Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

blog.checkpoint.com

Post reply on HN
Print view View original

31–40 of 120 posts

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#31

Post by staycoolboy »

josh2600 wrote: post #26
jandrese wrote: post #11

Earlier quoted context omitted.

From Apple's perspective Qualcomm has been insufficient for a long time for many reasons, the security issues here would only be one of the many factors involved in the decision to do their own development. For what it is worth, a modern chip as complex as the A* series is essentially guaranteed to have vulnerabilities. Maybe not 400, but definitely not 0.

This is a thing I think people constantly underestimate... Intel's cores are not necessarily dramatically more broken than everyone else's chips, they just pay for more auditing and public research.

> they just pay for more auditing and public research.

Who is Intel paying to audit their chips?

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#32

Post by cosmiccatnap »

supernova87a wrote: post #4

I wonder if Apple/others knew about such vulnerabilities, and passed up on using the chip as a risk? Or, was it just dumb luck that they avoided this?

It's more of an obsession with cutting costs to the bare minimum combined with a pretty good deal with ARM. Apple chips have bad just as many issues in terms of security.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#34

Post by phjesusthatguy3 »

BiteCode_dev wrote: post #23
mschuster91 wrote: post #17

Seriously I'm beyond pissed at the state of Android, patches and open-source compliance. If we are lucky 10% of current phone models will get any form of update. The rest will be vulnerable for years until the devices finally break. And that's only the Qualcomm stuff. There is another CPU vendor beginning with M who is big in el-cheapo hardware - look at their Android kernel leaks, wherever you dig you find horrid, H…

Still getting updates for my one plus 6. YMMV.

I just put Android 10 on my OnePlus One (via LineageOS). Best phone I've ever owned.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#35

Post by doytch »

staycoolboy wrote: post #31
josh2600 wrote: post #26

Earlier quoted context omitted.

This is a thing I think people constantly underestimate... Intel's cores are not necessarily dramatically more broken than everyone else's chips, they just pay for more auditing and public research.

> they just pay for more auditing and public research. Who is Intel paying to audit their chips?

Anyone who wants to report something via their bug bounty program.

https://www.intel.com/content/www/us/en/security-center/bug-...

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#36

Post by mohaine »

supernova87a wrote: post #4

I wonder if Apple/others knew about such vulnerabilities, and passed up on using the chip as a risk? Or, was it just dumb luck that they avoided this?

Looking at the slides from a different article, these are not really in the chip per say but in the SDK. So any lib compiled to use the chip would be affected but not really a hardware issue. Basically fuzzy testing found 400 library calls that fail with segfaults. These can sometimes (but not always) be modified to do a takeover, but I didn't see anyone claiming to have done that.

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#38

Post by ReverseCold »

oblio wrote: post #29
josh2600 wrote: post #26

Earlier quoted context omitted.

This is a thing I think people constantly underestimate... Intel's cores are not necessarily dramatically more broken than everyone else's chips, they just pay for more auditing and public research.

Even if they wouldn't, I imagine the exposure is enough. Windows, Android, Linux probably have more eyes on them than all the other software in the world, combined.

"If you want half the world's hackers to audit your code, put it in an Apple product. If you want all the world's hackers to audit your code, put it in a Nintendo product."

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#39

Post by evilos »

f00zz wrote: post #30
mschuster91 wrote: post #17

Seriously I'm beyond pissed at the state of Android, patches and open-source compliance. If we are lucky 10% of current phone models will get any form of update. The rest will be vulnerable for years until the devices finally break. And that's only the Qualcomm stuff. There is another CPU vendor beginning with M who is big in el-cheapo hardware - look at their Android kernel leaks, wherever you dig you find horrid, H…

> horrid, HORRID code Heh, I once found a "feature" in a kernel driver in my Xperia (with a SoC from the company with a name starting in M) that allowed you to read arbitrary kernel memory from userspace, by passing the appropriate structures via a ioctl interface. Didn't even have to dig around too much. Ah well, at least I got a t-shirt from Sony.

The fuck? Is there any documentation for this? CVE?

Re: Over 400 vulnerabilities on Qualcomm’s Snapdragon chip

#40

Post by xen2xen1 »

ReverseCold wrote: post #38
oblio wrote: post #29

Earlier quoted context omitted.

Even if they wouldn't, I imagine the exposure is enough. Windows, Android, Linux probably have more eyes on them than all the other software in the world, combined.

"If you want half the world's hackers to audit your code, put it in an Apple product. If you want all the world's hackers to audit your code, put it in a Nintendo product."

Please tell me where this came from, and that it's not just something you made up?
Post reply on HN