15 ms·

Thanks for making this comment. This post is a wonderful example of the rampant marketing that has given the security industry a bad name. - The title is techn

by dsacco 10y ago

Thanks for making this comment. This post is a wonderful example of the rampant marketing that has given the security industry a bad name. - The title is technically accurate, which is the best kind of accurate for clickbait. This is not a novel vulnerability representative of an application security flaw within Google - the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here. - There's a logo and cute name for something which is, again, not a novel vulnerability.[2] - Scaremongering tactics are used throughout to hype up the finding.[3][4] Deliberately ominous language like "...for now" is perhaps tolerable when it's coming from a media outlet, but it's certainly unacceptable from a firm conducting original security research. All things told, this is closer to "threat intelligence" than real security research. A much better source for this news is the blog post by Google's Director of Android Security, Adrian Ludwig (first footnote, linked elsewhere in this thread as well). In particular, notice the succinctness and the serious, yet detached professionalism associated with the post. In any case, there are legitimate arguments to be made in favor of extending software or device support lifetimes for vulnerability patches, but the onus is on device manufacturers to coordinate this. In the meantime, it would be great if fewer firms practiced this sort of manic self-promotion, but unfortunately there's little incentive not to. ------- 1. https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi 2. http://blog.checkpoint.com/wp-content/uploads/2016/11/goo_blog.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/goo_bl... 3. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_4_REVISED_11.23.16.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/info_4... 4. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_2_REVISED-11.23.16-Copy.jpg http://blog.checkpoint.com/wp-content/uploads/2016/11/info_2...

mola 10y ago
In a similar vain a Google employee has a very obvious incentive to downplay this campaign.
zepto 10y ago
The fact that most consumers aren't aware they most Android devices are susceptible to these kind of vulnerability argues for more noise about these issues - not calming press releases talking about how the issues are moot with the latest build.
- FT_intern 10y ago
  > The fact that most consumers aren't aware they most Android devices are susceptible Are they really? I've assumed that I'm taking the same risks installing an app on Android as running a .exe on Windows.
  - zepto 10y ago
    Do you think that most of the other billion Android users know what an .exe is?
Pxtl 10y ago
That's not to say Google has no responsibility in this. Google's OS has a terrible security-update policy. Being able to buy a new computing device from a store that will receive no security updates is terrible, and is fairly common in Android devices. Now, there are valid technical reasons that Google can't be as good as Microsoft at pushing out updates to every device running their OS, but still, it's hard to say that Google has made fixing this problem a priority. Even their own 1st-party devices have a pathetic 2-year upgrade window from launch, which, I'll remind you, still means somebody can buy last year's device on a store shelf and stop getting security updates before the device is even out of warranty.
- Kurtz79 10y ago
  Google in most cases is not the device's manufacturer, and in a mobile device OS and application SW are tightly coupled, so you cannot really have OS updates separate from firmware updates, bypassing the actual manufacturer's own updates. Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own, and actually it is one of the selling points of their new phone. In addition, at least in the US, devices connecting to a cellular network have to go through a certification process, enforced by the carriers, and every firmware update requires additional regression testing (time and money) for the device to be admitted on the network again. (That's my guess of why Lenovo dropped the policy of fast updates for Moto phones when they bought Motorola)
  - jdietrich 10y ago
    Google have an approval system before they allow a manufacturer to bundle Google services. Update mechanisms could easily be built into that approval process. I suspect that they haven't turned the screws too hard on manufacturers for fear of Samsung or LG making an Amazon-style fork. Google have already drawn their own roadmap with the Android One project - a number of low-end manufacturers have devices that get updates directly from Google. They could easily create a Nexus-type brand that manufacturers can opt into, guaranteeing timely updates and long-term support. This could be a big draw for mid-tier manufacturers. https://en.wikipedia.org/wiki/Android_One https://en.wikipedia.org/wiki/Android_One
ksk 10y ago
>the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here. That is a false statement where you are implying a certainty that has not yet been established. A Google employee says that as far as they have been able to investigate, several variants use known vulnerabilities. In any case, there is indeed a giant security flaw when an application executing in a supposed sandbox can get root access. It points to severe design flaws in the application model as well as the underlying OS. The fact that elevation of privilege is almost expected should be unacceptable. Given the terrible state of security updates in Android, I would say it is worth drawing as much publicity as possible to these events.
rudolf0 10y ago
Checkpoint has been notorious for this kind of exaggerated marketing, especially within the past few years. My theory is that their security appliance line has been suffering due to superior competitors (source: personal experience; could be wrong without global sales numbers), so I think they're trying to get their name back in people's minds. This research is definitely good and beneficial, but yes, it's threat intelligence research, not vulnerability research or any sort of revelation. Definitely not deserving of a logo.
- danielweber 10y ago
  Years and years ago I went out searching for UMD devices vulnerable to CSRF. They universally were, but the only vendor that responded to my email was CheckPoint, who admitted it and said they were working on a fix. (They had the fix released soon, too.) Everyone else was 100% silent treatment.
  - rudolf0 10y ago
    What % of the devices you tested were security appliances? It's good Checkpoint did that, but you would expect most security companies to care a lot more about patching their devices relative to all of the other various network device manufacturers out there.
    - danielweber 10y ago
      I should have said "UTM" devices, not "UMD" devices. So all of them were security devices. One company accused me of gaining access to a private development build. That was fun.
abalone 10y ago
I'd argue the opposite. It's this dismissive attitude about a vulnerability affecting 1M+ accounts that is the problem in some sectors of the security industry. You're drawing arbitrary lines around what Google is responsible for and what the user is responsible for, and ultimately blaming the user for having an "older device". But guess what? This problem doesn't affect iOS products anywhere nearly as much, even though there are hundreds of millions of older devices in use. That's because Apple took an approach that allowed them to ensure devices stay up to date. Google didn't. And that's as important to security as is UX design and all the other often-dismissed factors that go into achieving successful security outcomes.

by dsacco 10y ago

mola 10y ago

In a similar vain a Google employee has a very obvious incentive to downplay this campaign.

zepto 10y ago

The fact that most consumers aren't aware they most Android devices are susceptible to these kind of vulnerability argues for more noise about these issues - not calming press releases talking about how the issues are moot with the latest build.

FT_intern 10y ago
> The fact that most consumers aren't aware they most Android devices are susceptible Are they really? I've assumed that I'm taking the same risks installing an app on Android as running a .exe on Windows.
- zepto 10y ago
  Do you think that most of the other billion Android users know what an .exe is?

Pxtl 10y ago

That's not to say Google has no responsibility in this. Google's OS has a terrible security-update policy. Being able to buy a new computing device from a store that will receive no security updates is terrible, and is fairly common in Android devices. Now, there are valid technical reasons that Google can't be as good as Microsoft at pushing out updates to every device running their OS, but still, it's hard to say that Google has made fixing this problem a priority. Even their own 1st-party devices have a pathetic 2-year upgrade window from launch, which, I'll remind you, still means somebody can buy last year's device on a store shelf and stop getting security updates before the device is even out of warranty.

Kurtz79 10y ago
Google in most cases is not the device's manufacturer, and in a mobile device OS and application SW are tightly coupled, so you cannot really have OS updates separate from firmware updates, bypassing the actual manufacturer's own updates. Google (and Apple and Microsoft) can totally do it for devices that manufactures and maintains on its own, and actually it is one of the selling points of their new phone. In addition, at least in the US, devices connecting to a cellular network have to go through a certification process, enforced by the carriers, and every firmware update requires additional regression testing (time and money) for the device to be admitted on the network again. (That's my guess of why Lenovo dropped the policy of fast updates for Moto phones when they bought Motorola)
- jdietrich 10y ago
  Google have an approval system before they allow a manufacturer to bundle Google services. Update mechanisms could easily be built into that approval process. I suspect that they haven't turned the screws too hard on manufacturers for fear of Samsung or LG making an Amazon-style fork. Google have already drawn their own roadmap with the Android One project - a number of low-end manufacturers have devices that get updates directly from Google. They could easily create a Nexus-type brand that manufacturers can opt into, guaranteeing timely updates and long-term support. This could be a big draw for mid-tier manufacturers. https://en.wikipedia.org/wiki/Android_One https://en.wikipedia.org/wiki/Android_One

ksk 10y ago

>the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here. That is a false statement where you are implying a certainty that has not yet been established. A Google employee says that as far as they have been able to investigate, several variants use known vulnerabilities. In any case, there is indeed a giant security flaw when an application executing in a supposed sandbox can get root access. It points to severe design flaws in the application model as well as the underlying OS. The fact that elevation of privilege is almost expected should be unacceptable. Given the terrible state of security updates in Android, I would say it is worth drawing as much publicity as possible to these events.

rudolf0 10y ago

Checkpoint has been notorious for this kind of exaggerated marketing, especially within the past few years. My theory is that their security appliance line has been suffering due to superior competitors (source: personal experience; could be wrong without global sales numbers), so I think they're trying to get their name back in people's minds. This research is definitely good and beneficial, but yes, it's threat intelligence research, not vulnerability research or any sort of revelation. Definitely not deserving of a logo.

danielweber 10y ago
Years and years ago I went out searching for UMD devices vulnerable to CSRF. They universally were, but the only vendor that responded to my email was CheckPoint, who admitted it and said they were working on a fix. (They had the fix released soon, too.) Everyone else was 100% silent treatment.
- rudolf0 10y ago
  What % of the devices you tested were security appliances? It's good Checkpoint did that, but you would expect most security companies to care a lot more about patching their devices relative to all of the other various network device manufacturers out there.
  - danielweber 10y ago
    I should have said "UTM" devices, not "UMD" devices. So all of them were security devices. One company accused me of gaining access to a private development build. That was fun.

abalone 10y ago

I'd argue the opposite. It's this dismissive attitude about a vulnerability affecting 1M+ accounts that is the problem in some sectors of the security industry. You're drawing arbitrary lines around what Google is responsible for and what the user is responsible for, and ultimately blaming the user for having an "older device". But guess what? This problem doesn't affect iOS products anywhere nearly as much, even though there are hundreds of millions of older devices in use. That's because Apple took an approach that allowed them to ensure devices stay up to date. Google didn't. And that's as important to security as is UX design and all the other often-dismissed factors that go into achieving successful security outcomes.