Live data from Hacker News

Samsung embeds IronSource spyware app on phones across WANA

smex.org

191–200 of 500 posts

Re: Samsung embeds IronSource spyware app on phones across WANA

#191
> AppCloud, developed by the controversial Israeli-founded company ironSource (now owned by the American company Unity), is embedded into devices

We have new spyware coming from Israel, let's update the list:

- Pegasus

- Candiru

- QuaDream

- Cellebrite

- Paragon Solutions

- Nemesis

- AppCloud

Re: Samsung embeds IronSource spyware app on phones across WANA

#192

Earlier quoted context omitted.

You make an interesting point here. While “rooting your phone can void your warranty and pose a security risk“ may be a factually true statement, we must also consider some entirely unrelated and possibly untrue statements that could be theoretically uttered in another reality. We can get so bogged down with “things that are real” and “exist in this universe” that we completely fail to focus on the vital stuff like “…

On the contrary. My statements bear equivalent accuracy to yours in our current reality. My statements are also very obviously FUD. So is yours. Or do you dispute that you could be hospitalized for salmonella if you botch cooking poultry at home? Or perhaps you feel that there is no straightforward way to inadvertently endanger your life by servicing your vehicle incorrectly?

Interesting. While there is no such thing as a chauffeurs union or an FSD alliance, if we say that they exist maybe they do. Similarly, if you say something is “FUD” then maybe it becomes that.

I genuinely do not understand the last two sentences. Are you pro- or anti- “telling people that salmonella exists” ? Is saying “salmonella exists and can be a problem” FUD or what? Do you think salmonella isn’t real

Re: Samsung embeds IronSource spyware app on phones across WANA

#193

Earlier quoted context omitted.

We need regulation which defines that any hardware device capable of running software developed by a third party different from the hardware manufacturer qualifies as a general purpose computing device, and that any such device is disallowed to put cryptographic or other restrictions on what software the user wants to execute. This pertains to all programmable components on the device, including low-level hardware co…

I agree, but I think three extra conditions would need to be added here. 1. Devices should be allowed to display a different logo at boot time depending on whether the software is manufacturer-approved or not. That way, if somebody sells you an used device with a flashed firmware that steals all your financial data, you have a way to know. 2. Going from approved to unapproved firmware should result in a full device w…

4. Apps with special security needs are allowed to detect whether a device is unlocked and can either disable themselves or go into a mode that shifts ALL related liability onto the user. It's not the bank's fault if the user disabled protections and some spyware logs the online banking password or something like that.

Re: Samsung embeds IronSource spyware app on phones across WANA

#194
post #60

Earlier quoted context omitted.

How?

By following the principle of least privilege. Like with apps the user should only have privileges for what they are allowed to control and nothing more. So if the user should have privilege to disable apps, then the settings app could expose a way for the user to do so. Yes, this is kind of approach of coming up with a design to security instead of going with the easy route of everything being allowed is harder to d…

Okay, and how am I going to give the user the right to wipe all software from the device and use a completely custom software?

I mean, we all agree that such permissions are not required during everyday operations, but there should be a way for the consumer to have control over the software being used. And I mean all aspects of the software: firmware should be updatable, the OS should be replaceable, and the security concepts within the OS should be customizable by the user as well. I have no problem with hiding such functionality and requiring users to read the documentation to find out how it can be done, but it should still be possible.

Re: Samsung embeds IronSource spyware app on phones across WANA

#195
post #7

In my experience, Samsung is a label that means "stay far, far away." From the Galaxy Note fiasco to my microwave to my dishwasher to ... Probably at least three other products before I learned my lesson. I even refuse to buy QD-OLED monitors out of indignation that Samsung makes the panels. Maybe I'm alone but maybe one day we'll boycott lousy companies out of business.

Great SSDs though, generally speaking

Re: Samsung embeds IronSource spyware app on phones across WANA

#196

Earlier quoted context omitted.

In favor of what? The Android ecosystem is pretty lousy. Which manufacturers allow you to easily migrate to a new phone (Samsung has Smart Switch) and have, let's say, 4+ years of security updates? Genuine question. In my case I also wanted an SD card slot so it was slim slim pickings indeed. (And still there are some misfits who insist that there is no such thing as progress!)

LG back in the day. I miss my V20. What a weird, but wonderful phone.

I'm still using a V20 as my main phone. The recent app icons at the extra top section of the screen really make juggling active apps fast. I don't think any phone has had this feature since.

Re: Samsung embeds IronSource spyware app on phones across WANA

#197
post #8

The "unremovable" part is inaccurate. While you can't completely remove it because it resides on the system partition, you most probably can still disable it with an adb command: adb shell pm uninstall --user 0 com.package.name This command is very powerful as it works for any app, even those that have "disable" greyed out in the settings. I disabled the Galaxy Store on my S9 this way for example.

I had a Samsung phone and did the same with mine. Wrote a small tutorial here( https://harigovind.org/notes/removing-samsung-android-bloatw... ). But even then, these apps will pop right back after system updates and those were becoming more frequent. I got rid of it shortly after, nowadays I use Moto where bloatwares are comparatively minimal.

I've had a few Moto phones and have also been pleased with the fairly stock OS and durability.

Re: Samsung embeds IronSource spyware app on phones across WANA

#198

making it nearly impossible for regular users to uninstall it without root access, which voids warranties and poses security risks Stop parroting the corporate propaganda that put us into this stupid situation in the first place. Having root access on devices you own should be a fundamental right, as otherwise it's not ownership.

Didn't we backslide hard enough at this point that it is now architecturally ensured that there is a security downside to rooting? Prevents verified boot for example, since the attestation is tied to said corporations, and not you.

I don't follow the reasoning behind this - even in a verified boot scenario you can just choose to not load the offending kernel module without compromising security.

Re: Samsung embeds IronSource spyware app on phones across WANA

#199

making it nearly impossible for regular users to uninstall it without root access, which voids warranties and poses security risks Stop parroting the corporate propaganda that put us into this stupid situation in the first place. Having root access on devices you own should be a fundamental right, as otherwise it's not ownership.

My grandma should not have root on her phone and a lot of younger people as well.

Making it easy to root phone makes it easy for scammers to ask people to unlock it.

It should not void warranty if you unlock the phone. But security concerns are real. Mobile banking apps refuse to run on rooted phones.

Re: Samsung embeds IronSource spyware app on phones across WANA

#200
post #130

Earlier quoted context omitted.

What about PRISM? https://en.m.wikipedia.org/wiki/PRISM

Do Apple and Google have a choice to legally opt out of it?

What difference does that make to the outcome? If anything, being automatically subject to that without any option is worse.
Post reply on HN