5 ms·
I wonder if there are security researchers looking for vulnerabilities in custom roms eg CyanogenMod. I have the impression that they mostly focus on firmwares
by GTP 11y ago
I wonder if there are security researchers looking for vulnerabilities in custom roms eg CyanogenMod. I have the impression that they mostly focus on firmwares of well-known brands. I know that now the Cyanogen team has founded Cyanogen Inc and that they have a partnership with Microsoft, but still I don't recall hearing of security issues in CyanogenMod, so I'm wondering if it is really more secure or just not enough researchers are interested in finding holes in it.
- wolfgke 11y agoI personally strongly assume that the reason is that the firmware of well-known brands is a lot more static than CyanogenMod. Finding security holes takes a lot of time and if it is updated too often it can easily happen that the bug has been fixed/new bugs have been introduced. Additionally, if you want to write an exploit to prove that the bug is indeed exploitable, you are often back to square one if even some small details change in the firmware. Additionally finding bugs in the firmware of well-known brands carries a lot more prestige than finding bugs in some "hacker project". Sorry, but the more complicated to update an firmware is, the more potential danger lies in finding a similarly dangerous bug. Since CyanogenMod is by definition much easier to upgrade than some not-anymore-supported hardware vendor firmware, the conclusion should be clear.
- on_and_off 11y agothere is little practical interest in finding holes in CyanogenMod, so I would bet on the second option.