3 ms·

Is the iPhone actually more secure than a Samsung running Android? And I don't think LineageOS is going to fix the problem since it (probably) uses the same Br

by trendia 10y ago

Is the iPhone actually more secure than a Samsung running Android? And I don't think LineageOS is going to fix the problem since it (probably) uses the same Broadcom driver in the Linux kernel.

fencepost 10y ago
In the case of the Broadcom exploits being discussed in this series of articles, yes, the iPhone is almost certainly more secure than most (all?) Samsung devices with Android. In particular, the iOS 10.3.1 update released a week ago addresses "An attacker within range may be able to execute arbitrary code on the Wi-Fi chip" and credits the author of these articles and Google Project Zero. Because most iOS updates aren't carrier restricted (maybe on Verizon?) that update should be available to any device capable of running iOS 10. If there are corresponding releases from Samsung I don't remember seeing any mention of them, and even so they'd presumably be waiting for carriers to approve them so there's a chance that some of them will be released by the time people are replacing their current phones anyway. As for LineageOS, they may be able to address things in the driver, but in my somewhat outdated experience most ROMs don't touch the radio firmware. Radio firmware updates are a completely separate item.
- exhilaration 10y ago
  Supported Google Nexus and Pixel phones have the fix as well, I see "Remote code execution vulnerability in Broadcom Wi-Fi firmware" listed on the April update: https://source.android.com/security/bulletin/2017-04-01 https://source.android.com/security/bulletin/2017-04-01
  - ReverseCold 10y ago
    (Almost?) no one has that update yet. Sample size 1.
    - exhilaration 10y ago
      That's strange, do you have auto-updates disabled? My understanding is that it was immediately released. My Nexus 6P has it, I got it the same day it was released or a day after. Screenshot of my About Phone screen: http://m.imgur.com/APSvk8Z http://m.imgur.com/APSvk8Z
  - fencepost 10y ago
    I'd regard Nexus and Pixel phones to be the equivalent of iPhones for something like this - they get updates directly from the "manufacturer"/Google, much as iPhones get updates from Apple. Samsung-branded devices sold primarily through carriers on the other hand get updates when they finish passing through the system of Google->handset maker->carrier and often both the handset makers and carriers are big delay points.

by trendia 10y ago

Is the iPhone actually more secure than a Samsung running Android? And I don't think LineageOS is going to fix the problem since it (probably) uses the same Broadcom driver in the Linux kernel.

fencepost 10y ago

In the case of the Broadcom exploits being discussed in this series of articles, yes, the iPhone is almost certainly more secure than most (all?) Samsung devices with Android. In particular, the iOS 10.3.1 update released a week ago addresses "An attacker within range may be able to execute arbitrary code on the Wi-Fi chip" and credits the author of these articles and Google Project Zero. Because most iOS updates aren't carrier restricted (maybe on Verizon?) that update should be available to any device capable of running iOS 10. If there are corresponding releases from Samsung I don't remember seeing any mention of them, and even so they'd presumably be waiting for carriers to approve them so there's a chance that some of them will be released by the time people are replacing their current phones anyway. As for LineageOS, they may be able to address things in the driver, but in my somewhat outdated experience most ROMs don't touch the radio firmware. Radio firmware updates are a completely separate item.

exhilaration 10y ago
Supported Google Nexus and Pixel phones have the fix as well, I see "Remote code execution vulnerability in Broadcom Wi-Fi firmware" listed on the April update: https://source.android.com/security/bulletin/2017-04-01 https://source.android.com/security/bulletin/2017-04-01
- ReverseCold 10y ago
  (Almost?) no one has that update yet. Sample size 1.
  - exhilaration 10y ago
    That's strange, do you have auto-updates disabled? My understanding is that it was immediately released. My Nexus 6P has it, I got it the same day it was released or a day after. Screenshot of my About Phone screen: http://m.imgur.com/APSvk8Z http://m.imgur.com/APSvk8Z
- fencepost 10y ago
  I'd regard Nexus and Pixel phones to be the equivalent of iPhones for something like this - they get updates directly from the "manufacturer"/Google, much as iPhones get updates from Apple. Samsung-branded devices sold primarily through carriers on the other hand get updates when they finish passing through the system of Google->handset maker->carrier and often both the handset makers and carriers are big delay points.