Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Samsung embeds IronSource spyware app on phones across WANA

smex.org

Post reply on HN
Print view View original

371–380 of 500 posts

Re: Samsung embeds IronSource spyware app on phones across WANA

#371

Post by bawolff »

heavyset_go wrote: post #322
michaelt wrote: post #311

Earlier quoted context omitted.

> The much more logical explanation is someone approached a low level employee at the MEAF who turned over a USB stick with the governments org charts and payroll records in exchange for their kids getting a full ride to a prestigious foreign university. If there are spies in foreign countries going around offering life-changing sums of money for USB sticks, which people are accepting is it not also plausible that fo…

Yes, this happens. Industrial espionage is popular. From what I've seen with bribes, it doesn't even take life-changing amounts of money.

I imagine in a country like Iran where there is a sizable minority that hates the regime, someone might have done it for free.

Re: Samsung embeds IronSource spyware app on phones across WANA

#372

Post by Izkata »

johnisgood wrote: post #332
contingencies wrote: post #329

Earlier quoted context omitted.

1. Install android SDK / android studio on your computer. 2. Plug phone in to computer using USBC cable. 3. Answer prompt on phone granting permission to computer. 4. Run adb commands.

Thanks, my issue so far was with the 2nd step, as if my Linux did not recognize my device. I might have a go on Windows if Linux will not work again.

It only works for me with one of my two USB ports, and my Kobo ereader has the same issue. Not sure why, best guess is one might be USB 2.0 and the other 3.0

Re: Samsung embeds IronSource spyware app on phones across WANA

#373

Post by johnisgood »

Izkata wrote: post #372
johnisgood wrote: post #332

Earlier quoted context omitted.

Thanks, my issue so far was with the 2nd step, as if my Linux did not recognize my device. I might have a go on Windows if Linux will not work again.

It only works for me with one of my two USB ports, and my Kobo ereader has the same issue. Not sure why, best guess is one might be USB 2.0 and the other 3.0

That could very well be the issue. We will see. I think I only have 2.0 working right now. I hope it works with 2.0 too. :/

Re: Samsung embeds IronSource spyware app on phones across WANA

#374

Post by beeflet »

smokel wrote: post #348
poisonborz wrote: post #305

Earlier quoted context omitted.

Why? What is the reason root would be dangerous, if it's not the default? People can be scammed to activate it, but those same people can be scammed to click links and give passwords and personal data. Any action requiring root would need a warning and raise suspicion, or put behind an activation mechanism that's complex enough. Anything else and you lose freedom, and the whole ethos that enabled the advanced IT land…

Having root access implies that you can do all sorts of things: change files, install new software, new kernel modules, etc. Locking this down makes the attack surface for malicious parties much smaller. Many exploits start in user-space and then obtain root access to install rootkits. Of course you lose freedom, but that is exactly what is needed, because some people just cannot help themselves from exploiting that…

https://imgs.xkcd.com/comics/authorization.png

>Unless someone figures out a way where we can safely share computing power and connections to real-life services (e.g. banking, having an identity, communication in general), I think there is no real alternative.

I think the opposite is true. We don't have adequate sandboxing of userspace on most desktop OSes. If your malware has access to the victim's home directory and can phone home, they've been pwned for all intents and purposes. Root access would matter if userspace programs were well sandboxed.

On OSes where this is true like android, you have terrible interoperability of userspace programs and it's impossible to get "real work" done. Not to mention that without root access, you are just relying on the corporation to manage your system for you, which isn't tenable for a democracy.

You don't need all of this trusted computing stuff to have secure, private payments. Chaumian ecash and cryptocurrencies have known this for a while. Just use a digital signature scheme instead of relying on open-source information.

Re: Samsung embeds IronSource spyware app on phones across WANA

#375

Post by charcircuit »

tsegers wrote: post #168
charcircuit wrote: post #122

Earlier quoted context omitted.

By following the principle of least privilege. Like with apps the user should only have privileges for what they are allowed to control and nothing more. So if the user should have privilege to disable apps, then the settings app could expose a way for the user to do so. Yes, this is kind of approach of coming up with a design to security instead of going with the easy route of everything being allowed is harder to d…

I believe that the top-level comment you replied to is making the point that there should not be any authority that either allows or disallows what a user can do with the device they own. Purchasing a device should make one that authority, free to decide how much security to trade for how much privilege.

But really it's all about framing. For example on desktop computers it's not possible for people to create new instructions for their CPU to handle. At some layer there will be an API that user needs to use to interact with the device. As times goes on I think it's natural for that layer that users are expected to interact with their device with to become higher level. I believe the top level comment is framing this issue such that current phones don't have an API that matched how it worked for UNIX computers and that is a bad thing. The commenter is too focused on how things worked in the past and doesn't want to allow for things to change.

Re: Samsung embeds IronSource spyware app on phones across WANA

#377

Post by charcircuit »

arendtio wrote: post #194
charcircuit wrote: post #122

Earlier quoted context omitted.

By following the principle of least privilege. Like with apps the user should only have privileges for what they are allowed to control and nothing more. So if the user should have privilege to disable apps, then the settings app could expose a way for the user to do so. Yes, this is kind of approach of coming up with a design to security instead of going with the easy route of everything being allowed is harder to d…

Okay, and how am I going to give the user the right to wipe all software from the device and use a completely custom software? I mean, we all agree that such permissions are not required during everyday operations, but there should be a way for the consumer to have control over the software being used. And I mean all aspects of the software: firmware should be updatable, the OS should be replaceable, and the security…

Sure, but such a product requirement can be made to be legally required without legally requiring root access.

Re: Samsung embeds IronSource spyware app on phones across WANA

#378

Post by catlikesshrimp »

johnisgood wrote: post #332
contingencies wrote: post #329

Earlier quoted context omitted.

1. Install android SDK / android studio on your computer. 2. Plug phone in to computer using USBC cable. 3. Answer prompt on phone granting permission to computer. 4. Run adb commands.

Thanks, my issue so far was with the 2nd step, as if my Linux did not recognize my device. I might have a go on Windows if Linux will not work again.

Knoppix has an old android adb and drivers. Still recognizes Samsung A and chinese androids and is functional.

Other dristros surely offer the same support

Re: Samsung embeds IronSource spyware app on phones across WANA

#379

Post by beeflet »

Atlas667 wrote: post #361
v5v3 wrote: post #147

Earlier quoted context omitted.

Many 'democracies' are not democracies, as you can only really vote for one of 2 parties. The system is fully designed to supress smaller parties and independents. Only countries with regular coalition governments can be classed as a actual democracies.

The will of the masses is NEVER enacted. This is what bourgeois capitalism is. Oh you like phones? Well our phone companies require us to directly or indirectly create proxy wars in this region in order to acquire the raw materials necessary. This is the democracy of western nations: policy hidden behind capitalist interests that the people engage with through consumption. Its democracy for the rich not for the milli…

>Oh you like phones? Well our phone companies require us to directly or indirectly create proxy wars in this region in order to acquire the raw materials necessary.

I think that is the will of the masses.

I've got this fairphone in my pocket that has a replaceable cobalt-free battery and a replaceable OS for a reasonable price. But people by-and-large don't want fairphones, they want iphones.

The third worlders fighting over cobalt don't want peace, they want wealth for themselves.

People don't want niche third parties and alternative stuff, they want to be part of a larger cultural group.

Captialism is based on individual voluntarism, and the problems you describe are not caused by manufactured sentiment but a lack thereof. The problems are caused by the distributed actions of a silent majority, as opposed to some greater rational plan.

Re: Samsung embeds IronSource spyware app on phones across WANA

#380

Post by catlikesshrimp »

grishka wrote: post #8

The "unremovable" part is inaccurate. While you can't completely remove it because it resides on the system partition, you most probably can still disable it with an adb command: adb shell pm uninstall --user 0 com.package.name This command is very powerful as it works for any app, even those that have "disable" greyed out in the settings. I disabled the Galaxy Store on my S9 this way for example.

that doesn't work for every package. Some packages aren't authorized to be disabled this way, i.e. you can't disable them this way. * Some packages can technically be disabled this way, but they cause unrelated issues like the phone wasting processing resources, even overheating the device; or bootloops. * Less relevant, but the package is disabled, but removed. The system can still reenable it, reinstall it, or upgrade it. * Edit: I can't find a way to format this. It shows as a text block.
Post reply on HN