8 ms·

But your email app will still get updates right? (I guess I'm using Gmail and assuming you are using something like it that gets updates too, but maybe I'm wron

But your email app will still get updates right? (I guess I'm using Gmail and assuming you are using something like it that gets updates too, but maybe I'm wrong.) Same with SMS - lots of apps that get updates. What's the exact issue?

JohnZi 9y ago
Apps do get updates, but they aren't the issue. The system/kernel/system libraries don't get updates and if they are compromised all your apps are compromised too. If someone know a vulnerability only in a normal app he can't do anything but look at only this one app, with system access well he can do way more. (Also Android got some additional security/privacy features after Android 4)
- throwaway613834 9y ago
  But the thing is, even if 100% of your apps are vulnerable, it doesn't mean anything unless the attacker can reach your phone somehow. That can only happen in 5 different ways: (1) Low-level Wi-Fi bug exploit, (2) SMS exploit, (3) Cellular exploit (like a Stingray), (4) Cellular internet connection (open ports, etc.), (5) App-level exploits. I don't know of any critical examples of #1 that I would need to protect against where upgrading is my only solution (maybe I'll upgrade if I find one). #2 can be mitigated at the app level (see my reply to the other comment here) and probably faster so than the update you'd receive. #3 can't really be mitigated by phone updates. #4 is impractical since cells are behind carrier-grade NATs and don't have dedicated IP addresses to be reachable via the internet. And #5 just involves updating the app, not the OS or hardware. If you can give me an example of an actual attack that cannot be prevented without upgrading the hardware or the OS, I would find that far more convincing than a hypothetical.
  - veeti 9y ago
    https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl...
    - throwaway613834 9y ago
      Has this (a) been exploited in the wild, and more importantly, (b) even actually patched in more recent phones? Otherwise, how is this a justification for upgrading your phone? It seems like you may have forgotten what the argument even was. I was arguing against routine 1-2-year upgrades, not against the entire concept of upgrading for something wiht a serious security vulnerability. If a serious exploit appears in the wild and your only solution is to upgrade -- by all means, go for it. But is that the case here? And this happened periodically every 1-2 years for you to justify upgrading equally often?
      - veeti 9y ago
        A) I don't know. How would you ever know? RCE can be silent. B) Yes, in Android patch level July 2017 and iOS 10.3.3.
taivokasper 9y ago
That's not how things work! If the OS is not secure then app updates are rendered useless.
- throwaway613834 9y ago
  I think to a large extent (i.e. enough to eliminate the worry in practice) it is how things work, actually. See my reply to the sister comment here: https://news.ycombinator.com/item?id=15040745 https://news.ycombinator.com/item?id=15040745
quicklime 9y ago
"Stagefright" is an Android vulnerability that allows attackers to exploit a device by sending a specially crafted MMS message. No user intervention is required, no dodgy apps need to be installed. You're on Android 4, so your phone is vulnerable. If you use your phone for anything important, I'd suggest getting that new phone ASAP.
- throwaway613834 9y ago
  Actually I've already mitigated this by disabling automatic MMS download, and from what I read [1] it can be mitigated in other ways as well. It can't be done in every app, but then you can just use an app that lets you do this. So this is a non-issue. Any others you can think of? [1] https://en.wikipedia.org/wiki/Stagefright_(bug)#Mitigation https://en.wikipedia.org/wiki/Stagefright_(bug)#Mitigation
  - tinus_hn 9y ago
    Just make sure not to open any videos from the internet. Hardly an issue!
    - throwaway613834 9y ago
      > Just make sure not to open any videos from the internet. Hardly an issue! What? Chrome and Firefox protect against it [1]... do you not use either? [1] https://www.howtogeek.com/225834/stagefright-what-you-need-to-know-and-how-to-protect-yourself/ https://www.howtogeek.com/225834/stagefright-what-you-need-t...
      - veeti 9y ago
        The app-level "mitigation" is that media isn't automatically loaded. You are still just as vulnerable after you decide to play that innocuous-looking MP4 file.
        throwaway613834 9y ago
veeti 9y ago
Just go through the monthly Android security bulletins [1]. Without fail there are a bunch of critical RCE issues every single month. [1] https://source.android.com/security/bulletin/2017-08-01 https://source.android.com/security/bulletin/2017-08-01
Jaepa 9y ago
Most will, some will drop support after its X major release behind. But that's not really the issue, the underlying system has a lot of security issues (as all complex systems do). So just for 2017 there are: - 326 code execution vulnerabilities - 221 memory overflow bugs - 114 memory corruption issues - 309 privilege escalation bugs http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?... Granted, I'm sure a lot of these CVE are very low risk, and some are duplicates (because CVE). But there were a couple of notable really bad security issues. But this is just the Android, not all the of dependencies Android has. StageFright was already mentions, and there has been a couple of iterations of this already, stemming from different bugs in a parsing library used with MMS. Included in this is a remote code execution and an privilege escalation. Another fun one is Broadpwn, which is rather new one and was disclosed as BlackHat US this year. Its effects both iOS and Android and can be wormed trivially. It targets a widely used Broadcomm wifi chipset, and does not require _any_ user interaction. A malformed SSID broadcast allows for remote code execution. And when I say any user interaction, you can walk by something broadcasting this and you're infected.
- throwaway613834 9y ago
  Regarding Broadpwn: I wasn't aware of it, but at the same time -- has it actually been exploited, and has it been patched in more recent hardware or OSes? If the upgrade doesn't help mitigate an actual, existing threat then upgrading doesn't solve anything. To put it another way: if you learn of a very serious exploit like this in the wild and an upgrade is the only way to solve it -- by all means, go ahead and upgrade. I'm not saying you should never upgrade, nor am I saying serious security vulnerabilities cannot pop up. But neither in any way implies you need a periodic 1-2-year hardware/OS refresh. A refresh could be justified in 1 day or in 10 years; it just depends on what the actual threats and mitigations are. Remember what the original discussion was about: it was about whether the periodic refresh is justified. As for the rest of those (StageFright and other attacks) -- I've addressed them in other comments. See here: https://news.ycombinator.com/item?id=15040745 https://news.ycombinator.com/item?id=15040745
  - dmoy 9y ago

JohnZi 9y ago

Apps do get updates, but they aren't the issue. The system/kernel/system libraries don't get updates and if they are compromised all your apps are compromised too. If someone know a vulnerability only in a normal app he can't do anything but look at only this one app, with system access well he can do way more. (Also Android got some additional security/privacy features after Android 4)

throwaway613834 9y ago
But the thing is, even if 100% of your apps are vulnerable, it doesn't mean anything unless the attacker can reach your phone somehow. That can only happen in 5 different ways: (1) Low-level Wi-Fi bug exploit, (2) SMS exploit, (3) Cellular exploit (like a Stingray), (4) Cellular internet connection (open ports, etc.), (5) App-level exploits. I don't know of any critical examples of #1 that I would need to protect against where upgrading is my only solution (maybe I'll upgrade if I find one). #2 can be mitigated at the app level (see my reply to the other comment here) and probably faster so than the update you'd receive. #3 can't really be mitigated by phone updates. #4 is impractical since cells are behind carrier-grade NATs and don't have dedicated IP addresses to be reachable via the internet. And #5 just involves updating the app, not the OS or hardware. If you can give me an example of an actual attack that cannot be prevented without upgrading the hardware or the OS, I would find that far more convincing than a hypothetical.
- veeti 9y ago
  https://googleprojectzero.blogspot.com/2017/04/over-air-exploiting-broadcoms-wi-fi_11.html https://googleprojectzero.blogspot.com/2017/04/over-air-expl...
  - throwaway613834 9y ago
    Has this (a) been exploited in the wild, and more importantly, (b) even actually patched in more recent phones? Otherwise, how is this a justification for upgrading your phone? It seems like you may have forgotten what the argument even was. I was arguing against routine 1-2-year upgrades, not against the entire concept of upgrading for something wiht a serious security vulnerability. If a serious exploit appears in the wild and your only solution is to upgrade -- by all means, go for it. But is that the case here? And this happened periodically every 1-2 years for you to justify upgrading equally often?
    - veeti 9y ago
      A) I don't know. How would you ever know? RCE can be silent. B) Yes, in Android patch level July 2017 and iOS 10.3.3.

taivokasper 9y ago

That's not how things work! If the OS is not secure then app updates are rendered useless.

throwaway613834 9y ago
I think to a large extent (i.e. enough to eliminate the worry in practice) it is how things work, actually. See my reply to the sister comment here: https://news.ycombinator.com/item?id=15040745 https://news.ycombinator.com/item?id=15040745

quicklime 9y ago

"Stagefright" is an Android vulnerability that allows attackers to exploit a device by sending a specially crafted MMS message. No user intervention is required, no dodgy apps need to be installed. You're on Android 4, so your phone is vulnerable. If you use your phone for anything important, I'd suggest getting that new phone ASAP.

throwaway613834 9y ago
Actually I've already mitigated this by disabling automatic MMS download, and from what I read [1] it can be mitigated in other ways as well. It can't be done in every app, but then you can just use an app that lets you do this. So this is a non-issue. Any others you can think of? [1] https://en.wikipedia.org/wiki/Stagefright_(bug)#Mitigation https://en.wikipedia.org/wiki/Stagefright_(bug)#Mitigation
- tinus_hn 9y ago
  Just make sure not to open any videos from the internet. Hardly an issue!
  - throwaway613834 9y ago
    > Just make sure not to open any videos from the internet. Hardly an issue! What? Chrome and Firefox protect against it [1]... do you not use either? [1] https://www.howtogeek.com/225834/stagefright-what-you-need-to-know-and-how-to-protect-yourself/ https://www.howtogeek.com/225834/stagefright-what-you-need-t...
    - veeti 9y ago
      The app-level "mitigation" is that media isn't automatically loaded. You are still just as vulnerable after you decide to play that innocuous-looking MP4 file.
      - throwaway613834 9y ago

veeti 9y ago

Just go through the monthly Android security bulletins [1]. Without fail there are a bunch of critical RCE issues every single month. [1] https://source.android.com/security/bulletin/2017-08-01 https://source.android.com/security/bulletin/2017-08-01

Jaepa 9y ago

Most will, some will drop support after its X major release behind. But that's not really the issue, the underlying system has a lot of security issues (as all complex systems do). So just for 2017 there are: - 326 code execution vulnerabilities - 221 memory overflow bugs - 114 memory corruption issues - 309 privilege escalation bugs http://www.cvedetails.com/product/19997/Google-Android.html?vendor_id=1224 http://www.cvedetails.com/product/19997/Google-Android.html?... Granted, I'm sure a lot of these CVE are very low risk, and some are duplicates (because CVE). But there were a couple of notable really bad security issues. But this is just the Android, not all the of dependencies Android has. StageFright was already mentions, and there has been a couple of iterations of this already, stemming from different bugs in a parsing library used with MMS. Included in this is a remote code execution and an privilege escalation. Another fun one is Broadpwn, which is rather new one and was disclosed as BlackHat US this year. Its effects both iOS and Android and can be wormed trivially. It targets a widely used Broadcomm wifi chipset, and does not require _any_ user interaction. A malformed SSID broadcast allows for remote code execution. And when I say any user interaction, you can walk by something broadcasting this and you're infected.

throwaway613834 9y ago
Regarding Broadpwn: I wasn't aware of it, but at the same time -- has it actually been exploited, and has it been patched in more recent hardware or OSes? If the upgrade doesn't help mitigate an actual, existing threat then upgrading doesn't solve anything. To put it another way: if you learn of a very serious exploit like this in the wild and an upgrade is the only way to solve it -- by all means, go ahead and upgrade. I'm not saying you should never upgrade, nor am I saying serious security vulnerabilities cannot pop up. But neither in any way implies you need a periodic 1-2-year hardware/OS refresh. A refresh could be justified in 1 day or in 10 years; it just depends on what the actual threats and mitigations are. Remember what the original discussion was about: it was about whether the periodic refresh is justified. As for the rest of those (StageFright and other attacks) -- I've addressed them in other comments. See here: https://news.ycombinator.com/item?id=15040745 https://news.ycombinator.com/item?id=15040745
- dmoy 9y ago