Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

thenextweb.com

Post reply on HN
Print view View original

191–200 of 236 posts

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#191

Post by pjmlp »

zzzcpan wrote: post #190
pjmlp wrote: post #189

Earlier quoted context omitted.

Security should indeed come before anything else. If you're system gets p0wned there is hardly any audio to play. macOS, iOS and Windows security improvements, while being the musicians choice for real time audio, show it is possible to put security first, while offering a good audio stack.

Security is always in service of something, not the other way around. The highest point for security is coming together with something side by side, but not before it.

That is how languages like C or JavaScript get adoption.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#192

Post by incompatible »

dTal wrote: post #127
incompatible wrote: post #68

Earlier quoted context omitted.

There'd be a case for sandboxing proprietary software, for sure.

With the recent raft of vulnerabilities such as Spectre/Meltdown and Rowhammer, there's an argument to be made that maybe, just maybe, running "untrusted" code on the same physical machine as "trusted" code is fundamentally insecure. Not just because of those particular vulnerabilities, but because they all seem to point to some sort of axiom - when two pieces of code share physical state (CPU, RAM etc), you cannot e…

We could just put all our personal data on some non-networked machine with minimal software installed. But data like that wouldn't really be much use for anything. The data is already being shared over the Internet. People just want the data to stay in the right context: financial details shared with a bank shouldn't find its way onto Facebook or a random game company.

Using a separate computer for each counterparty would be more secure, but again not very convenient.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#193

Post by scarface74 »

adtac wrote: post #157
scarface74 wrote: post #109

Earlier quoted context omitted.

“Many” users?

Yes, nearly all of /r/jailbreak is running iOS 12.x or lower. Specifically, practically no one there has updated to 12.4.1, which fixes Pwn20wnd's exploit.

R/jailbreak has about about 5400 members and “or lower” includes discussions about a first generation iPad and the iPad mini one. They aren’t using an older version by choice - they are using old versions because there are no newer versions available.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#194

Post by scarface74 »

lern_too_spel wrote: post #166
scarface74 wrote: post #59

Earlier quoted context omitted.

Hasn’t the entire argument been that Android’s permission system would have prevented this even if the app was installed outside of the store?

The Epic app installed other apps using a private Samsung API, so the apps were installed using the permissions of the Samsung Galaxy Apps Store app, which has permission to install other apps (on Samsung devices). There is nothing to stop a similar confused deputy vulnerability in the iOS App Store. The Android permission system prevents it from taking pictures or doing other things it was not granted permission to…

Except there isn’t a way for an app to download code outside of the App Store and have the executable bit set.....

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#195

Post by verbify »

mehrdadn wrote: post #104
verbify wrote: post #95

Earlier quoted context omitted.

When you say 'authorities' that includes countries that persecute civil right activists. Amnesty International has specifically criticized NSO specifically regarding UAE activist Ahmed Mansoor. He is currently serving 10 years in jail. UN human rights experts considered his arrest and imprisonment "a direct attack on the legitimate work of human rights defenders". He was monitored by the UAE using NSO technologies. A…

This is supposed to justify putting millions of more people at an even larger risk of getting hacked?

The upside is a certainty - giving a heads up to people we know are getting hacked, and whose repercussions for getting hacked could mean imprisonment or death. The downside is allowing other hackers to maybe produce an exploit in time (before this bug gets patched), and maybe hack some more people.

I'd say the upsides outweigh the downsides.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#196

Post by dexen »

dmix wrote: post #102
typical182 wrote: post #74

To me, the biggest part of this story is: 1. Over two years ago, this was apparently detected automatically by the syzkaller kernel fuzzer, and automatically reported on its public mailing list. [1] 2. Over a year and a half ago, it was apparently fixed in the upstream kernel. [2] 3. It was apparently never merged back to various "stable" kernels, leading to the recent CVE. [3] So you might read that and think "Ok, p…

The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…

>The failures of the Linux core team to properly prioritize security

Why even post this, when it has nothing to do the with the case GP & OP described? It's misleading at best.

The failure here is in the way Google has set its Android development process. They keep a separate "stable" kernel, and manually select certain patches to backport to. In process they skip all kinds of patches - performance, features, and yes, security ones. Given that only selected patches are backported, the process is best described as insecure by default. It was Google's decision to favor stable API over security here.

This is compounded by the fact other Android phone vendors are pretty slow at releasing OS upgrade - and tend to stop releasing them altogether shortly after the phone's no longer manufactured.

The mainline kernel, as released by the Linux core team is up to date with security. Hold to account people that decided to skip patches as a matter of course, resulting in the insecure by default process.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#197

Post by viraptor »

dexen wrote: post #196
dmix wrote: post #102

Earlier quoted context omitted.

The failures of the Linux core team to properly prioritize security is quite well known. A lot of people have poked the bear by trying to bring this up, also with specific real examples, and got a tongue lashing from the team and moved on to other things. I'm amazed the GRSecurity people have managed to do it for so long. Even if merging their stuff mainline legitimately wasn't practical, I've seen plenty of snark an…

>The failures of the Linux core team to properly prioritize security Why even post this, when it has nothing to do the with the case GP & OP described? It's misleading at best. The failure here is in the way Google has set its Android development process. They keep a separate "stable" kernel, and manually select certain patches to backport to. In process they skip all kinds of patches - performance, features, and yes…

> The failure here is in the way Google has set its Android development process.

I think it's still the won't layer. Google may be able to put some pressure to change things, but it's describe the issue as "the failure is in the way SOC manufacturers have set their kernel porting process". You often get chips which work with one version and a dump of specific drivers. Beyond pressuring the company to upstream their changes, or writing clean room versions, I don't see many solutions.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#198

Post by jsjohnst »

posix_me_less wrote: post #184
justinjlynn wrote: post #175

Earlier quoted context omitted.

Indeed. Who the hell thought it was a great idea for the modem baseband device to have unlimited direct memory access to the host processor memory space? I mean, especially when the baseband firmware can usually be remotely updated by the network with zero user interaction?!

> have unlimited direct memory access to the host processor memory space Can you give some reference for that claim?

https://www.usenix.org/system/files/conference/woot12/woot12...

If you want more, literally google “baseband attack host processor memory” or “baseband exploits DMA” or “baseband exploits memory”.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#199

Post by jsjohnst »

panpanna wrote: post #179
ebiggers wrote: post #100

Earlier quoted context omitted.

syzbot is already fuzzing the latest two stable kernels and has found hundreds of bugs, including lots of use-after-frees. All these bugs are listed here: - https://syzkaller.appspot.com/linux-4.14 - https://syzkaller.appspot.com/linux-4.19 As far as I know, no one is doing anything with the syzbot bugs against stable kernels directly, since no company using Linux is paying anyone to do it as their job. But some are…

How complex it is to test all known issues against all current kernels? A weekly report with some easy to understand graphs would probably convince more people to work on these bugs.

Time and cost, same as it would be to do it across all kernel versions, not just current ones. Theoretically could be done pretty simply via a CI/CD pipeline if someone wrote solid test cases for the issues found by the fuzzier.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#200

Post by viraptor »

jackcodes wrote: post #148
StavrosK wrote: post #81

Earlier quoted context omitted.

I don't understand people who want to remove choice. Don't want the ability to install apps from untrustworthy sources? Don't enable the option that gives you that ability.

He did say ‘for his family’. I don’t expect older people and children to not enable that option if convinced by an advert to the lure of free pirated apps.

That's what parental controls are for. You can disable app installation completely if necessary.
Post reply on HN