5 ms·

Interestingly, no one has done a deep dive on what Android exploits were hosted on the site that Google discovered and talked about last week with the iOS explo

by kerng 7y ago

Interestingly, no one has done a deep dive on what Android exploits were hosted on the site that Google discovered and talked about last week with the iOS exploits. Google has been utterly quiet about it, and kept only talking about iOS exploits. Certainly lots of security PR happening and this article is interestingly timed also.

arkadiyt 7y ago
> Interestingly, no one has done a deep dive on what Android exploits were hosted on the site that Google discovered Volexity did [1], although it's not clear if the android exploits were hosted on the same sites that google was referencing. [1]: https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/ https://www.volexity.com/blog/2019/09/02/digital-crackdown-l...
- kerng 7y ago
  Thanks for sharing, that's a great resource! This at the grand scheme of things hasn't gotten much attention I think.
lawnchair_larry 7y ago
Google did not find any Android exploits.
- kerng 7y ago
  It seems very unlikely that the majority system used (especially outside the US), would not be exploited - maybe they try to separate and say not the exact same webpage hosted Android exploits. But I havent seen any official statement from Project Zero that they have not found Android exploits as part of this campaign. Not even one that says, not the same page hosted Android exploits. If you have a link, please share. All I saw was this below. It says Google did not comment on the question officially: https://www.forbes.com/sites/thomasbrewster/2019/09/01/iphone-hackers-caught-by-google-also-targeted-android-and-microsoft-windows-say-sources/#540aff8b4adf https://www.forbes.com/sites/thomasbrewster/2019/09/01/iphon...
  - chc4 7y ago
    Here's a tweet from a member of Google TAG saying they didn't see any non-iOS exploits. https://twitter.com/itswillis/status/1168543167219716096 https://twitter.com/itswillis/status/1168543167219716096
  - shkkmo 7y ago
    That same article has a quote from Microsoft: > Google Project Zero was very specific in its blog post that the recently publicized attacks used unique iPhone exploits and they have not disclosed similar information to us," I would be rather surprised if Project Zero ran across new Windows exploits and did not notify Microsoft so I suspect that any exploits they found for Windows used known vulnerabilities.
    - deleted 7y ago
      [deleted]
  - TACIXAT 7y ago
    This is the only public thing I can point to. See position and retweets. [1] 1. https://twitter.com/ShaneHuntley?s=09 https://twitter.com/ShaneHuntley?s=09
mushufasa 7y ago
Well, why would Google need to publicly shame themselves (e.g. 90 day ultimatum) to motivate a bug fix? They can just fix the bug once they know about the vulnerability.

by kerng 7y ago

arkadiyt 7y ago

> Interestingly, no one has done a deep dive on what Android exploits were hosted on the site that Google discovered Volexity did [1], although it's not clear if the android exploits were hosted on the same sites that google was referencing. [1]: https://www.volexity.com/blog/2019/09/02/digital-crackdown-large-scale-surveillance-and-exploitation-of-uyghurs/ https://www.volexity.com/blog/2019/09/02/digital-crackdown-l...

kerng 7y ago
Thanks for sharing, that's a great resource! This at the grand scheme of things hasn't gotten much attention I think.

lawnchair_larry 7y ago

Google did not find any Android exploits.

kerng 7y ago
It seems very unlikely that the majority system used (especially outside the US), would not be exploited - maybe they try to separate and say not the exact same webpage hosted Android exploits. But I havent seen any official statement from Project Zero that they have not found Android exploits as part of this campaign. Not even one that says, not the same page hosted Android exploits. If you have a link, please share. All I saw was this below. It says Google did not comment on the question officially: https://www.forbes.com/sites/thomasbrewster/2019/09/01/iphone-hackers-caught-by-google-also-targeted-android-and-microsoft-windows-say-sources/#540aff8b4adf https://www.forbes.com/sites/thomasbrewster/2019/09/01/iphon...
- chc4 7y ago
  Here's a tweet from a member of Google TAG saying they didn't see any non-iOS exploits. https://twitter.com/itswillis/status/1168543167219716096 https://twitter.com/itswillis/status/1168543167219716096
- shkkmo 7y ago
  That same article has a quote from Microsoft: > Google Project Zero was very specific in its blog post that the recently publicized attacks used unique iPhone exploits and they have not disclosed similar information to us," I would be rather surprised if Project Zero ran across new Windows exploits and did not notify Microsoft so I suspect that any exploits they found for Windows used known vulnerabilities.
  - deleted 7y ago
    [deleted]
- TACIXAT 7y ago
  This is the only public thing I can point to. See position and retweets. [1] 1. https://twitter.com/ShaneHuntley?s=09 https://twitter.com/ShaneHuntley?s=09

mushufasa 7y ago

Well, why would Google need to publicly shame themselves (e.g. 90 day ultimatum) to motivate a bug fix? They can just fix the bug once they know about the vulnerability.