7 ms·

How ironic. Yesterday on HN someone said "Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Micro

by mrb 10y ago

How ironic. Yesterday on HN someone said "Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Microsoft. You've got an even bigger and more complicated mess to clean up, you dug the hole yourself, it's going to take you longer, and you should have started on it years ago" [1] And today we have this very impressive counter-example of Google putting some engineers to work for months doing vuln research for making, in the end, EVERYONE safer: Apple users, Samsung users, and hundreds of other mobile device vendors who use this popular Broadcom Wi-Fi chipset in products shipped to 1B+ users. But no, somehow, tomorrow again it is going to be all Google's faults that Android-derived commercial works are insecure and poorly maintained by their respective vendors. [1] https://news.ycombinator.com/item?id=14023969 https://news.ycombinator.com/item?id=14023969

berberous 10y ago
Google has 57,000 employees. There is always going to be some good, some bad, in an organization that size. The Project Zero team is excellent and we should all be grateful for their work. But we should also continue to hold Google's feet to the fire on the state of Android security, since it is truly a mess, and they are probably the only player to have the power and ability to fix it.
- mrb 10y ago
  Android is open source and has a permissive license. Fundamentally this means Google cannot prevent manufacturers like Samsung from shipping insecure phones receiving infrequent software updates. I am curious as to what you think Google "should" do? Make Android closed source like iOS and ship it as binary blobs and a license forcing manufacturers to ship sw updates exactly when Google says to do so? You think phone manufacturers would agree to that? They would promptly fork off the last open source Android and rarely take Google's subsequent updates. If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates.
  - wtallis 10y ago
    Google has substantial leverage with the Android trademarks and the Play store ecosystem.
    - tastythrowaway2 10y ago
      This. Parent post doesn't realize this basic architectural advantage that should be leveraged.
    - srcmap 10y ago
      In windows 10, I use procexp (from sysinternals) with totalvirus check enable. Basically, it allows all the running .exe programs signatures be checked at once with 56+ virus checking websites and results shows up in the GUI of procexp. No wasting of CPU cycles to scan every files in the system, typical < 3 seconds to check all the running programs - Light up green/red in GUI. https://www.youtube.com/watch?v=RnPtuTbqzd4&t=3s https://www.youtube.com/watch?v=RnPtuTbqzd4&t=3s Love to see google do something similar to this in Android. It is very trivial for Google to dev, deploy these kind of tools/REST API/website. If this is deploy in billions + Android phones, Google should be able to detected/collected/analyze new/potential malwares instantly. Known good programs with valid signatures - do nothing. Unknown programs sig - setup special container and monitors app behavior - collect the binaries if needed. Also, I think google should be able to separate the Google control portions of AOSP from the 3rd party vendors systems drivers/utilities and allow them to be upgrade separately. I used to work on porting the AOSP on cell/tablet SOC before. It is doable.
      - adrianN 10y ago
        I don't think that, in the grand scheme of things, anti virus programs are really helping. Once you have the machine compromised, hiding from a scan isn't terribly difficult.
      - GrinningFool 10y ago
        > No wasting of CPU cycles to scan every files in the system, typical < 3 seconds to check all the running programs - Light up green/red in GUI. THis sounds good, but it can take much less than 3 seconds to compromise user-space data and ship it off.
- sigmar 10y ago
  >feet to the fire on the state of Android security, since it is truly a mess Specifically, by what metric are you calling it a mess? Certainly Apple devices are a little more secure depending on your threat model (except for physical security, where Apple is a leader), but Android seems pretty secure if you stick to the play store. ASLR, ART runtime, sandboxing, safetynet, good tls stack, and a solid bug bounty program have lead to an pretty safe OS imo. Web browsers on the other hand...
  - berberous 10y ago
    I was referring to the post that the parent linked to, which criticizes Google for letting the various Android partners get away with never shipping security updates. The latest Android on a Pixel phone may have good security, but not the majority of phones out there that are way out of date.
dfc 10y ago
Ironic? Where is the irony?
AgentME 10y ago
I don't get what's ironic. Does anyone not expect that Android phones overall are going to be the slowest to be patched / have the most stay unpatched?
lloeki 10y ago
> And today we have this very impressive counter-example of Google putting some engineers to work for months doing vuln research for making, in the end, EVERYONE safer: Apple users, Samsung users, and hundreds of other mobile device vendors who use this popular Broadcom Wi-Fi chipset in products shipped to 1B+ users. This highly technical work is awesome, really. Yet the sad and unrelated part is that this will not trickle down to the massive amount of Android users that won't get any security fix in sight. Yes, carriers and vendors are entirely accountable, but in a way Google is definitely at fault too and should be using all its might and weight to pressure vendors into updating, and carriers to stop fscking with tailored ROMs and having a say in whatever the phone receives as an update. This is not a technical issue but a political one, that Apple sidestepped on the vendor front thanks to vertical integration but took a hard stance on in front of carriers.
- blitmap 10y ago
  Speaking almost entirely unrelated to the topic: Phones need to become general-purpose minicomputers, with the cellular modem "attached" as a peripheral (like over USB). As soon as we start treating them like full-blown computers the better we will get at supporting them. (the modem thing is more of a security want...)

by mrb 10y ago

berberous 10y ago

Google has 57,000 employees. There is always going to be some good, some bad, in an organization that size. The Project Zero team is excellent and we should all be grateful for their work. But we should also continue to hold Google's feet to the fire on the state of Android security, since it is truly a mess, and they are probably the only player to have the power and ability to fix it.

mrb 10y ago
Android is open source and has a permissive license. Fundamentally this means Google cannot prevent manufacturers like Samsung from shipping insecure phones receiving infrequent software updates. I am curious as to what you think Google "should" do? Make Android closed source like iOS and ship it as binary blobs and a license forcing manufacturers to ship sw updates exactly when Google says to do so? You think phone manufacturers would agree to that? They would promptly fork off the last open source Android and rarely take Google's subsequent updates. If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates.
- wtallis 10y ago
  Google has substantial leverage with the Android trademarks and the Play store ecosystem.
  - tastythrowaway2 10y ago
    This. Parent post doesn't realize this basic architectural advantage that should be leveraged.
  - srcmap 10y ago
    In windows 10, I use procexp (from sysinternals) with totalvirus check enable. Basically, it allows all the running .exe programs signatures be checked at once with 56+ virus checking websites and results shows up in the GUI of procexp. No wasting of CPU cycles to scan every files in the system, typical < 3 seconds to check all the running programs - Light up green/red in GUI. https://www.youtube.com/watch?v=RnPtuTbqzd4&t=3s https://www.youtube.com/watch?v=RnPtuTbqzd4&t=3s Love to see google do something similar to this in Android. It is very trivial for Google to dev, deploy these kind of tools/REST API/website. If this is deploy in billions + Android phones, Google should be able to detected/collected/analyze new/potential malwares instantly. Known good programs with valid signatures - do nothing. Unknown programs sig - setup special container and monitors app behavior - collect the binaries if needed. Also, I think google should be able to separate the Google control portions of AOSP from the 3rd party vendors systems drivers/utilities and allow them to be upgrade separately. I used to work on porting the AOSP on cell/tablet SOC before. It is doable.
    - adrianN 10y ago
      I don't think that, in the grand scheme of things, anti virus programs are really helping. Once you have the machine compromised, hiding from a scan isn't terribly difficult.
    - GrinningFool 10y ago
      > No wasting of CPU cycles to scan every files in the system, typical < 3 seconds to check all the running programs - Light up green/red in GUI. THis sounds good, but it can take much less than 3 seconds to compromise user-space data and ship it off.
sigmar 10y ago
>feet to the fire on the state of Android security, since it is truly a mess Specifically, by what metric are you calling it a mess? Certainly Apple devices are a little more secure depending on your threat model (except for physical security, where Apple is a leader), but Android seems pretty secure if you stick to the play store. ASLR, ART runtime, sandboxing, safetynet, good tls stack, and a solid bug bounty program have lead to an pretty safe OS imo. Web browsers on the other hand...
- berberous 10y ago
  I was referring to the post that the parent linked to, which criticizes Google for letting the various Android partners get away with never shipping security updates. The latest Android on a Pixel phone may have good security, but not the majority of phones out there that are way out of date.

dfc 10y ago

Ironic? Where is the irony?

AgentME 10y ago

I don't get what's ironic. Does anyone not expect that Android phones overall are going to be the slowest to be patched / have the most stay unpatched?

lloeki 10y ago

> And today we have this very impressive counter-example of Google putting some engineers to work for months doing vuln research for making, in the end, EVERYONE safer: Apple users, Samsung users, and hundreds of other mobile device vendors who use this popular Broadcom Wi-Fi chipset in products shipped to 1B+ users. This highly technical work is awesome, really. Yet the sad and unrelated part is that this will not trickle down to the massive amount of Android users that won't get any security fix in sight. Yes, carriers and vendors are entirely accountable, but in a way Google is definitely at fault too and should be using all its might and weight to pressure vendors into updating, and carriers to stop fscking with tailored ROMs and having a say in whatever the phone receives as an update. This is not a technical issue but a political one, that Apple sidestepped on the vendor front thanks to vertical integration but took a hard stance on in front of carriers.

blitmap 10y ago
Speaking almost entirely unrelated to the topic: Phones need to become general-purpose minicomputers, with the cellular modem "attached" as a peripheral (like over USB). As soon as we start treating them like full-blown computers the better we will get at supporting them. (the modem thing is more of a security want...)