81–90 of 170 posts
What's the big deal? Google does this on a much bigger scale and of course shares its data with the US government when asked. Why is it suddenly scary when a Chinese company does the same?
cough
Huawei routers used in Indian govt offices were found to be sending data to China. They were banned after the discovery. Wont be surprised if cellular components that are made in China send back data quietly.
People at HN would appreciate the corresponding links...
You cannot have privacy and security without free/libre software. While such doesn't doesn't guarantee privacy or security, operating systems that make an effort to build the system entirely from source without any proprietary components are much less likely to have a problem like this slip through the cracks of a large, active development community. Unfortunately, currently the only Android operating system to do th…
That's the old open source argument. And while many things could most certainly be discovered by extensive, costly audits, that someone has to pay for... OS code bases are huge. How difficult would it be to hide functionality like this in some obscure code that's camouflaged as something else? How hard would it be to automatically install an app that does this after first boot, disguised as some self updating or anal…
But even without such a campaign, evil developers would be in a constant danger that someone may discover a backdoor. It is a very unstable situation: just one person is enough to make a lot of noise, and everyone could be this person. And yes, people do read the sources:
https://www.fsf.org/blogs/community/who-actually-reads-the-c...
It's all about defense in depth:
https://en.wikipedia.org/wiki/Defense_in_depth_%28computing%...
H guys, I'm one of the researchers with kryptowire if you have any questions
I've got two phones here that were used during my trip there. I was wondering if you had any tips for figuring out of they were compromised or otherwise owned while I was out there.
It also has an auto-update (read: backdoor) feature that cannot be disabled.
I ended up making a linux-based whitelist firewall to access the Internet but it is pretty inconvinient because I have to manually enable every new host. And I can use it only at home.
As a consumer I am very disappointed and feel being deceived by Google. I know about "you are the product" saying but the smartphone is not free. I bought an expensive (two hundred dollars!) device and I had to spend a lot of my time to be able to control its activity. And of course the advertisement never mentioned that a smartphone is going to spy on me.
We need a law against this.
You cannot have privacy and security without free/libre software. While such doesn't doesn't guarantee privacy or security, operating systems that make an effort to build the system entirely from source without any proprietary components are much less likely to have a problem like this slip through the cracks of a large, active development community. Unfortunately, currently the only Android operating system to do th…
That's the old open source argument. And while many things could most certainly be discovered by extensive, costly audits, that someone has to pay for... OS code bases are huge. How difficult would it be to hide functionality like this in some obscure code that's camouflaged as something else? How hard would it be to automatically install an app that does this after first boot, disguised as some self updating or anal…
Projects have the option to only accept contributions from known entities. If your identity is public knowledge, trying to sneak a backdoor into version control is high-risk.
Openness is viable stratagem for hardening and reducing the attack surface. It does not have to be perfect to make meaningful improvements towards a layered defense.
Earlier quoted context omitted.
We did work with DHS and notify all the parties ahead of the press release. We also remember carrierIQ ! We have a comparison table here: http://www.kryptowire.com/adups_security_analysis.html
So you didn't tell the Federal Trade Commission, even though they previously investigated (and punished) HTC for doing something similar?
I wonder if many security researchers know to routinely shop their findings to multiple agencies independently. It doesn't seem like this is common knowledge.
I have a chinese Android phone. Instead of connecting it to the Internet I connected it to my computer over bluetooth and started monitoring the traffic it tried to send. There were attempts to connect to Google servers and chinese manufacturer's servers. The data sent to China was supposed to contain sensitive information like phone number or SIM card identifier. It also has an auto-update (read: backdoor) feature t…