Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

thenextweb.com

Post reply on HN
Print view View original

41–50 of 236 posts

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#41

Post by scarface74 »

zmmmmm wrote: post #35
klingonopera wrote: post #30

> However, if you install an application from an untrusted source, attackers can take advantage of that. I'm slightly confused: Do they mean any app or a compromised app?

Yes, it's frustrating when people casually conflate using any alternative source of apps than official app stores with actual malicious application sources. The reality is, you don't need to "trust" the source in general, you just need to trust that the source is not malicious. If the source is untrusted but you have faith it is not malicious then you can rely on Android's built in permissions system to protect you f…

Android’s built in permission system didn’t work too well with the Fortnite installer

https://www.pcmag.com/news/363357/google-irks-epic-games-by-...

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#42

Post by detaro »

mehrdadn wrote: post #33
detaro wrote: post #29

Earlier quoted context omitted.

> How many consumers across the world would actually be at risk… We don't know, because we don't know who bought it and how widespread they deployed it.

Oh come on. We can never know with 100% certainty. But they already know the company is selling to authorities, not random people. Can't we make an educated guess here?

I don't know - I can't, maybe Google/other researchers can. But true, my comment was a bit needlessly glib.

It also seems like you could discover the bug from public sources - it had been created and fixed in the kernel. Apparently at the time not registered as a security issue, but review could discover the link and check for Android's not having the fix.

In the case of Android, "just tell the vendor" is also kind of awkward: There's dozens, if not hundreds of those. If there's an active threat, it's kind of hard to justify not to inform all of them, but could you trust an embargo over so many parties?

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#43

Post by typical182 »

creato wrote: post #13
typical182 wrote: post #6

Earlier quoted context omitted.

Well, one thing is it was apparently already publicly reported over 2 years ago by syzkaller: https://twitter.com/dvyukov/status/1180195777680986113

That was apparently fixed? > No longer occurring on linux-next, probably fixed by the following commit: > #syz fix: ANDROID: binder: remove waitqueue when thread exits. https://groups.google.com/forum/#!msg/syzkaller-bugs/QyXdgUh...

Yes, fixed upstream near start of 2018, but apparently never merged back to various “stable” kernels.

See for example:

https://mobile.twitter.com/grsecurity/status/118005953923380...

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#44

Post by GeekyBear »

arusahni wrote: post #40

After the recent disclosures about Apple vulnerabilities, I've seen a lot of (unwarranted, in my opinion) criticism from HN of Project Zero, specifically the accusation of non-Google bias. For those who hold this position, does this affect your stance?

Wasn't this a case where members of the Project Zero team were individually commenting in a Chromium bug thread and not a Project Zero public facing blog post?

Was there a Project Zero blog post before those comments went public that I missed?

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#45

Post by shrimp_emoji »

notmokjklhr wrote: post #31
userbinator wrote: post #22

This is another great chance to root your phone and take complete control of what you should rightly own.

And your chance to share this complete control with every installed app. Phones should be like desktop computers. You install an app, you give it access to everything your account can touch on the computer.

SHOULD desktop apps be like this? :D

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#46

Post by vengefulduck »

zelly wrote: post #37
notmokjklhr wrote: post #31

Earlier quoted context omitted.

And your chance to share this complete control with every installed app. Phones should be like desktop computers. You install an app, you give it access to everything your account can touch on the computer.

Android has one of the best security models and sandboxing for apps. It's based around SELinux.

Which this vulnerability bypasses, so kinda a moot point.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#47

Post by msbarnett »

mehrdadn wrote: post #20
jdm2212 wrote: post #11

Earlier quoted context omitted.

It's being actively exploited, which changes the calculus.

"Actively exploited" by... law enforcement? Do all consumers really need to freak out about this the same way they would if hackers had access? Doesn't that detail change the calculus here?

> "Actively exploited" by... law enforcement

"Actively exploited" by at least law enforcement. It’s sheer folly to presume that if one motivated group has already discovered this that nonetheless somehow others won’t have as well.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#48

Post by jdnenej »

shrimp_emoji wrote: post #45
notmokjklhr wrote: post #31

Earlier quoted context omitted.

And your chance to share this complete control with every installed app. Phones should be like desktop computers. You install an app, you give it access to everything your account can touch on the computer.

SHOULD desktop apps be like this? :D

Absolutely not. It's an outdated concept from the days where all the software you run was either preinstalled or you created it yourself and the only security consideration was stopping you from messing up another users setup on the shared computer.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#49

Post by mercora »

scarface74 wrote: post #41
zmmmmm wrote: post #35

Earlier quoted context omitted.

Yes, it's frustrating when people casually conflate using any alternative source of apps than official app stores with actual malicious application sources. The reality is, you don't need to "trust" the source in general, you just need to trust that the source is not malicious. If the source is untrusted but you have faith it is not malicious then you can rely on Android's built in permissions system to protect you f…

Android’s built in permission system didn’t work too well with the Fortnite installer https://www.pcmag.com/news/363357/google-irks-epic-games-by-...

this has nothing to do with androids permission system at all... epic made the decision to distribute Fortnite themselves while bypassing the Play Store in order to save on the 30% cut google would otherwise get from game sales. This worked by installing an app manually that did download the game and installs or updates it afterwards. This installer had a serious flaw allowing malicious apps to install other software by abusing rights the installer had gained to install or update the game.

You could claim google has been irresponsible for publishing technical details about this flaw in epics installer too early but it still has nothing to do with Androids permission system.

Re: Google, Xiaomi, and Huawei affected by zero-day flaw that unlocks root access

#50

Post by fireattack »

GeekyBear wrote: post #44
arusahni wrote: post #40

After the recent disclosures about Apple vulnerabilities, I've seen a lot of (unwarranted, in my opinion) criticism from HN of Project Zero, specifically the accusation of non-Google bias. For those who hold this position, does this affect your stance?

Wasn't this a case where members of the Project Zero team were individually commenting in a Chromium bug thread and not a Project Zero public facing blog post? Was there a Project Zero blog post before those comments went public that I missed?

It's not a "Chromium" bug, it's project-zero bug [1]. https://bugs.chromium.org/ is just a bug tracker site to host batch of projects by Google. While most of them are related to Chromium, there are also things like project-zero.

[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=19...

Post reply on HN