Live data from Hacker News

Samsung embeds IronSource spyware app on phones across WANA

smex.org

491–500 of 500 posts

Re: Samsung embeds IronSource spyware app on phones across WANA

#491

Earlier quoted context omitted.

There was mention of GDPR so maybe this only exists for EU phones. --- I just received the data inside an email. It is just a HTML file with the headers "Data Privacy Report" and "Aura Up Privacy Report" but other than that it is empty. Obviously this is all just bullshit to pretend to comply with GDPR.

But we have GDPR here in UK too. Who is the email sender?

[dead]

Re: Samsung embeds IronSource spyware app on phones across WANA

#492

Earlier quoted context omitted.

> what's so difficult about flashing a stock image to a device being serviced? Yes, I think that would cover most cases if we take it to its logical conclusion of wiping all device state (hard disk). OTOH, a few points: 1. I would accept the need to wipe the hard disk if I had messed with firmware or the OS, but not if a couple of keys on the keyboard had stopped working. This implies that (for me at least) a meaning…

I think there's somewhat of a misunderstanding. The suggestion is that warranties not be denied due to user modifications that are unrelated or trivial to revert. It's the logical extension of Magnusun-Moss from aftermarket parts to aftermarket software packages. 1. I expect wiping any given component to be entirely up to the manufacturer's discretion. If doing so is not trivial and is legitimately required for the r…

I like the concept of unrelated modifications remaining under warranty. That seems reasonable and also, crucially, amenable to the usual "Would a reasonable person say that damage X increases the chances of damage Y occurring?" type of test.

I don't like the "intended for general purpose computing" concept so much. For one, it seems to offer lots of easy wiggle room to manufacturers: Just say that your product is not intended for that, but for something marginally more specific. For another, it's not clear to me why general purpose computing ought to enjoy consumer protections that other manufactured devices do not. (One exception I'd grant is for safety reasons: If tinkering with a device could make it cause injury, fine, that device can be in a different class.)

Re: Samsung embeds IronSource spyware app on phones across WANA

#493

Earlier quoted context omitted.

> The third worlders fighting over cobalt don't want peace, they want wealth for themselves. They are enabled into fighting by big, huge interests. They ship them weapons and rationales. Who are the customers in the end? Western nations. They create the abject poverty, they use poor governments to exploit and enslave their own people. There is no "poverty" in the world only exploitation. All poverty is fabricated and…

>They are enabled into fighting by big, huge interests. They ship them weapons and rationales. Weapons and rationales don't fight wars themselves (yet). >Why is it that Mali is one of the poorest nations on earth but is also one of the top 10 exporters of gold? How does that work? Gold is just a shiny rock. No one needs gold to survive and it has few industrial uses. If your only asset is a resource like that, you ar…

> Weapons and rationales don't fight wars themselves (yet).

And people dont fight wars without weapons and rationales.

I am specifically saying that a lot of the chaos in the third world is the result of opposing global-capitalists interests in order to sustain poverty and exploitation for the sake of the first worlds' economies.

> Look at taiwan, japan, ukraine, even isreal. These little nations can leverage greater nations to fight on their behalf by using their industrial capability, even when they are surrounded by enemies.

Those are all nations developed during or after the cold war in regions of conflict. They are not independent nations that developed due to "natural" regional history. They are neocolonial experiments.

They are neo-colonies of a global capitalist hegemony centered in the "west". Taiwan developed from Formosa from the aid of western capitalist nations as a base for defense from China. Israel is the same idea in the middle east. Japan essentially the same thing. Ukraine is currently in their neocolonial war for deciding which capitalist block to align with. These are not true independent nations, they are neocolonial experiments of essentially captive economies.

All this to say: Development is not down to a type of industry alone, it is also due to an economic context. Mali does not develop because it is not allowed to develop. This is what colonialism has done in the global south, this is how they prop up western nations. With slavery, misery and exploitation.

Your analysis of the global south is also what racists use to defend racial capacity while completely ignoring history and current economic contexts.

> You are conflating voluntarism and democracy. Capitalism is voluntaristic, but democratic insofar as wealth is well-distributed.

Ok, so competition and corruption in capitalism always makes capitalism undemocratic and exploitative. This is what we see in the leading nations of the world. Working classes who get the illusion of choice in their democratic institutions.

> You vote with your dollar.

This is one of the oldest lies in the book. It's circular reasoning. If someone else's dollar defines the choices; I'm not voting with my dollar. I'm just buying what I can afford.

> I would make this tradeoff, but I wouldn't be so sure others would, in the large. There are some things that only plastics can do[...]

Nobody wants plastic in their nuts. Plastic cannot be eliminated world wide, but maybe we could stop letting producers get away with not dealing with the trash they produce.

Imagine living in a system where you're allowed to innovate and create products and not deal with the consequences. It's almost as if the system is designed by those producers. Should they be allowed to create trash and not deal with it?

Sure, that's more like bourgeois logic, the voluntarist cop-out that is capitalism.

Remember: I buy what I can afford, they make what they can profit off of.

> The economies of scale and capital costs are not a result of any specific economic system, they are often the result of the realities of production and logistics. These tradeoffs exist even within communist command economies.

You are describing why capitalism is inherently flawed and leads to more and more and more exploitation.

And just to add, command economies is the same as a planned economy. Which we have the tech to build right now. No exploitation needed, because no private profits are allowed. We literally have the tech to create an unexploitable system of production right now.

> The only difference is that in capitalism, it is voluntaristic enough that you have the ability to choose what you do with your own wealth and time. You can affect change gradually, on a small scale.

You literally dont. I literally have to create wealth for someone else in order to eat. That is the opposite of "choose what you do with your own wealth and time". And sure I could find another job, or another. But there are hard limits to choosing a job, as well as hard limits to being your own boss. We can't all be capitalists or indefinitely choose jobs. The billions of us can't be capitalists and we'd all die before we find a job with the perfect trade-offs.

The only way to reconcile this contradiction is to be a classist who truly believes that some people are just doomed to be exploited because of their inherent qualities or lack.

Voluntarism is a cop out from inherent capitalist exploitation.

> Then buy a fairphone or something. You have some options.

A person who believes that wanting a good, cheap phone requires child soldiers, child labor and abject poverty should really re-think what they are doing and promoting in the world. Just because it's far away and detached doesn't mean it isn't real. And remember, we're truly all connected.

I don't judge you for thinking this way tho. This is what the capitalists promote. They literally control the airwaves, and while there is no "soviet" style censorship there is still the actual censorship of monopoly platforms deciding what gets amplified and what doesn't.

Re: Samsung embeds IronSource spyware app on phones across WANA

#494
post #222

Earlier quoted context omitted.

It's a mistake to assume that a very capable country can't get into a network that uses Chinese equipment/software.

It's also a mistake to assume that a very capable country can't get into a network that uses US equipment/software... especially Cisco equipment with all the "forgotten" hardcoded logins. Iran is better off with Chinese equipment than American or Korean.

Who made that assumption? The comment I replied to said that the network deployed by S. Korean firms was compromised and implied that the one from China was safe. I'm just pointing out that using Huawei or ZTE won't stop a country like Israel.

Re: Samsung embeds IronSource spyware app on phones across WANA

#495

Earlier quoted context omitted.

> Was situation in Tibet really good before China came? Well I imagine there was a lot less persecution by the Chinese government at that time. > media are not interested in enlightening people You're right, the media in China are mostly or exclusively mouthpieces for the state.

> Well I imagine there was a lot less persecution by the Chinese government at that time. Is feudal society with slavery and human sacrifices better? How can we really be sure about more or less persecution by Chinese government if we don't live in Tibet, do not know Tibetan and Chinese, and all we know about those "persecutions" are somebody else's translated words? > You're right, the media in China are mostly or e…

> How can we really be sure about more or less persecution by Chinese government if we don't live in Tibet

You're conflating your lack of knowledge about the subject with a general lack of knowledge about the subject; those are not the same.

> You're right, the media are mostly or exclusively mouthpieces for the state. FTFY. There are not exceptions anywhere in the world.

That's a false equivalence; yes, most or all countries' governments have captured the press to some extent, but the degree to which it happens varies wildly by country, and again the fact that you don't see that speaks more to your own experiences than any objective reality.

Re: Samsung embeds IronSource spyware app on phones across WANA

#496

Earlier quoted context omitted.

They're for the bank's (and other customers') security, not yours. I think they're supposed to prevent people from reverse-engineering banking app APIs and writing bots that perform millions of requests per second, trying to brute force their way into peoples' accounts. As an extra protection, SafetyNet also makes it harder to distribute apps that repackage your genuine banking app, but with an extra trojan added.

Every bank of repute also has a web portal for internet banking. If it were about security, leaving this open while closing the mobile route doesn't make sense. The web is also vulnerable to scammers hosting trojan websites but somehow that doesn't seem to be a big problem. If a bank (or any entity for that matter) needs to control the client in order to make their systems secure, then it's bad security. The system m…

This depends on the bank and the country, but web portals usually have some kind of 2FA on them. This means hacking into somebody's web portal account isn't enough, you still need to hack that mobile device first.

Re: Samsung embeds IronSource spyware app on phones across WANA

#497

Earlier quoted context omitted.

Having your vehicle serviced by someone other than the dealer could void your warranty and poses a safety risk. Cooking animal products at home poses a health risk. You should be sure to only ever consume animal products prepared by a duly licensed establishment. The chauffeur's union would like to take this opportunity to remind you that amateurs operating their own motor vehicles risk serious injury and even death.…

> Having your vehicle serviced by someone other than the dealer could void your warranty and poses a safety risk Good tongue in cheek post, but in the US Magnuson-Moss prohibits warranty claim denials merely on the basis of non-OEM parts and service. It also puts the burden on the manufacturer to demonstrate the defect or failure was the direct result of the non-OEM part. Other jurisdictions have similar laws on the…

OP was making the same comparison. Voiding a warranty by merely rooting something is illegal under the Magnuson-Moss Warranty Act.

The problem is getting the companies to change their act, and they probably won't without a class action lawsuit, and I have no idea if there's enough financial incentive there for a law firm to tackle it.

Re: Samsung embeds IronSource spyware app on phones across WANA

#498
post #8

The "unremovable" part is inaccurate. While you can't completely remove it because it resides on the system partition, you most probably can still disable it with an adb command: adb shell pm uninstall --user 0 com.package.name This command is very powerful as it works for any app, even those that have "disable" greyed out in the settings. I disabled the Galaxy Store on my S9 this way for example.

OK, I see that one can get a list of all installed packages via adb: $ pm list packages How does one know which are safe to disable? In the sense that there won't be unexpected side effects. Besides, not all the names make clear exactly what the package is for.

Each one needs inspected one by one - but there is always the chance that package names have been purposefully obfuscated. It's really quite the uphill battle.

Re: Samsung embeds IronSource spyware app on phones across WANA

#499
post #17
post #2

Buying a device that only runs OEN Android is ridiculous for this exact reason. We need to decouple phone hardware from phone software, as we did with computers.

We do, but I don't see it happening anytime soon. Many banking / government apps and even some games use the Play Integrity API, which AFAIK is starting to require remote attestation for newer devices. As it's usually not viable to opt-out of those, the solution seems to be having a separate device.

Fortunately (or unfortunately depending on your perspective), Play Integrity is bit of a joke at the moment thanks to a group of OEMs who just can't seem to secure their private keys. Unrevoked keyboxes are publicly available.

Re: Samsung embeds IronSource spyware app on phones across WANA

#500
post #383

Earlier quoted context omitted.

This has been going on in Russia on massive scale. For bribes officials sells anything including highly sensitive databases. Those were used to uncover various Kremlin-run assassins targeting oppositions. Then Ukrainian special services used those to target high-ranking Russian military officers. Russia tried to crack down on that but it just increased the database price tag.

Do you have sources for that? No problem if they're not in English.

This is sufficiently-well established presently that it's almost hard to find specific documentation as it's largely accepted fact. I'm finding few hits post-2019, so it's possible that data practices have improved.

WNYC's On the Media carried several interviews with a documentarian filming Alexy Navalny as Navalny and the documentarian team identified Navalny's (initial) would-be assassins, including various FSB agents. They specifically targeted a person they'd think might have weak opsec, a scientist directly engaged in producing nerve agents (novichok IIRC). His core competence was chemistry rather than spycraft. The documentary team included a former Bellingcat investigator:

Brooke Gladstone: In the months following Navalny's poisoning, Christo Grozev, former lead Russia investigator at Bellingcat, was stuck in Vienna with filmmaker Daniel Roher. The two had just been booted from Ukraine where they had been trying to film an investigation. Now Grozev had lots of time on his hands and a laptop and a fresh stack of data from the Russian black market....

Christo Grozev: When we were looking at the Navalny poisoning, we thought, "Well, they must have used the same scientists. They can't have hundreds of scientists who do this. This has to be kept top secret. These people have to take the risk to manufacture this toxin." I started looking at the phone records of these scientists, and we bought them on the Russian markets where you can buy absolutely any kind of data.... [Navalny's people] provided the data of how Navalny had traveled to what locations. I matched it to the known travel data of the poisoners and spies. We saw this pattern, essentially a group of six to eight FSB poisoners had been tailing him for more than four years to a total of 66 different towns and cities.

https://www.wnycstudios.org/podcasts/otm/episodes/revisiting...>

Other general coverage (searching "russia black market data"):

"Russian data theft: Shady world where all is for sale" (26 May 2019)

According to cyber-security experts, vast quantities of supposedly private data - including from Russian state institutions - are bought and sold every day....

https://www.bbc.com/news/world-europe-48348307>

And for a long time. From 2009:

Goldmine of black market in Russian data

Gorbushka Market, just outside central Moscow, does a thriving trade in any electronics good you could want: mobile phones, plasma television sets, the latest DVDs, and, if you ask to see them, software peddlers will show potential clients a list of “databases”.

These consist of CDs with names such as “Ministry of Interior – Federal Road Safety Service”, “Tax Service” and “Federal Anti-Narcotics Service” and cost about $100 apiece. Each contains confidential information gathered by Russian law enforcement or government agencies: anything from arrest records, personal addresses, passport numbers, phone records or address books to bank account details, known associates, tax data and flight records are on offer...

https://www.ft.com/content/07dedd34-d921-11de-b2d5-00144feab...>

Archive: https://archive.is/UPPHK>

And 2005:

"In the stolen-data trade, Moscow is the Wild East"

https://web.archive.org/web/20050708015611/http://www.globet...>

Adjacent article on Bellingcat OSINT generally (2024), though nothing on black markets:

"The forensic empire that is Bellingcat"

https://www.theprojectcounselgroup.com/2024/06/19/the-forens...>

Post reply on HN