Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Latest Android phones hijacked with one-shot Chrome exploit

theregister.co.uk

Post reply on HN
Print view View original

31–40 of 46 posts

Re: Latest Android phones hijacked with one-shot Chrome exploit

#31

Post by epmatsw »

vetinari wrote: post #21
josteink wrote: post #13

Happy Android and Firefox user calling in. My Nexus is still safe :)

I'm also using Firefox on Android (because it is the only mobile browser that supports extensions). However, the desktop Firefox regularly tops my 'Apps using significant energy' list, even when idling.

Fwiw, the significant energy usage list on OSX corresponds pretty poorly with real world results. Safari is the most efficient, and Firefox is actually slightly better than Chrome.

What does the OS X Activity Monitor’s “Energy Impact” actually measure? | Nicholas Nethercote https://blog.mozilla.org/nnethercote/2015/08/26/what-does-th...

Chrome vs Safari vs Firefox web browser efficiency http://blog.getbatterybox.com/which-browser-is-the-most-ener...

Re: Latest Android phones hijacked with one-shot Chrome exploit

#32

Post by vetinari »

epmatsw wrote: post #31
vetinari wrote: post #21

Earlier quoted context omitted.

I'm also using Firefox on Android (because it is the only mobile browser that supports extensions). However, the desktop Firefox regularly tops my 'Apps using significant energy' list, even when idling.

Fwiw, the significant energy usage list on OSX corresponds pretty poorly with real world results. Safari is the most efficient, and Firefox is actually slightly better than Chrome. What does the OS X Activity Monitor’s “Energy Impact” actually measure? | Nicholas Nethercote https://blog.mozilla.org/nnethercote/2015/08/26/what-does-th... Chrome vs Safari vs Firefox web browser efficiency http://blog.getbatterybox.com/…

Thanks for the links, especially the Nicholas Nethercotes' blog is very interesting.

To be fair, Google is working on the Chrome efficiency: https://plus.google.com/+PeterKasting/posts/GpL63A1K2TF

Re: Latest Android phones hijacked with one-shot Chrome exploit

#33

Post by blisterpeanuts »

mtgx wrote: post #25
blisterpeanuts wrote: post #19

Earlier quoted context omitted.

So, are there more exploits for iOS out there? I had the impression that Android has more. Also, this particular one is a browser JavaScript problem that affects multiple android versions, is it not?

> So, are there more exploits for iOS out there? I had the impression that Android has more. But that was his point - he was referring to Nexus-only (or CyanogenMod), not "Android", where 87% of the devices are vulnerable to least one of the 11 vulnerabilities tested below, because of their lack of (fast) updates: http://androidvulnerabilities.org/

He said:

a frequently updated Android distribution (Nexus or CyanogenMod) might in fact be more secure than iOS, where you are forced to be vulnerable to Apple's Webkit engine.

I took that to mean that Apple devices are more vulnerable because they are infrequently updated, as compared to Android. Google and its partners do release fairly frequent (every 3-4 months) dot releases of webkit, Chrome, and the entire OS, to add features and address vulnerabilities.

By contrast, Apple's release schedule is rather monolithic and their superior security is based on a more tightly controlled platform.

Re: Latest Android phones hijacked with one-shot Chrome exploit

#34

Post by segmondy »

Maarten88 wrote: post #12

Am I alone being amazed that we still have not experienced an Android worm or virus shutting down all mobile networks globally for a few days? I remember Slammer, which brought down many corporate networks and severely impacted all internet traffic. With all these unpatched phones and so many vulnerabilities it seems a matter of time before something like this happens on a grander scale in mobile networks. Would it b…

Blackhats are no longer in it for the mischiefs but more for the profit.

Re: Latest Android phones hijacked with one-shot Chrome exploit

#35

Post by x1798DE »

gcb0 wrote: post #22

i never understood why even tech ppl are OK using phones like clueless people used computers in the 90s. vendor toolbars and bundled applications? check. saved logins on banks and everything else? check. no firewall? check. ads everywhere? check. get your crap together, everyone.

Do you know people who actually do this? I'm deeply uncomfortable when I get a new phone that doesn't have a CM / custom ROM out yet, because I need to be able to lock everything down myself. I assumed other tech literates did the same.

Re: Latest Android phones hijacked with one-shot Chrome exploit

#37

Post by gambiting »

x1798DE wrote: post #35
gcb0 wrote: post #22

i never understood why even tech ppl are OK using phones like clueless people used computers in the 90s. vendor toolbars and bundled applications? check. saved logins on banks and everything else? check. no firewall? check. ads everywhere? check. get your crap together, everyone.

Do you know people who actually do this? I'm deeply uncomfortable when I get a new phone that doesn't have a CM / custom ROM out yet, because I need to be able to lock everything down myself. I assumed other tech literates did the same.

Really? I am the exact opposite. Few years ago I would always run a custom firmware on my android phone, now I wouldn't touch a rooted phone with a bargepole. Mostly because none of my bank apps work on rooted phones, but also because CM was always an unstable affair for me - fantastic at the beginning, more and more annoying the longer I use it. The "customization"(which I used once to change some icons) is simply not worth the loss of stability.

Re: Latest Android phones hijacked with one-shot Chrome exploit

#38

Post by UnoriginalGuy »

devit wrote: post #18

This is why you should use Firefox for Android: it's a great browser (even offering extensions such as uBlock Origin), but it has very little marketshare and is thus unlikely to be attacked. This is also part of the reason a frequently updated Android distribution (Nexus or CyanogenMod) might in fact be more secure than iOS, where you are forced to be vulnerable to Apple's Webkit engine. The same reasoning also appli…

I use Firefox for Reddit.com (Chrome keeps freezing when I hit the [-] buttons on long comment threads); but holy heck does it drain battery like crazy.

I could use Chrome or Chrome Beta all day long and my phone doesn't get hot and the display is the biggest battery hog, I run up Firefox and the thing turns noticeably hot and Firefox overtakes the display for battery usage.

Re: Latest Android phones hijacked with one-shot Chrome exploit

#39

Post by mccr8 »

headmelted wrote: post #6

Even by Android standards, this is pretty shocking. Being that this a one-shot exploit that the author believes will work on any Android with the latest Chrome makes it doubly so. I'd also be more concerned that the exploit is described as targeting V8 specifically, considering how widely it is being used out of the browser these days.

Browsers are likely the only place people are using v8 to run arbitrary hostile code.
Post reply on HN