Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

thenextweb.com

Post reply on HN
Print view View original

181–190 of 236 posts

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#181

Post by e12e »

delibes wrote: post #18

> However, if you install an application from an untrusted source, attackers can take advantage of that. Attackers can also take advantage of the bug if they pair it with vulnerabilities in the Chrome browser to render content. So, you have to sideload an app or from some other source. Is it unreasonable to say don't do that? How common is it anyway? I work with IT folks and only a few ever seem to load outside the P…

In addition to "essential" apps, like the early versions of Pokémon Go(?) that bizarrely needed to be sideloaded IIRC, and running your own (unpublished) apps - there are the numerous vendor-provided apps and app stores that avoid the play store gatekeeping. (of course, the vendors should be gatekeepers here..)

Then there's f-Droid, the people that run without Google apps (alternate roms).

And then there's "Android TV" that has a "different" play store due to the TV profile being different - but allows sideloading of apps like zerotier(VPN) or chrome - that work fine on TVs - but unfortunately isn't flagged as supporting TV in the Manifest.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#182

Post by bloudermilk »

The macro-level progression of digital security really worries me. Each day the attack surface grows, the number of bad actors grows, the number of internet-connected individuals grows, and the quantity and sensitivity of data per-capita grows.

Is there a well-researched theory that considers a "breaking point" in this pattern? Where we either a) accept that all data is at risk of being exposed or b) develop fundamental security patterns to privatize our data or c) something else?

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#183

Post by josteink »

nothrabannosir wrote: post #126
telanis wrote: post #114

Earlier quoted context omitted.

Since when is "we do it all the time" the same as "it's a good thing"?

goto for error handling is not just "freeform anything goes goto". It's a very specific idiom, being an "error" label and a bunch of "if (resource) free(resource)" statements at the end of the function. It is essentially analogous to a common use case of Go's defer. Typically an accepted pattern when dealing with many resources and possible exit points. Prevalent in I/O heavy code. Different ballgame from the subject…

> It is essentially analogous to a common use case of Go

Go, which is also known for its terrible error-handling.

Great.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#184

Post by posix_me_less »

justinjlynn wrote: post #175
westmeal wrote: post #137

Earlier quoted context omitted.

The new Android devices also have hardened kernels but it doesn't really matter phones are insecure as fuck in other ways.

Indeed. Who the hell thought it was a great idea for the modem baseband device to have unlimited direct memory access to the host processor memory space? I mean, especially when the baseband firmware can usually be remotely updated by the network with zero user interaction?!

> have unlimited direct memory access to the host processor memory space

Can you give some reference for that claim?

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#185

Post by deno »

iliketosleep wrote: post #134
markmark wrote: post #79

Earlier quoted context omitted.

In Android land you can buy a phone where the bootloader can be unlocked and directly flash a pre-rooted ROM rather than relying on people exploiting security vulnerabilities like this.

From my experience, this is not necessarily true, even when a phone is advertised as unlockable. I know that Huawei phones, for instance, had two different unlock modes. One called USER Lock, and the other FB Lock. The unlock codes given to users only applied to USER Lock, which means only some partitions could be modified (e.g. recovery could be modified, but fastboot was restricted). I'm not sure whether or not oth…

Plenty to choose from that don’t do things like that. E.g. Sony has a page dedicated to AOSP[1] and ASUS recently was sending their new flagship to LineageOS developers[2].

[1] https://developer.sony.com/develop/open-devices/

[2] https://www.xda-developers.com/asus-zenfone-6-custom-rom-twr...

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#186

Post by posix_me_less »

pnako wrote: post #158
jodrellblank wrote: post #153

Earlier quoted context omitted.

It’s “telling” of what exactly? Linux distributions make up the majority of public web and database servers and approximately none of the real-time audio players, is that not a “particular reason” to prioritise security over real-time audio?

I'm not saying that Linux should neglect security, but there is no reason for it to be above anything else. People who care about security can look at systems that are more focused, like OpenBSD.

Agreed on fair prioritization, but most people care about Linux security, because that is the major platform. OpenBSD is an obscure platform that is not an option for massive majority of users, and no phone uses it.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#187

Post by Yetanfou »

klingonopera wrote: post #90
Yetanfou wrote: post #88

Earlier quoted context omitted.

Use YALP [1] or Aurora [2] (both are on FDroid) to get the APK's for your banking apps. These apps This is what I do for the Swedish electronic ID app, it has worked for years and hopefully will continue to do so. [1] https://f-droid.org/en/package/com.github.yeriomin.yalpstore... [2] https://f-droid.org/en/packages/com.aurora.store/

Tried 'em both, IIRC Yalp didn't work, Aurora seemed fine. Since it was a banking app, I got the APK of many different sites/programs and compared the hashes, and one of the programs had definitely tampered with the APK, but I can't remember which. Since I left Aurora on my phone, they seemed to have passed on untouched APKs, but don't take my word for it. EDIT: Also, this voids me of any "warranties" my bank would o…

YALP and Aurora get the APK directly from the play store, that is the whole point about these programs.

Get the source to Aurora (or YALP) and find out how it downloads the APK from the play store. Now either build something which does what you want (e.g. feed it an identifier and it downloads an APK), simplify the existing code until only the required functionality is left or use Aurora as it is. You can feed it a Google account (if you have one) to log in to the play store or it can do so 'anonymously'.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#188

Post by pjmlp »

fooker wrote: post #170
dmix wrote: post #102

Earlier quoted context omitted.

The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…

There is no 'Linux core team'

Sure there is, the ones with commit rights to validate pull requests.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#189

Post by pjmlp »

pnako wrote: post #136
dmix wrote: post #102

Earlier quoted context omitted.

The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…

If you submitted a huge patch to Linux that would really improve support for real-time audio, but break many other things like IO throughput, etc. but your argument for accepting it anyway was "yes, but it's for real-time audio support, so it's really important and more important than what everyone else is working on", you'd be laughed out of the mailing list. The fact you use the word "prioritize security" is indeed…

Security should indeed come before anything else.

If you're system gets p0wned there is hardly any audio to play.

macOS, iOS and Windows security improvements, while being the musicians choice for real time audio, show it is possible to put security first, while offering a good audio stack.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#190

Post by zzzcpan »

pjmlp wrote: post #189
pnako wrote: post #136

Earlier quoted context omitted.

If you submitted a huge patch to Linux that would really improve support for real-time audio, but break many other things like IO throughput, etc. but your argument for accepting it anyway was "yes, but it's for real-time audio support, so it's really important and more important than what everyone else is working on", you'd be laughed out of the mailing list. The fact you use the word "prioritize security" is indeed…

Security should indeed come before anything else. If you're system gets p0wned there is hardly any audio to play. macOS, iOS and Windows security improvements, while being the musicians choice for real time audio, show it is possible to put security first, while offering a good audio stack.

Security is always in service of something, not the other way around. The highest point for security is coming together with something side by side, but not before it.
Post reply on HN