6 ms·
Samsung's Tizen is riddled with security flaws, amateurishly written
- ArtDev 10y agoSamsung should have used Intel Appup instead.
- 59nadir 10y agoMaybe Samsung has a running bet with Huawei over how much crappy code you can push to how many devices. Huawei is still very likely winning, as they had that period when they had to rewrite most of their router software after being outed as having stolen Cisco's code. They just plain wrote the same shit, but replaced everything good with about 2 bad things instead.
- jolux 10y agoIs anyone the least surprised by this?
- astrodust 10y agoSamsung and security problems go together like peanut-butter and jelly or PHP and MySQL.
- danso 10y ago...Yes? I mean, Samsung is a big enough company with big enough profits to attract talented candidates and also be selective: https://www.quora.com/How-would-you-prepare-for-the-Samsung-interview-Can-seniors-share-their-experiences-What-all-must-we-do https://www.quora.com/How-would-you-prepare-for-the-Samsung-... Furthermore, their mobile business is mature and well-known enough that even if they were staffed with complete amateurs whose legacy code was awful, Samsung has been a prominent player for a long time in terms of tech-biz-years. The chances are significant that they have among their ranks a wise-enough manager to realize that it's time to tackle technical debt. Or, in lieu of that, that Samsung would've by now had a come-to-Security-Jesus security fuckup traumatic enough to force a thorough audit and revamp. Clearly that hasn't happened here so I'm interested in learning the details as they come out.
- khedoros1 10y agoI interviewed for a position with one of their Smart TV software development teams. They gave me a simple-ish problem to solve. It needed to be C++ code, it needed to contain no mistakes (although they wouldn't give me a list of what they'd consider "mistakes"), and it had to be done in a plain text editor while talking to the interviewer on the phone. I took from their "perfect on the first try" requirement for interviewing that their strategy for handling technical debt was supposed to be "don't create technical debt".
- djfumberger 10y agoMaybe then security is less to do with individuals and more so company culture ?
- jolux 10y agoI would think that's pretty obvious but I guess not.
- thomask0 10y agoShould not come as a surprise... https://what.thedailywtf.com/topic/15687/code-review-malediction https://what.thedailywtf.com/topic/15687/code-review-maledic... https://what.thedailywtf.com/topic/15001/enlightened https://what.thedailywtf.com/topic/15001/enlightened
- coldtea 10y ago> https://what.thedailywtf.com/topic/15001/enlightened https://what.thedailywtf.com/topic/15001/enlightened Actually it's the author of the rant that comes of as totally uninformed and with unwarranted snark to boot. https://what.thedailywtf.com/topic/15001/enlightened/242 https://what.thedailywtf.com/topic/15001/enlightened/242
- phpnode 10y agoThe responses in that thread give me a headache, has the daily wtf forum always been such a wasteland? One of the replies is "someone posted your software to the daily wtf so there MUST be a problem with your software, you should just accept it and here's how you should respond". Maddening
- coldtea 10y agoYes. And they even scold the author of the software for responding in an emotional tone, while the whole "wtf" rant was full of personal attacks (and misunderstanding C programming, not bothering with facts etc). And thusly, a website originally created for people to point to actual coding WTFs by incompetent programmers is running posts by incompetent users, voted by other incompetent users.
- tigershark 10y agoSeriously? The EFL author flatly denied to have "bitch" in the error message, posting even the grep results, while silently changing the error message from "bitch" to "complain" hoping that no one would notice it. Obviously git history doesn't lie like him. And he was the one that wrote that error message. In the meantime he started attacking the author of the post on that forum with meaningless arguments. And you have the courage to say that the incompetence is in the forum users rather than in such person that is so full of sh*t to just outrightly lie in front of everyone?
- arrakeen 10y agothankfully, due to the Wayland protocol, an attacker will not be able to take a screenshot of the device without direct user input.
- iamacynic 10y agoeverything i've ever purchased from samsung has broken. i just don't even consider their gear now.
- stuaxo 10y agoThey have always had nice hardware and terrible, terrible software - way back in the J2ME days Samsung were the bain of my life.
- Neliquat 10y agoExactly. I love my galaxy but rooted and flashed it immediately. The bloatware was uncomfortably pervasive, specifically on my carrier. I have other samsung devices, and have had few non firmware issues.
- khedoros1 10y agoI've got a TV from them, 8 years old now. The connection from the component cables is slightly "iffy", but everything else has been solid as a rock. I've had 2 Samsung bluray players. The first was a refurb and still works 90% of the time, but the 10% instances are read errors from the disk drive. After 7 years of use, I was happy with it for the price I paid. The replacement player seems OK so far, although there were a lot of "features" to disable. My Galaxy Nexus is still my favorite phone. I'd pay a lot for that phone, but with upgraded guts.
- deleted 10y ago[deleted]
- Jabbles 10y agoTheory: Samsung is just funding Tizen development to gain leverage over Android
- saagarjha 10y agoWasn't the main reason why they wrote Tizen? Because Google was pushing them around too much?
- throw81001 10y agoTizen was/is mostly built out of a Samsung subsidiary in Warsaw, Poland. (Several thousand software engineers in total.) I worked with Polish software engineers for a western company that used the same outsourcing method during the same time that Tizen was being built. We had hires from Samsung and they had hires from us. I think that what I witnessed at our company (which I won't name) is representative for what Samsung saw. The stereotypical development model was one where individual developers were perceived as lego blocks that could be moved from one area to another about as the project(s) progressed without any regard for the individual contributors accumulated knowledge. Large volumes of contributors ("bug resolvers") were valued over smaller, coherent teams with smarter contributors. There was also a disturbing amount of machoismo surrounding everything - nothing could be questioned; everything was a of sense pride to someone. (What I heard from the local engineering managers supports the above.)
- throw81001 10y agoMy assessment after having a few years perspective: - There's quite a big span between the average level to high level to top level when it comes to polish devs. Specifically, it goes a lot lever than what I'm used to. It goes high too, though, but those individuals are not necessarily cheaper than a western european employee of the same calibre (probably similar). - (Engineering) Management culture is totally whacko and quite a bit behind the western world. I blame the machoismo.
- deleted 10y ago[deleted]
- dgregd 10y agoThere are a lot of good software engineers in Warsaw, working at various companies. However most of companies here doesn't care that much about top talent. They just want to pay an average salary and that's all. It is very rare that Warsaw devs that write good quality code are compensated appropriately.
- demarq 10y agoIs it that big industrial corporations are bad at creating code? Toyota, samsung, synaptic. I'm really beggining to think that code should be left to smaller and medium sized outfits. i.e samsung should buy or hire a small startup to independently develop and grow their next ecosystem. Large enterprises just seem too clumsy pull pull it off unless they wholly dedicate themselves to developing that one piece of technology.
- pg_is_a_butt 10y agoyeah, and big pharma should pushing opiates... you're all idiots.
- itcmcgrath 10y agoThe counter arguments include Google, Apple, Microsoft, etc. I think the big vs small comparison is flawed. I've seen some atrocious code produced by small/medium sized outfits. My fondest memory including auditing code from a 3 person outfit who's code quite literally setup an RPC on the server that executed any string it was sent, verbatim, against a database that handled money.
- demarq 10y agoThose counter examples were all software startups. And have very very different cultures to other corporations their size due to their roots.
- pducks32 10y agoIs Samsung at this point really _that_ different in terms of semantics from those examples though. Obviously they are all unique and Samsung's location makes a big impact on their culture but like they hire a similar intelligence echelon of people right? I don't know much about the internals of Samsung so maybe I'm missing something.
- ungzd 10y agoSamsung is primarily home appliances corporation. Maybe their management treats TVs as "devices that display TV broadcasts" and phones as "devices for talking over distance". In this worldview there are no things like "bugs", "vulnerabilities", "software updates". Software inside these devices is at the same concern as prints on cardboard box. These devices, including phones, are sold at home appliance stores where "shop assistants" say you things like "That's Ultra Mega HD Super", "8 Cores and water resistant case" and once appliance is sold it is sold and no more problem of company. If it turns on and display pictures then it works.
- contingencies 10y agoIn Samsung HQ in Suwon, Korea, back in 2010 in the leadup to the launch of the Galaxy device series, each individual OS had its own literal skyscraper in the HQ campus. One for BadaOS, one for Android, one for Windows Mobile. I don't think they communicated at all, as a general rule. Even in the Android one where I was working, the whole floor was nominal software guys but only one knew how to compile the firmware everyone was working on! They actually had to fly in a team of low-level programmers from Samsung India to get the device firmware up to speed in time for the hardware launch. It was an extremely interesting organization to spend a few days in from an anthropological perspective, but I left swearing that if the experience was a vision of the future I wanted no part of it.
- mihaela 10y agoI was hoping Samsung would do something with Tizen as opposed to Android. Sorry to hear this.
- alimbada 10y agoI'm very tempted to buy a Samsung TV (primarily for the the low input lag times which makes them good for gaming) and I plan to keep it offline (no WiFi or Ethernet connection), using a Chromecast and a HTPC+Kodi instead for streaming. With that in mind, should I be worried about security flaws?
- MatthaeusHarris 10y agoDepends on your threat model. From TFA: Another attack on Samsung Smart TVs was published last week that used malicious commands embedded in broadcast TV signals. So, even if it's airgapped, a tv that's been compromised in this way is effectively a hostile general-purpose computer with a wifi card running inside your house. If this is something you would do for a Klondike bar, then go ahead. I'll keep my dumb TV and my Kodi box, though.
- scorpioxy 10y agoAgreed. These "smart" TVs mostly run outdated and buggy software which are difficult if not impossible to update either because of technical limitations or because the manufacturer doesn't care enough after getting your money. So why bother with a "smart" TV if you're going to be using an external computer anyway. Saving a few hundred dollars to spend on that external computer seems like a better investment. I run a "dumb" big LG TV hooked up to a raspberry pi running Kodi via LibreElec. I'm very happy with the set up in terms of functionality and price. Edit: the attack via signal is linked from the article, reading now.
- alimbada 10y ago> So why bother with a "smart" TV if you're going to be using an external computer anyway. Saving a few hundred dollars to spend on that external computer seems like a better investment. I'm in the market for a 4k TV with low input lag. If you look at input lag tests (e.g., http://uk.rtings.com/tv/tests/inputs/input-lag http://uk.rtings.com/tv/tests/inputs/input-lag) you'll see that every single TV listed there is a smart TV, at least in the 43"-50" range anyway. In fact, are there even such things as "dumb" TVs anymore? That said, I've done some more research and realised tha the LG UH6* range is actually also pretty good for low input lags and runs webOS to boot so I think I'll go for an LG instead.
- danpalmer 10y agoThis doesn't surprise me. A company I used to work for fielded a team at most Pwn2Own competitions, and it was widely regarded as "not good sport" to take on a Samsung phone because they were so bad.
- newsat13 10y agoI can't believe there are still string overflow bugs. Might be a good idea to invest sometime in Rust. On a side note, I have been looking for a good doc on how I can slowly migrate my existing code base step-by-step to Rust. A total rewrite is out of question, we would rather ship our product step by step. Does anyone know of such a doc?
- steveklabnik 10y agohttps://github.com/carols10cents/rust-out-your-c-talk https://github.com/carols10cents/rust-out-your-c-talk http://blog.adamperry.me/rust/2016/06/11/baby-steps-porting-musl-to-rust/ http://blog.adamperry.me/rust/2016/06/11/baby-steps-porting-...
- newsat13 10y agoThanks!