Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A 0-click exploit chain for the Pixel 10

projectzero.google

Post reply on HN
Print view View original

81–90 of 255 posts

Re: A 0-click exploit chain for the Pixel 10

#81

Post by ainch »

jcims wrote: post #51
revolvingthrow wrote: post #6

Semi-related: has the rate of published exploits picked up as if late, or is it simply the fact that there’s hype around ai as security tool (offense or defense) so it’s simply in the news more often? Feels like there’s something new every other day - linux, windows, mobile, various commonplace tools used by everybody, the list goes on

I just did some analysis on this last weekend, in 2024 there were roughly 100 CVEs published every day. In April we hit approximately 200 per day. Going backwards from 2023, the doubling interval for published CVEs was approximately 4 to 4 1/2 years. Since then it’s approximately two years. There has definitely been a rapid uptick.

Did you publish this anywhere? Would love to read more.

Re: A 0-click exploit chain for the Pixel 10

#82

Post by nekitamo »

greesil wrote: post #4

"This is notably fast given that this is the first time that an Android driver bug I reported was patched within 90 days of the vendor first learning about the vulnerability." This makes me feel better about Google, but also makes me kind of frightened of the rest of Android. I wonder what Apple's response time is?

Given that 42% of Android devices are unpatched as of now [1] it's an interesting decision on their part to release their research and make them all vulnerable

[1] https://gs.statcounter.com/android-version-market-share [2] https://www.cybersecurity-insiders.com/survey-reveals-over-1...

Re: A 0-click exploit chain for the Pixel 10

#83

Post by kotaKat »

krupan wrote: post #66

I followed the link to the Pixel 9 bug/exploit and saw this: "Over the past few years, several AI-powered features have been added to mobile phones that allow users to better search and understand their messages. One effect of this change is increased 0-click attack surface, as efficient analysis often requires message media to be decoded before the message is opened by the user" Haven't we learned our lesson on this…

"But the users never know what they want to do! We have to shove suggestions and recommendations at them at every! waking! moment!"

Re: A 0-click exploit chain for the Pixel 10

#84

Post by kube-system »

greesil wrote: post #4

"This is notably fast given that this is the first time that an Android driver bug I reported was patched within 90 days of the vendor first learning about the vulnerability." This makes me feel better about Google, but also makes me kind of frightened of the rest of Android. I wonder what Apple's response time is?

On brand-name android devices you can count on getting OS security updates. The first-party vendor can build and push these themselves. Driver and firmware security updates are a maybe. These often have to come from an upstream vendor, who may or may not care to fix the issues.

Smaller brands often ship budget android devices and never update them.

Re: A 0-click exploit chain for the Pixel 10

#85

Post by kube-system »

nekitamo wrote: post #82
greesil wrote: post #4

"This is notably fast given that this is the first time that an Android driver bug I reported was patched within 90 days of the vendor first learning about the vulnerability." This makes me feel better about Google, but also makes me kind of frightened of the rest of Android. I wonder what Apple's response time is?

Given that 42% of Android devices are unpatched as of now [1] it's an interesting decision on their part to release their research and make them all vulnerable [1] https://gs.statcounter.com/android-version-market-share [2] https://www.cybersecurity-insiders.com/survey-reveals-over-1...

That's perennially the case. A big portion of the world buys bargain-basement android devices that are unsupported right out of the box.

Search "android phone" on aliexpress and there's top selling phones on the first page running android 8, android 10, etc. They're not getting security updates of any sort, let alone driver updates.

Re: A 0-click exploit chain for the Pixel 10

#86

Post by tucnak »

orf wrote: post #62
mark_l_watson wrote: post #58

Earlier quoted context omitted.

Not sure how much it helps, but I just run all my Apple devices in "Lockdown mode", don't install apps (use Safari), and try to mostly use Safari in private sandboxed mode.

This makes sense if you’re a human-rights journalist working in a dangerous country, with the threat of state-level actors looking to compromise you. If you’re not then this seems quite paranoid, bordering on LARPing.

I thought it was common knowledge that all kinds of Americans (not to mention other nations) are routinely compromised with zero-clicks, mostly developed in the US and Israel.

Re: A 0-click exploit chain for the Pixel 10

#87

Post by StilesCrisis »

Aachen wrote: post #55
StilesCrisis wrote: post #21

Earlier quoted context omitted.

It's easy to be secure if you just remove features. There's obvious tension here.

Could you be any more specific about what features they've removed such that the hardening functions work? Because I think there are none

They're quite open about it. https://grapheneos.org/features#attack-surface-reduction

Re: A 0-click exploit chain for the Pixel 10

#88

Post by bayesnet »

tucnak wrote: post #86
orf wrote: post #62

Earlier quoted context omitted.

This makes sense if you’re a human-rights journalist working in a dangerous country, with the threat of state-level actors looking to compromise you. If you’re not then this seems quite paranoid, bordering on LARPing.

I thought it was common knowledge that all kinds of Americans (not to mention other nations) are routinely compromised with zero-clicks, mostly developed in the US and Israel.

This is the kind of assertion without evidence that just muddies the waters. “All kinds” of people is so vague as to be an almost entirely vacuous category and “routine” means almost nothing without an actual quantification of how prevalent and frequent the problem is.

It’s undeniable that the proverbial guns for hire make it easy (if not cheap) to target basically anyone — but just because the vibes are bad doesn’t mean we can just say “it’s common knowledge that …”

The fact is mitigations are costly in terms of convenience and ease of use. Helping people make informed choices about whether to enable mitigations and bear that cost requires more than platitudes imo

Re: A 0-click exploit chain for the Pixel 10

#90

Post by [deleted] »

lightedman wrote: post #76
orf wrote: post #62

Earlier quoted context omitted.

This makes sense if you’re a human-rights journalist working in a dangerous country, with the threat of state-level actors looking to compromise you. If you’re not then this seems quite paranoid, bordering on LARPing.

"If you’re not then this seems quite paranoid, bordering on LARPing." There are sooooooo many other situations where such device lockdown is warranted. Government intrusion, sensitive industry, journalism, anything ITAR/EAR covered, and more. Your reduction to a single issue is absurd.

[deleted]
Post reply on HN