I've run into similar issues before. The solution seems reasonable, but I'm skeptical about the claimed performance improvements.
A 0-click exploit chain for the Pixel 10
171–180 of 255 posts
Re: A 0-click exploit chain for the Pixel 10
#172I've run into similar issues before. The solution seems reasonable, but I'm skeptical about the claimed performance improvements.
[dead]
Re: A 0-click exploit chain for the Pixel 10
#173Hmmm... I'd like someone to double check my thinking here. I posted this exact prompt for gpt 5.5 xhigh: ``` does this look right to you? don't do any searches or check memory, just think through first principles static int vpu_mmap(struct file fp, struct vm_area_struct vm) { unsigned long pfn; struct vpu_core core = container_of(fp->f_inode->i_cdev, struct vpu_core, cdev); vm_flags_set(vm, VM_IO | VM_DONTEXPAND | VM…
That's not really a fair test because you're leading the model pretty hard, even if the prompt doesn't specifically say there's a bug to be found. It's basically the same objections that people raised in the thread where someone claimed current models are just as good as mythos.
I don't agree, and I'd like to understand your point of view.
To me, asking if a function has something wrong with it is just a very basic code review - something that should happen with every function. A competent, security conscious engineer would respond the same way as the model, unsurprisingly, since the model is... modelling competence.
Re: A 0-click exploit chain for the Pixel 10
#174I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…
Google owns Android. Google does not care about you or other users. Their customers are ads publishers. 0days does not matter for them! Because there is hardly one alternative: iphone (and Huawei, but maybe not everywhere). Not much to care about.
We all need a new phone OS and hardware level. Urgently.
Re: A 0-click exploit chain for the Pixel 10
#175I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…
Google owns Android. Google does not care about you or other users. Their customers are ads publishers. 0days does not matter for them! Because there is hardly one alternative: iphone (and Huawei, but maybe not everywhere). Not much to care about. We all need a new phone OS and hardware level. Urgently.
> Google owns Android. Google does not care about you or other users. Their customers are ads publishers. 0days does not matter for them
"Google does not care about zero-day vulnerabilities" is an absolutely ludicrous claim.
Re: A 0-click exploit chain for the Pixel 10
#176Earlier quoted context omitted.
You said removing features. This link is talking about making certain feautures optional and disabled by default, not removing them.
Did you happen to notice the phrase "stripping out code" in the first sentence?
And which features have been removed, as you claim? Removing code is not necessarily removing features. I use GOS and I honestly can't think of a missing feature compared to the stock OS, other than stuff not in AOSP in the first place, like gemini.
Re: A 0-click exploit chain for the Pixel 10
#177Where are the iPhone jailbreaks didn’t see anything since a long time.. what’s happening? Did I miss them or isn’t anything available? I mean props to Apple however they do it but is it a matter of time in regard to the current timeline or what is actually going on?
Exploits that can survive reboots are almost impossible these days. And a jailbreak enabling exploit now requires a whole chain of exploits which are worth significant money and also get patched as soon as they become public. So something like the old iphone jailbreaking scene is just impossible now.
Its still a thing but only on older devices. Eventually exploits get published long after they've been sold many times.
Re: A 0-click exploit chain for the Pixel 10
#178Earlier quoted context omitted.
> What is the purported lesson we should have learned? Not to automatically execute things within data that we have been sent.
The subtle lesson, which we won't learn is [astronaut meme] all communication is potentially remote code execution . This isn't a computer thing, it's in the inherent nature of how communication works for us too. You can be more or less careful, but you can't eliminate the problem entirely or else communicating ceases to be effective.
Hey, you! Stop executing code in my head!
Re: A 0-click exploit chain for the Pixel 10
#179Re: A 0-click exploit chain for the Pixel 10
#180Earlier quoted context omitted.
"Don't click on links" is not a solution, and it's not something people actually do, it's just something they think they do. Corporate Security will tell you that it's ok to click links to the payroll system or hr or vanta or the 'secure email service' or jira or github or to docusign or the microsoft office document that a partner company sent you or an amazon delivery notification, but not ok to click links in the…
>It's not possible to tell whether a message giving you a link to something is 'sketchy' or not before clicking the link Sure it is. It's just not something the average user can do. But what makes the situation worse is that most emails now use click tracking, so ALL links are sketchy. For example, emails from my union all link to 2mv.aplink.red and are 200 characters long and look like /dev/urandom output. No fuckin…
I think you are providing a very good argument for why even technical users cannot distinguish legitimate links from sketchy ones.