6 ms·

Kernel Vulnerabilities in the Samsung S4

30 points by moviuro 11y ago

GTP 11y ago
I wonder if there are security researchers looking for vulnerabilities in custom roms eg CyanogenMod. I have the impression that they mostly focus on firmwares of well-known brands. I know that now the Cyanogen team has founded Cyanogen Inc and that they have a partnership with Microsoft, but still I don't recall hearing of security issues in CyanogenMod, so I'm wondering if it is really more secure or just not enough researchers are interested in finding holes in it.
- wolfgke 11y ago
  I personally strongly assume that the reason is that the firmware of well-known brands is a lot more static than CyanogenMod. Finding security holes takes a lot of time and if it is updated too often it can easily happen that the bug has been fixed/new bugs have been introduced. Additionally, if you want to write an exploit to prove that the bug is indeed exploitable, you are often back to square one if even some small details change in the firmware. Additionally finding bugs in the firmware of well-known brands carries a lot more prestige than finding bugs in some "hacker project". Sorry, but the more complicated to update an firmware is, the more potential danger lies in finding a similarly dangerous bug. Since CyanogenMod is by definition much easier to upgrade than some not-anymore-supported hardware vendor firmware, the conclusion should be clear.
- on_and_off 11y ago
  there is little practical interest in finding holes in CyanogenMod, so I would bet on the second option.
mschuster91 11y ago
At least Samsung gives us the kernel sources so that the fixes can (and likely will) be backported. Other vendors (I'm looking at you, Mediatek, your code is rotten) are not so good because many OEMs don't care about the GPL and Mediatek supplies the kernel code under NDA to the OEMs.
- pjc50 11y ago
  supplies the kernel code under NDA to the OEMs If this ever came to court, it would be invalidated: either they're infringing the copyright of all the kernel contributors or they're obliged by the GPL to give the source to everyone who has the binary and asks for it.
  - mschuster91 11y ago
    The problem is: whom to sue and where? Court cases in the US are one thing, enforcing them for the shitload of Chinese-manufactured handsets is another!
- darklajid 11y ago
  While you might have a point here I feel bad about praising them. Arguably Samsung is among the worst manufacturers if you care about open source development (I'm looking at my dreaded, crappy, mostly unused S6E and think of all the Exynos love the internet can come up with..). Yes, good that the kernel sources were present. But oh god, they probably did that right by accident.
  - mindslight 11y ago
    I bought an S4 (i9500) within the past year since it's the most recent Exynos that Cyanogenmod runs on. I was only interested in Exynos since the application processor is isolated from the baseband, so that my phone isn't pwnt-by-design by the cell network. You'd think there would be more demand for this these days. Hopefully the deprecation of carrier-specific radios and adoption of LTE will help us there.
- nadams 11y ago
  > Other vendors (I'm looking at you, Mediatek, your code is rotten) are not so good because many OEMs don't care about the GPL and Mediatek supplies the kernel code under NDA to the OEMs. They have pretty bad lawyers if they do this: http://www.gnu.org/licenses/gpl-faq.en.html#DoesTheGPLAllowNDA http://www.gnu.org/licenses/gpl-faq.en.html#DoesTheGPLAllowN... I have a feeling that they have copyrighted source from other vendors in the kernel which prevents them from redistributing the source. I believe this was the problem/downfall of Entourage Edge.

30 points by moviuro 11y ago

GTP 11y ago

I wonder if there are security researchers looking for vulnerabilities in custom roms eg CyanogenMod. I have the impression that they mostly focus on firmwares of well-known brands. I know that now the Cyanogen team has founded Cyanogen Inc and that they have a partnership with Microsoft, but still I don't recall hearing of security issues in CyanogenMod, so I'm wondering if it is really more secure or just not enough researchers are interested in finding holes in it.

wolfgke 11y ago
I personally strongly assume that the reason is that the firmware of well-known brands is a lot more static than CyanogenMod. Finding security holes takes a lot of time and if it is updated too often it can easily happen that the bug has been fixed/new bugs have been introduced. Additionally, if you want to write an exploit to prove that the bug is indeed exploitable, you are often back to square one if even some small details change in the firmware. Additionally finding bugs in the firmware of well-known brands carries a lot more prestige than finding bugs in some "hacker project". Sorry, but the more complicated to update an firmware is, the more potential danger lies in finding a similarly dangerous bug. Since CyanogenMod is by definition much easier to upgrade than some not-anymore-supported hardware vendor firmware, the conclusion should be clear.
on_and_off 11y ago
there is little practical interest in finding holes in CyanogenMod, so I would bet on the second option.

mschuster91 11y ago

At least Samsung gives us the kernel sources so that the fixes can (and likely will) be backported. Other vendors (I'm looking at you, Mediatek, your code is rotten) are not so good because many OEMs don't care about the GPL and Mediatek supplies the kernel code under NDA to the OEMs.

pjc50 11y ago
supplies the kernel code under NDA to the OEMs If this ever came to court, it would be invalidated: either they're infringing the copyright of all the kernel contributors or they're obliged by the GPL to give the source to everyone who has the binary and asks for it.
- mschuster91 11y ago
  The problem is: whom to sue and where? Court cases in the US are one thing, enforcing them for the shitload of Chinese-manufactured handsets is another!
darklajid 11y ago
While you might have a point here I feel bad about praising them. Arguably Samsung is among the worst manufacturers if you care about open source development (I'm looking at my dreaded, crappy, mostly unused S6E and think of all the Exynos love the internet can come up with..). Yes, good that the kernel sources were present. But oh god, they probably did that right by accident.
- mindslight 11y ago
  I bought an S4 (i9500) within the past year since it's the most recent Exynos that Cyanogenmod runs on. I was only interested in Exynos since the application processor is isolated from the baseband, so that my phone isn't pwnt-by-design by the cell network. You'd think there would be more demand for this these days. Hopefully the deprecation of carrier-specific radios and adoption of LTE will help us there.
nadams 11y ago
> Other vendors (I'm looking at you, Mediatek, your code is rotten) are not so good because many OEMs don't care about the GPL and Mediatek supplies the kernel code under NDA to the OEMs. They have pretty bad lawyers if they do this: http://www.gnu.org/licenses/gpl-faq.en.html#DoesTheGPLAllowNDA http://www.gnu.org/licenses/gpl-faq.en.html#DoesTheGPLAllowN... I have a feeling that they have copyrighted source from other vendors in the kernel which prevents them from redistributing the source. I believe this was the problem/downfall of Entourage Edge.