace or ever was.

Re: Samsung embeds IronSource spyware app on phones across WANA

#178

making it nearly impossible for regular users to uninstall it without root access, which voids warranties and poses security risks Stop parroting the corporate propaganda that put us into this stupid situation in the first place. Having root access on devices you own should be a fundamental right, as otherwise it's not ownership.

This is a good point. While there is nothing factually incorrect in the statement “rooting your phone can void your warranty and pose a security risk”, if you imagine factual statements are the same thing as value judgments it becomes very problematic. Similarly it is pretty messed up when people say stuff like “fire can burn you if you aren’t careful” because so many people rely on fire for food and warmth.

In fact there is a lot factually incorrect.

For starters, in most places, warranty is a legal requirement and the manufacturer isn't allowed to void it for whatever reason they want. If my phone's battery starts getting really hot in normal use, or I start getting dead pixels on my screen or whatever else, the fact I have a custom OS on my phone isn't relevant to the warranty claim any more than having it in a case or putting some stickers on it. Yes, it'll make claiming it more difficult, but that doesn't mean it's void, just that you'll have to fight through a few more tiers of support agents to get it fixed.

More importantly, rooting is only a security risk in the sense that it increases the attack surface for exploits. The same can be said for any other system-level software. Like if you buy an Nvidia graphics card in your computer and that loads its kernel driver, malware now has one more place to exploit. Are Nvidia graphics cards a security risk?

We've come an incredibly long way from just dropping /xbin/su and calling it a day. Modern (as in the last 10 years) root solutions have caller checks based on a user-defined whitelist and really modern implementations use kernel-level checks to make sure the app wanting root access is allowed to get it. The only way this can be dangerous is if one of those apps or the root solution itself has a code execution exploit. But again, the same can be said for the plethora of system-level bloatware vendors install these days.

Re: Samsung embeds IronSource spyware app on phones across WANA

#179

Earlier quoted context omitted.

It's not (only) propaganda. Rooting disables or bypasses verified boot, allowing exploits to persist across a reboot.

Malware van persist across reboots regardless of verified boot. What it can't do is persist through a factory reset. But if you really want a thorough reset, simply re-lock the bootloader and flash stock firmware from there. Nothing can persist through that without an exploit in the verification chain and if you have that kind of exploit, you don't need the bootloader to be unlocked in the first place. Also, there ar…

> Malware [c]an persist across reboots regardless of verified boot.

Some can, some can't. Even when it can persist, escalating to root after every reboot may be unreliable or noisy (e.g. 70% chance of success, 30% crash) compared to straight persistence as root without verified boot.

> Also, there are devices out there that let you enroll your own keys, like the Google Pixel series.

This still applies to those devices. It's the main reason GrapheneOS (which exclusively runs on Pixels, with the bootloader relocked to a GrapheneOS key) is opposed to building in root access: Verified boot would be "enabled", but effectively bypassed. https://xcancel.com/GrapheneOS/status/1730435135714050560

Re: Samsung embeds IronSource spyware app on phones across WANA

#180
post #95

Earlier quoted context omitted.

> Having root access is not in the interest OR benefit of most regular users. What about desktop OSes for the last 40/50 years? Sure they aren’t the foam-padded locked down phone OSes, but isn’t this fear a case of leaving said padded room?

Computer usage and consequently threat landscape went through a crazy change from 40/50 years ago. Desktops are a minority of devices. If you take personal devices even more so. Most people in the world with a computer have just a pocket one. Especially in WANA countries discussed If you talk to regular non IT savvy people many of them don't bother and correctly assume that at some point it will "get a virus" or some…

> almost no one uses desktop for critical stuff like payment or finance

What? This makes no sense. For something where security matters, using the desktop is the only rational choice. I never, ever, allow any sensitive information through the phone since it is not a trusted device.

Post reply on HN