43 ms·

Critical Bluetooth vulnerability in Android

504 points by photon-torpedo 7y ago

TekMol 7y ago
That's heavy. There are tons of phones out there that will never be patched again. The situation on the phone market is so miserable. The industry forces us to throw away perfectly fine hardware after just 3 years or so.
- madez 7y ago
  The solution is rather simple; buy devices with better documented and open internals rather than what's cheapest, shiniest, and most convenient. There are alternatives, and we all vote with our wallets.
  - pixl97 7y ago
    Ah, yes, this is sure to work. watches the plan fail yet again This is like saying "we dont need regulations in meat packing, every individual can become educated in butchery cleanliness and track the supply chains for the products they buy and everything will be better!"
    - madez 7y ago
      We surely need regulation that demands at least delayed publication of firmware source and hardware documentation, I agree. The analogy to regulation in the food industry is enlightening. It's easier to achieve regulation when people care and show that they care. It seems to me, voting now with your wallet is one of the most direct ways to make a case.
      - Normal_gaussian 7y ago
        I don't think many people are talking directly to their officials about it. It certainly isn't something my local representatives talk about, and the political consultation groups some of my uni-friends now work in definitely don't have it on their radar.
      - clarry 7y ago
        Voting against the tyranny of the ignorant masses (or just people who also value convenience; or those who can't afford expensive) is a discarded vote. Your pennies are not going to change the world.
        madez 7y ago
        Unlike in some political systems, in the market the winner doesn't take all, but rather all receive their votes. Even then, I don't understand the psychology underlying the concept "discarded vote". I vote for what I think is best. To me that is what votes are all about. Is the psychological desire to be part of the winning group responsible?
        clarry 7y ago
        If you know you're voting for a niche candidate that cannot win, then that vote achieves nothing. It amounts to as much as not voting at all; voting, then, is an empty ritual, just a rain dance. Psychological desire has nothing to do with it, it's just hard facts.
        madez 7y ago
        Even in an archaic the-winner-takes-all vote, the result reveals important information besides determining the winner. That information can influence other voters, vote options, and the winners behavior.
        kortilla 7y ago
        We’re talking about voting with your wallet. The vendor you pick doesn’t need to “win”, it just needs to get enough to survive. This is why voting with your wallet is much more powerful than voting for winner-take-all representatives in a political system.
        tripzilch 7y ago
        I think you're taking the analogy of "vote with your wallet" a bit too far. It's not actual voting, or democratic, it just means that whoever has the most money decides. It's not really comparable to a political system of voting (and if you think it does seem suspiciously similar, that probably means that political system is broken). > I vote for what I think is best. Maybe you're an exception, but if you're talking about "vote with your wallet", then the vast majority will actually vote what they think is best for their wallets. I mean, if you're going to let money decide, then expect the outcome to benefit money.
      - Mirioron 7y ago
        How do I vote with my wallet though? The only alternative is an iPhone which fulfills a somewhat different role functionally.
    - dTal 7y ago
      >This is like saying "we dont need regulations in meat packing, every individual can become educated in butchery cleanliness and track the supply chains for the products they buy and everything will be better!" People say this kind of thing all the time, even on HN. It's a libertarian saw that the FDA is unneccesary and obstructionist. Personally I think it's deranged, but apparently it's an ideological battle that's still being fought.
  - taspeotis 7y ago
    Or just buy Apple. The iPhone 5s was released in 2013 and got an update less than a fortnight ago (January 28).
    - eithed 7y ago
      Can you make assurances that iPhone doesn't suffer from similar issues, given it's not open source solution?
      - lima 7y ago
        There's tons of security researchers focusing on iOS and the lack of source code access is merely an inconvenience.
      - objclxt 7y ago
        Depends what you mean by "similar issues" If you mean "a bunch of relatively new Android phones not getting security updates because their manufacturer doesn't support them", then yes. Apple is actively providing not just security patches but entire feature software updates for the iPhone 6S, which is 4.5 years old at this point.
        eithed 7y ago
        Yup, that's what I mean. While I do have an Android phone that is patched (Samsung), I understand that many people will be hmm... irritated that this vulnerability won't be fixed and requires them to upgrade. I'd not treat switching to Apple ecosystem as panacea to everything though and would be more for security through audit, not obscurity.
        why_only_15 7y ago
        Apple's security is heavily audited in a lot of ways. They give special phones to researchers that make it easier to audit them, and there are significant bug bounties.
        7y ago
  - rjmunro 7y ago
    Looks like I need a new phone because of this. Which phone would you recommend so I don't make the same mistake again?
    - krn 7y ago
      I would only buy a device running Android One, because they receive monthly security patches and new Android versions for up to 3 years. The current options include all Nokia smartphones, Motorola One line, and Xiaomi Mi A line. For the best hardware and 5G support, I would look at Nokia 9.2 (Snapdragon 8--) and Nokia 8.2 (Snapdragon 7--) releases this year. The best deal is to buy 6 months after the release, when most Android devices become heavily (30-40%) discounted, but are still quite new. I prefer Android over iOS because of the freedom to install open-source OS-level ad-blockers, such as Blokada[1], which greatly improve privacy and battery life. [1] https://blokada.org/ https://blokada.org/
      - zozbot234 7y ago
        Note that "Xiaomi Mi A" devices are the only ones that are similar to Android One. Most Xiaomi devices have a custom UX and additional weirdness. (Among which is the need to "sign up" online for bootloader unlock and wait for a timeout period. They do this because resellers used to ship bootloader-unlocked versions with "unofficial" mods of sorts, often with customers being none-the-wiser. Not an issue on the 'Mi A' line, for whatever reason.)
        krn 7y ago
        > Most Xiaomi devices have a custom UX and additional weirdness. That's true. Just like Samsung, Huawei, OnePlus, and any other Android manufacturer except Nokia, Xiaomi maintains its own Android ROM, called MIUI[1]. It's not as vanilla as Android One, but at least it also receives monthly security patches. > Among which is the need to "sign up" online for bootloader unlock and wait for a timeout period. They do this because resellers used to ship bootloader-unlocked versions with "unofficial" mods of sorts, often with customers being none-the-wiser. Not an issue on the 'Mi A' line, for whatever reason. It's not an issue with Xiaomi Mi A line, because Xiaomi's reputation is not affected as much if there is something wrong with a smartphone that is not running its custom ROM. Nokia has only recently started allowing to unlock the bootloader of some of the models, and has a similar process[2]. [1] https://en.wikipedia.org/wiki/MIUI https://en.wikipedia.org/wiki/MIUI [2] https://www.nokia.com/phones/en_int/bootloader https://www.nokia.com/phones/en_int/bootloader
  - zozbot234 7y ago
    They're all using the same junk SoC's with zero documentation and the crappiest possible level of "board" support anyway. You're actually better off buying a device where that support has been properly reverse-engineered/forward ported and is included in the mainline kernel. (Lots of Allwinner boards are "supported" in that way.) But it's ridiculous that we have to do this. Also FWIW, the problem has zilch to do with "Android" per se - pre-Android mobile Linux was even worse. It's embedded platforms in general.
  - kees99 7y ago
    My understanding is that each android phone model is unique and requires unique OS update (unlike, say, BIOS- or UEFI-based x86 PCs, where exact same Windows/Linux/BSD/... image can be installed on any of them). Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone - now that would be the true alternative, which I would be delighted to vote for with my wallet.
    - zozbot234 7y ago
      > Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone Project Treble is working towards this, in a way. But it's a huge hack that's still dependent on lots of weird AOSP-specific stuff, and doesn't even give you a "single" OS image for every device - the "proper" image for your device varies by baseline AOSP support (7, 8, 9, 10), "A" vs. "A+B" boot and of course 32-bit vs. 64-bit architecture. Nowhere near "UEFI-based PC" territory.
      - yjftsjthsd-h 7y ago
        Eh... remember 32-bit UEFI? It might be smaller, but there is still room for weirdness.
    - jacquesm 7y ago
      > My understanding is that each android phone model is unique Sure, but each PC is also 'unique' in that sense, in fact I'd happily bet that there are more different kinds of hardware combinations for PCs than there are android phone models. And yet, that never was a problem.
      - zozbot234 7y ago
        Plug-and-Play and then ACPI have been used to get around this. Hardware discovery just doesn't seem to be a thing on these embedded SoC platforms, and even the hardware support itself (drivers, etc.) is extremely sub-par if you expect to run the ordinary, mainline kernel.
  - nicolaslem 7y ago
    This is why my next phone will be a Librem 5. I know that it will probably suck but at least it's moving things in the right direction.
    - madez 7y ago
      I'm in the same boat. If it moves things in the right direction, then it doesn't suck.
      - prox 7y ago
        Indeed! I usually get “but it’s still a closed source modem” as a counterpoint ... sigh
        squarefoot 7y ago
        The closed source modem, or network firmware for that matter, isn't much of a problem if it can't see clear data and/or access to system memory or execute instructions. I'd see it more of a black box not unlike old RS232 connected modems: they could see all data going back and forth, but encrypting that data would be enough since they could never access the system memory to see the data before encryption or after decryption. Librem 5 and Pinephone should work along these lines. Having everything 100% open would be better, but in this case being closed doesn't create security concerns since all personal data is unavailable to these subsystems; only the main system, which is entirely open and where the user is king, can access them.
    - ekianjo 7y ago
      > my next phone will be a Librem 5. Better go with a Pinephone if everything that's been written about Librem as a company is even half-true.
  - papermachete 7y ago
    What are some 2018+ sub-$200 smartphones that run first-party LineageOS to no disadvantage over the stock ROM?
    - pmlnr 7y ago
      There aren't any, unless you go second hand. LOS and nearly all custom ROMs are aiming at widespread, mostly high end devices, which is one of the big problems.
      - myself248 7y ago
        I've learned this lesson. If I have $200 to spend on a phone, I will not buy a low-end 2019 $200 phone. I will buy a used (or new-old-stock) flagship that was $700 when it came out a few years ago, and is now $200 on the used market. The older flagship will have similar specs to today's low-end junk, but also all the enthusiast support, better accessory availability, and probably better build quality overall, because it was originally intended to be the highest of the high-end.
        steerablesafe 7y ago
        Flagships have the most idiotic designs though, as far as I looked around. Low-end current year $200 phones often have removable batteries, headphone jack and dual sim support. Flagships typically have none of that.
        papermachete 7y ago
        I mean if you can go so far as to install or build third party ROMs, it'd be an interesting weekend hobby to repair electronics yourself. I've saved hundreds of dollars of technology on trivial home repairs instead of buying replacements.
        mavhc 7y ago
        You'll also have to replace the battery though
  - kop316 7y ago
    I hope you realize that with the exception of freescale, there are no phone and tablet devices where the vendor actually cooperate and does that. Many of the devices that are documented are because of the open source community that actually bother to dig in and do this (without any vendor support). That means there is no Android or Apple device on the market today that accomplishes what you say. The only phones that are out there that can do that are the Pinephone and Librem 5. I have beta devices of both, and while I am extremely excited to see them mature and turn into daily drivers, the fact is neither can actually be a daily driver today.
  - tremon 7y ago
    > There are alternatives Can you name one smartphone device with open internals? I'd love to buy one, but I don't think they exist. From Replicant's recommendations [1]: If compromising on privacy/security is not an option, or anything serious is at stake (e.g. political activism or journalism in a sensitive area), it is advised to avoid using a telephony-enabled device at all. My impression from the smartphone market is that phone platforms have become less open, not more, over the last ten years. The PinePhone isn't generally available yet, and the Librem 5 current iterations don't have working audio calls. [1] https://www.replicant.us/freedom-privacy-security-issues.php#recommendations https://www.replicant.us/freedom-privacy-security-issues.php...
    - madez 7y ago
      Openness isn't binary. One significant step is support for the mainline Linux kernel. Another significant step is free information about the hardware on a high-level, such as PCB schematics and documentation about the used chips. Here are some projects that I'm aware of: Mainline Linux: https://pocket.popcorncomputer.com/ https://pocket.popcorncomputer.com/ https://necunos.com/shop/ https://necunos.com/shop/ Mainline Linux + high-level hardware documentation: https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/ https://www.pine64.org/pinephone/ https://www.pine64.org/pinephone/
  - munificent 7y ago
    That would work better mobile phones were anywhere in the vicinity of an efficient market. It's not. * The barrier of entry is very high: You need a top-tier manufacturing system and supply chain. An operating system. An entire suite and market of applications. All of the apps users expect and rely on (mail, navigation, Facebook, chat, Instagram, etc.) must be supported. The hardware is only profitable if you manufacture at very high scale. * Information asymmetry is very high. Users have almost no insight into how secure one platform is versus another. In fact, they have access to paradoxical information. The most secure platforms are the ones with the most transparent security flaw handling, but those are also the ones that appear the least secure because the vulnerabilities are more widely reported. * Products are nowhere near commoditized. A phone is a very large constellation of hardware, operating system, and software features. There is no apples to apples comparison between phones. Maybe you like the camera on one but not the screen on the other. One has better apps but the other a more stable OS. This is not a market where consumer choice will effectively drive solutions to diffuse problems.
  - toast0 7y ago
    Do you want two OpenMoko phones sitting in my drawer? They're about as useful now as they were then.
  - tripzilch 7y ago
    That solution is also rather terrible. We need a better solution than "vote with our wallets", I'm not prepared to give disproportionate voting power to those with disproportionally more money. Because money does not make one more right, more qualified and most definitely not more likely to make a decision that is fair to everybody. "Voting with your wallet" only leads to good outcomes if the incentives are right. I mean it's money, the VAST majority of it is spent not for the greater good but for small, inefficient egotistical purposes.
- rjmunro 7y ago
  In the UK I always wonder if it's possible to bring a claim under Part 1 Chapter 2 of the Consumer Rights Act 2015. The goods must be 'satisfactory'. Remove code execution over bluetooth is not satisfactory, even if it only became apparent 3 years later. https://www.moneysavingexpert.com/shopping/consumer-rights-refunds-exchange/ https://www.moneysavingexpert.com/shopping/consumer-rights-r...
  - 867-5309 7y ago
    a legal battle with a phone manufacturer will cost much more than the phone itself. 99% of retailers will say it's nothing to do with them, take it up with the manufacturer. phones are relatively cheap and transient commodities compared to something like houses, where "consumer rights" might actually mean something
    - jacquesm 7y ago
      If consumer rights don't mean anything for > $500 devices then there might as well be no consumer rights.
    - rjmunro 7y ago
      > a legal battle with a phone manufacturer will cost much more than the phone itself You'd only need to do it once to set a precedent, and everyone can get their phones fixed or replaced. The problem is that the law applies to the retailer, not to the manufacturer. As I didn't buy my phone direct, I'd have to get the retailer to replace it, and as I went to a high street retailer who is suffering from competition from Amazon etc, and closing branches, it feels bad to give the problem to them. If I'd bought the phone from the manufacturer direct, from Amazon, or from a phone network, I'd gladly go ahead with the action because those retailers would have enough clout that the manufacturer would care about loosing their business.
    - michaelhoffman 7y ago
      In the UK it is really easy and inexpensive to file a small claim, and there are limits to how much cases on the small claims track can cost you. https://www.gov.uk/make-money-claim https://www.gov.uk/make-money-claim I've done it myself and got paid by an intransigent phone retailer relatively promptly after that point. My lawsuit was about a contractual dispute rather than faulty goods though.
- kop316 7y ago
  Yep. Even Google's own devices that are not supported anymore will permanently be vulnerable to this: https://developers.google.com/android/images https://developers.google.com/android/images I have a Pixel C that will never have an official patch to this exploit. I wonder if this is a user space exploit too, and if so, that would mean there's no technical reason for why they can't update it.
  - zozbot234 7y ago
    I'm pretty sure that Pixel C (dragon) is in the PostmarketOS wishlist - you might want to get involved! It does already have LineageOS support.
    - kop316 7y ago
      Yep it does, I have it on Lineage. However Lineage cannot update the Kernel (due to no vendor support), it's stuck on 3.10. I'll take a look at Postmarket, I didn't know they were working on it. My issue is that I use the tablet primarily as my music workstation, and there are several apps I use that depend on Google Play. I do have a Pinephone, and I would honestly prefer to use my time to get a matured OS for that. EDIT: I looked around on PostmarketOS, I did not see anything for the Pixel C? I just saw an external resource on how to boot Linux onto the Pixel C
      - PhilippGille 7y ago
        > I didn't know they were working on it. > ... > I did not see anything for the Pixel C He was just talking about the wishlist I think, which is this one I guess: https://wiki.postmarketos.org/wiki/Device_Wishlist https://wiki.postmarketos.org/wiki/Device_Wishlist But I don't see it there either.
- DangerousPie 7y ago
  FWIW, the situation is significantly better in the Apple phone market.
  - oauea 7y ago
    Where can I buy a $200 apple phone? And how do I develop software for it without buying a $1000 macbook? Oh, and I have to pay $100/year for the privilege of being able to develop software for my own hardware, right?
    - nxc18 7y ago
      Buy a $400 device and hold onto it for a few years. The android device needs to be replaced every 2 years and subjects you to misery for the last half of its life. The old iPhone is going to work as well as, if not better than, a new android device - Apple tends to be about 5 years ahead of Qualcomm in performance, and they actually service their devices. My mom is using my iPhone 6S from 2015 that feels about as snappy as my 2018 XR. And that feels snappier than a pixel 4. Very few people are software developers so the Mac req to develop is a non-issue.
      - khill 7y ago
        Not true - I replace my Android phones every 4-5 years.
      - oauea 7y ago
        My phone is older than that, and it's working perfectly fine. It's still getting updates, too. No idea what you're talking about or where you're getting your information from, but it's clearly wrong and biased. Makes sense I suppose, when you've spent so much money to buy into the apple ecosystem you just can't help but defend it.
    - heavyset_go 7y ago
      Don't forget that GPL software is banned from the App Store.
- neilsimp1 7y ago
  My current phone (Samsung Note 5) is too old to receive updates and I'm still on Android 7. I hardly use Bluetooth but I'm still a little upset.
- 32gbsd 7y ago
  this, hardware has become a the ugly ducklin to software.
- dspillett 7y ago
  At least there is the mitigation that it isn't exploitable unless the device is scanning for new devices to pair with, at least by my reading of the reports I've seen. Phones are not usually in that state unless the BT settings screen is open. Otherwise it would drain excess battery in normal use.
  - londons_explore 7y ago
    No - it is always exploitable, but you need to know the Mac address to pull off the exploit. While scanning for devices, a phone reveals the Mac address. There are other ways to know the Mac address too.
- mtgx 7y ago
  > The industry forces us to throw away perfectly fine hardware after just 3 years or so. And even if you don't care about software or security updates, it's still true in the sense that most don't have replaceable batteries now, and they tend to use batteries that start to die out after about 2 years. They do this on purpose, but it's quite difficult to prove they were doing it as "planned obsolescence". This is why I'd fully support laws that make it illegal to make battery-powered devices that can't have their batteries easily replaced by the consumer (not the iFixit guys).
- ChrisCinelli 7y ago
  > That's heavy Almost every month there are security patches for "critical" problems. Just skim throught the blog pages. This is Jan 2020 for example: https://source.android.com/security/bulletin/2020-01-01 https://source.android.com/security/bulletin/2020-01-01 Consider this: if I remember correctly somebody on HN was saying that in these days the average time from releasing a patch and exploit found in the wild is 4 days. Consider that the patches hit the open source code a lot before they are deployed. Consider that beside Google, any other Android phone manufacturer take around a month before releasing the patches even on current models. The situation has no easy solutions.
  - arendtio 7y ago
    > Consider that beside Google, any other Android phone manufacturer take around a month before releasing the patches even on current models. Still the biggest problem. For my PC I can install updates on a daily basis. For my smartphone, I can be happy if there are any updates at all.
    - ChrisCinelli 7y ago
      If your OS is open sourced, the question is: how long does it take from the time the patch is discussed in open places (ex: mailing list or bug trackers for patch approval) and when the patch is deployed?
- ChrisCinelli 7y ago
  I agree with you that it is a shame that perfectly working hardware is left highly insecure after just 3 years (that is actually worse for some other manufacturers). The worst part is that people keep using the phones because are not tech savvy or grossly underway the risk and they do not feel that they need to spend money on a new phone.
- silenussays 7y ago
  But unlike Apple's closed source walled garden ecosystem, Android is open source! That means you can patch it yourself! Right guys?
- shadowgovt 7y ago
  > The industry forces us to throw away perfectly fine hardware after just 3 years or so. Possibly because of things like this; when a vulnerability isn't going to get patched, churn (with new hardware running newest OS) protects the ecosystem against mass-compromise. We can bemoan the lack of patches, but who's paying for the patches?
  - DiabloD3 7y ago
    We are, thats the problem. When you can make a ridiculous profit on a flagship phone and sell it for $500-700 (say, a OnePlus, for a good example), but they sell it for $800-1400 (Samsung, Apple, et al), then what am I paying for? It's supposed to be for better support and a smoother experience when things go wrong. You know who has historically stabbed me in the back the least? OnePlus. I'm not going to say it has been perfect, but for a phone I spent $550 on, they've screwed me far less times than other alternatives would have. So, we are paying for the patches to be delivered on a meaningful schedule for more than 3 years. I seem to be getting it what I paid for, and you don't. There is something massively wrong with this picture.
    - megablast 7y ago
      You are paying for apple stores, and instant access to support and replacement. You are paying for 5 years of updates. And a superior phone.
- loeg 7y ago
  You can shorten 3 years to 1.5 for typical Android vendors (i.e., Samsung) and maybe extend it to 4 or 5 years for Apple. There is a marked difference in the two ecosystems' approach to support for older hardware.
- xtat 7y ago
  mobile is the tire fire that keeps on giving
m1r3k 7y ago
My OnePlus 3 phone just got its last security patch and is now out of support from the manufacturer. I use bluetooth constantly for my smartwatch and headphones. I think it's time for custom firmware just because of this. Goodby banking apps and Google Pay, because apparently a newer but unofficial OS is more insecure [1]. [1] https://developer.android.com/training/safetynet https://developer.android.com/training/safetynet
- guimoz 7y ago
  You can usually still pass safetynet with latest magisk, even on custom Roms. Go check the xda forums and you might find that.
  - m1r3k 7y ago
    I know there are means to defeat safetynet but honestly I was glad not to tweak my phones anymore and happy without a rooted firmware. I remember the times of endless tweaking and patching after some Google Play services update a few years ago.
  - zozbot234 7y ago
    > You can usually still pass safetynet with latest magisk, even on custom Roms. It's unreliable by definition. You're better off keeping a device around with the stock OS on it, that you only use for SafetyNet-required stuff.
Brave-Steak 7y ago
> Keep your device non-discoverable. Most are only discoverable if you enter the Bluetooth scanning menu. Nevertheless, some older phones might be discoverable permanently. Does this mean your MAC address isn't visible while on, non-discoverable and connected to a BT device?
- baybal2 7y ago
  Actually Android keep bluetooth on even when UI says off for Google to radiolocate your position.
  - rjmunro 7y ago
    Are you sure? I know they keep some WiFi on, but I didn't think there was much location value in bluetooth signals because most bluetooth devices people use are portable (headphones, cars, etc.)
    - baybal2 7y ago
      Actually yes, I did investigate that. Can post a screenshot.
      - whatisthiseven 7y ago
        Did you also disable that setting under the "location" submenu, which explicitly says it works even if bluetooth is off? Not that this is good design, mind you, but if you turned both settings off and still say BT activity, then that is much different.
        baybal2 7y ago
        If you do that, it will disable it. Yes, it's a well hidden option deep in the menu.
  - gruez 7y ago
    That can be turned off.
2T1Qka0rEiPr 7y ago
> Keep in mind that most Bluetooth enabled headphones also support wired analog audio. Is this true?
- lathiat 7y ago
  I would say the reverse is true. There is absolutely a subset that support this but I doubt most is close.
- lima 7y ago
  Actual headphones, yes - many of them have an analog jack. But I haven't ever seen a bluetooth headset that support analog audio.
  - zeisss 7y ago
    My Bose QuietComfort 35 has a cable and jack for analog audio. It is quite common among germans, afaict.
    - rahuldottech 7y ago
      Those are headphones. I think OP was talking about wireless earphones.
  - Munksgaard 7y ago
    My Jabra Elite 85h has jack in addition to bluetooth.
    - rahuldottech 7y ago
      Again, those are headphones. OP was talking about earphones, I think.
- tushar-r 7y ago
  Headphones, yep. Earphones? Mostly no.
tjoff 7y ago
> Only enable Bluetooth if strictly necessary. Keep in mind that most Bluetooth enabled headphones also support wired analog audio. Reason #4373 that ditching the headphone jack is pure insanity. Sigh.
- gchokov 7y ago
  I haven’t missed the jack for a single day.
  - flir 7y ago
    How do you deal with the latency in games?
    - zozbot234 7y ago
      BT latency is annoying enough when listening to media. I'm used to pressing the pause button and having the audio stop promptly, with no perceptible delay. The video desync (if applicable) can also be very annoying.
      - tommit 7y ago
        That's odd, I have literally never experienced that before. What kind of setup are you using? I just tried it now, thinking maybe I just never really paid attention to any play/pause delay when listening to music or watching videos. Nope, it's pretty much instant as far as I can tell. I'm using the AirPods Pro and had Gen 1 AirPods before that -- can't recall ever having that problem in the past 3 years.
        avian 7y ago
        Not GP. It really depends on the device in my experience. My Denon system has seconds of lag over Bluetooth, enough to even make the volume slider on the phone annoying to use. On the other hand, my wireless headphones from Sony have as far as I can tell zero discernable lag. Both used from the same Android phone.
markhenrry 7y ago
https://www.printerrepairnearme.com/troubleshooting/fix-hp-printer-offline-windows-10-issue/ https://www.printerrepairnearme.com/troubleshooting/fix-hp-p...
magicalhippo 7y ago
> For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address. Which ones would that be? Anyone know?
billpg 7y ago
"We could roll out the patches, or we could make all our customers buy new phones!" Stagefright again.
est31 7y ago
Judging by the three commits added by the android-9.0.0_r53 tag in the platform/system/bt android subcomponent, the vulns seem to be UAF + OOB write. All vulnerabilities thus belong into the class of vulnerabilities that safe Rust eliminates. https://android.googlesource.com/platform/system/bt/+/1d788d25a8e1632eee1bfdb2b7c42176ad24b43a%5E%21/ https://android.googlesource.com/platform/system/bt/+/1d788d... https://android.googlesource.com/platform/system/bt/+/c20f248f7530252c749004c1efe6e1074f92e72d%5E%21/ https://android.googlesource.com/platform/system/bt/+/c20f24... https://android.googlesource.com/platform/system/bt/+/abc3023b05872f49a1e0e5c078a33dc055b62afb%5E%21/ https://android.googlesource.com/platform/system/bt/+/abc302...
- userbinator 7y ago
  It's an 8-bit counter... just allocate a fixed 256 entries and be done with it. That reads like code written by people without any embedded/low-level experience. Keeping code simple and without unnecessary abstraction is a far more valuable skill than $safe-language-trend-of-the-day.
  - reyqn 7y ago
    It's a valuable skill for sure, but there apparently isn't enough people with this skill on the market, which is why $safe-language-trend-of-the-day is being developed and gains momentum.
    - bluejekyll 7y ago
      How long must a language be around and prove it’s staying power before people will stop brushing it aside with the “$safe-language-trend-of-the-day“ quip? 1 year? 2 years? 5 years? 50? How many people must use it? 1k? 10k? 100k? It’s pointless to argue with someone who throws Rust into that category at this point because it means nothing. It’s a slight to allow them to feel ok, that eventually this language too will pass, and so it will be ignored.
    - zamalek 7y ago
      > there apparently isn't enough people with this skill on the market Judging by the number of memory vulnerabilities found each year in mainstream operating systems (which are developed by some of the best programmers around), there aren't any people on the market with this skill. This is very likely because all programmers are human beings. Manually managing memory isn't difficult, it has been proven to be practically impossible. I wouldn't care if it were Linus claiming otherwise, it's ignoring incredible amounts of evidence to the contrary and is much like flat-earther.
photon-torpedo 7y ago
> only the Bluetooth MAC address of the target devices has to be known Android has a feature of "Bluetooth scanning" to improve device location (similar to Wifi scanning). I'm not sure, but even if Bluetooth is disabled in the menu, this might still activate Bluetooth occasionally and perhaps reveal the Bluetooth MAC to the (nearby) world?
- dspillett 7y ago
  IIRC that doesn't enable BT if disabled, only uses it if available.
  - bepvte 7y ago
    It says "Bluetooth scanning — Let apps use Bluetooth for more accurate location detection, even when Bluetooth is off." I doubt it makes the device discoverable though.
nickcw 7y ago
> As soon as we are confident that patches have reached the end users, we will publish a technical report on this vulnerability including a description of the exploit as well as Proof of Concept code. It is likely to be a long time to never for most Android phones to receive patches for this :-(
microcolonel 7y ago
Gotta say, having worked with the Android Bluetooth stack, I'd be surprised if there weren't lots of serious issues like this. The handling of pointers in there is often both clever and not helpful.
aedron 7y ago
So some questions: > with the privileges of the Bluetooth daemon Which priviliges is that? Can it access user data? Snoop on input/output? > For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address So if wifi is off, I'm safe? I have bluetooth on all the time, because it automatically pairs with my car for cellular and audio, and turning it on and off would be a hassle. I rarely, however, use wifi unless I have to download a very big amount of data, which is almost never.
- oauea 7y ago
  > So if wifi is off, I'm safe? No, the connection packets can still be sniffed from the air once your device connects to your car. Then the attacker knows your mac address and can initiate the exploit.
- e12e 7y ago
  > Which priviliges is that? Can it access user data? Snoop on input/output? This is somewhat addressed in a comment/reply by jorge: https://insinuator.net/2020/02/critical-bluetooth-vulnerability-in-android-cve-2020-0022/#comment-103506 https://insinuator.net/2020/02/critical-bluetooth-vulnerabil... > Hi, the Bluetooth daemon is a process on the Android system that runs in the background (daemon) that is responsible for managing the Bluetooth controller and handling of various Bluetooth related protocols, such as HCI, L2CAP and GATT. As it has to process attacker-controlled input it is susceptible to attacks. In addition, it has to run with high privileges (not as ‘root’ like on Linux) to support features like: – file transfer => read files – share Internet connection => configure network and VPN – Human Interaction Devices => emulate keyboard and mouse
matchbok 7y ago
Android is such a mess. Google needs to do a rewrite and dump legacy support.
- drummer 7y ago
  Quite possibly the worst piece of software ever. Hot garbage.
  - deleted 7y ago
    [deleted]
- eximius 7y ago
  I mean, they kind of are... https://en.wikipedia.org/wiki/Google_Fuchsia https://en.wikipedia.org/wiki/Google_Fuchsia
mavhc 7y ago
Why haven't most of the billions of Android phones been hacked already? Most never get updates and seems like there's 100 ways to hack them.
- anotheryou 7y ago
  I think phones are also relatively hardened so the attack surfaces are not super convenient. Bluetooth: get in reach of an attacker (and from another comment: have your device searching for bluetooth devices) Web-stuff: if a patched browser doesn't help you are still relatively safe browsing all the non-infecting websites in the world. file-stuff: you have to be stupid enough to open files, on your phone, from phishy mails (unless you are targeted they are always suspiciously generic, even when spreading from a hacked acquaintance ) I guess if there was a vulnerability where you could remotely gain full control over a phone without any action on the phone side you'd indeed have phone botnets. Looks like there are no such vulnerabilities. Take what I write with a grain of salt, I'm actually just a noob trying to make sense of this, too.
  - tgsovlerkhgsel 7y ago
    > Bluetooth: get in reach of an attacker This part looks very different if the attack is a worm. How many phones are not in reach of another vulnerable phones at least once a workday?
    - sieabahlpark 7y ago
      Ding ding ding! Attack one and get them all. Can't wait for the next DNS attack that takes down the internet from this.
  - mavhc 7y ago
    The stagefright stuff was never fixed for most people I'd bet, it's just odd that no one's just decided to try to take over a billion phones. 90% of them don't seem to get monthly patches in a timely manner/at all, or are so old there's no patch anyway.
butz 7y ago
Great, because of limited Android updates I have to get a new phone.
joelthelion 7y ago
On the plus side, could this be used to root phones?
gaius_baltar 7y ago
I'm now wondering if I can use this to root my phone.
FraKtus 7y ago
Am I right to understand that this vulnerability only works when Bluetooth is in discoverable mode? If yes, then most phones are safe even if they have this vulnerability, it's only when you go in the Bluetooth menu that you are at risk...
dmatech 7y ago
I hate to say it, but it seems like only a large-scale worm outbreak that gets media coverage would be enough to fix the utterly broken Android patching landscape. From the description, this appears wormable (especially in crowds and possibly in vehicles). And unlike other wormable vulnerabilities that go through a service (like Google or even the phone company), this is just two phones with no intermediary to protect devices.
zepto 7y ago
Surprising that Project Zero didn’t catch this.
beatgammit 7y ago
It's exactly this type of reason that I'm excited for the Librem 5 and PinePhone. I don't use many apps, and I value security updates, so using a community supported phone based on standard Linux sounds a lot more appealing to me than getting another Android phone. My current phone is an Android One device and so should still be getting updates, so hopefully I can stay reasonably secure until those phones are usable as replacements.

That's heavy. There are tons of phones out there that will never be patched again. The situation on the phone market is so miserable. The industry forces us to throw away perfectly fine hardware after just 3 years or so.

madez 7y ago
The solution is rather simple; buy devices with better documented and open internals rather than what's cheapest, shiniest, and most convenient. There are alternatives, and we all vote with our wallets.
- pixl97 7y ago
  Ah, yes, this is sure to work. watches the plan fail yet again This is like saying "we dont need regulations in meat packing, every individual can become educated in butchery cleanliness and track the supply chains for the products they buy and everything will be better!"
  - madez 7y ago
    We surely need regulation that demands at least delayed publication of firmware source and hardware documentation, I agree. The analogy to regulation in the food industry is enlightening. It's easier to achieve regulation when people care and show that they care. It seems to me, voting now with your wallet is one of the most direct ways to make a case.
    - Normal_gaussian 7y ago
      I don't think many people are talking directly to their officials about it. It certainly isn't something my local representatives talk about, and the political consultation groups some of my uni-friends now work in definitely don't have it on their radar.
    - clarry 7y ago
      Voting against the tyranny of the ignorant masses (or just people who also value convenience; or those who can't afford expensive) is a discarded vote. Your pennies are not going to change the world.
      - madez 7y ago
        Unlike in some political systems, in the market the winner doesn't take all, but rather all receive their votes. Even then, I don't understand the psychology underlying the concept "discarded vote". I vote for what I think is best. To me that is what votes are all about. Is the psychological desire to be part of the winning group responsible?
        clarry 7y ago
        If you know you're voting for a niche candidate that cannot win, then that vote achieves nothing. It amounts to as much as not voting at all; voting, then, is an empty ritual, just a rain dance. Psychological desire has nothing to do with it, it's just hard facts.
        madez 7y ago
        Even in an archaic the-winner-takes-all vote, the result reveals important information besides determining the winner. That information can influence other voters, vote options, and the winners behavior.
        kortilla 7y ago
        We’re talking about voting with your wallet. The vendor you pick doesn’t need to “win”, it just needs to get enough to survive. This is why voting with your wallet is much more powerful than voting for winner-take-all representatives in a political system.
        tripzilch 7y ago
        I think you're taking the analogy of "vote with your wallet" a bit too far. It's not actual voting, or democratic, it just means that whoever has the most money decides. It's not really comparable to a political system of voting (and if you think it does seem suspiciously similar, that probably means that political system is broken). > I vote for what I think is best. Maybe you're an exception, but if you're talking about "vote with your wallet", then the vast majority will actually vote what they think is best for their wallets. I mean, if you're going to let money decide, then expect the outcome to benefit money.
    - Mirioron 7y ago
      How do I vote with my wallet though? The only alternative is an iPhone which fulfills a somewhat different role functionally.
  - dTal 7y ago
    >This is like saying "we dont need regulations in meat packing, every individual can become educated in butchery cleanliness and track the supply chains for the products they buy and everything will be better!" People say this kind of thing all the time, even on HN. It's a libertarian saw that the FDA is unneccesary and obstructionist. Personally I think it's deranged, but apparently it's an ideological battle that's still being fought.
- taspeotis 7y ago
  Or just buy Apple. The iPhone 5s was released in 2013 and got an update less than a fortnight ago (January 28).
  - eithed 7y ago
    Can you make assurances that iPhone doesn't suffer from similar issues, given it's not open source solution?
    - lima 7y ago
      There's tons of security researchers focusing on iOS and the lack of source code access is merely an inconvenience.
    - objclxt 7y ago
      Depends what you mean by "similar issues" If you mean "a bunch of relatively new Android phones not getting security updates because their manufacturer doesn't support them", then yes. Apple is actively providing not just security patches but entire feature software updates for the iPhone 6S, which is 4.5 years old at this point.
      - eithed 7y ago
        Yup, that's what I mean. While I do have an Android phone that is patched (Samsung), I understand that many people will be hmm... irritated that this vulnerability won't be fixed and requires them to upgrade. I'd not treat switching to Apple ecosystem as panacea to everything though and would be more for security through audit, not obscurity.
        why_only_15 7y ago
        Apple's security is heavily audited in a lot of ways. They give special phones to researchers that make it easier to audit them, and there are significant bug bounties.
        7y ago
- rjmunro 7y ago
  Looks like I need a new phone because of this. Which phone would you recommend so I don't make the same mistake again?
  - krn 7y ago
    I would only buy a device running Android One, because they receive monthly security patches and new Android versions for up to 3 years. The current options include all Nokia smartphones, Motorola One line, and Xiaomi Mi A line. For the best hardware and 5G support, I would look at Nokia 9.2 (Snapdragon 8--) and Nokia 8.2 (Snapdragon 7--) releases this year. The best deal is to buy 6 months after the release, when most Android devices become heavily (30-40%) discounted, but are still quite new. I prefer Android over iOS because of the freedom to install open-source OS-level ad-blockers, such as Blokada[1], which greatly improve privacy and battery life. [1] https://blokada.org/ https://blokada.org/
    - zozbot234 7y ago
      Note that "Xiaomi Mi A" devices are the only ones that are similar to Android One. Most Xiaomi devices have a custom UX and additional weirdness. (Among which is the need to "sign up" online for bootloader unlock and wait for a timeout period. They do this because resellers used to ship bootloader-unlocked versions with "unofficial" mods of sorts, often with customers being none-the-wiser. Not an issue on the 'Mi A' line, for whatever reason.)
      - krn 7y ago
        > Most Xiaomi devices have a custom UX and additional weirdness. That's true. Just like Samsung, Huawei, OnePlus, and any other Android manufacturer except Nokia, Xiaomi maintains its own Android ROM, called MIUI[1]. It's not as vanilla as Android One, but at least it also receives monthly security patches. > Among which is the need to "sign up" online for bootloader unlock and wait for a timeout period. They do this because resellers used to ship bootloader-unlocked versions with "unofficial" mods of sorts, often with customers being none-the-wiser. Not an issue on the 'Mi A' line, for whatever reason. It's not an issue with Xiaomi Mi A line, because Xiaomi's reputation is not affected as much if there is something wrong with a smartphone that is not running its custom ROM. Nokia has only recently started allowing to unlock the bootloader of some of the models, and has a similar process[2]. [1] https://en.wikipedia.org/wiki/MIUI https://en.wikipedia.org/wiki/MIUI [2] https://www.nokia.com/phones/en_int/bootloader https://www.nokia.com/phones/en_int/bootloader
- zozbot234 7y ago
  They're all using the same junk SoC's with zero documentation and the crappiest possible level of "board" support anyway. You're actually better off buying a device where that support has been properly reverse-engineered/forward ported and is included in the mainline kernel. (Lots of Allwinner boards are "supported" in that way.) But it's ridiculous that we have to do this. Also FWIW, the problem has zilch to do with "Android" per se - pre-Android mobile Linux was even worse. It's embedded platforms in general.
- kees99 7y ago
  My understanding is that each android phone model is unique and requires unique OS update (unlike, say, BIOS- or UEFI-based x86 PCs, where exact same Windows/Linux/BSD/... image can be installed on any of them). Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone - now that would be the true alternative, which I would be delighted to vote for with my wallet.
  - zozbot234 7y ago
    > Having a "standard" OS interface for the phone, where there is just one OS image for a given OS version, and that image could be installed on any phone Project Treble is working towards this, in a way. But it's a huge hack that's still dependent on lots of weird AOSP-specific stuff, and doesn't even give you a "single" OS image for every device - the "proper" image for your device varies by baseline AOSP support (7, 8, 9, 10), "A" vs. "A+B" boot and of course 32-bit vs. 64-bit architecture. Nowhere near "UEFI-based PC" territory.
    - yjftsjthsd-h 7y ago
      Eh... remember 32-bit UEFI? It might be smaller, but there is still room for weirdness.
  - jacquesm 7y ago
    > My understanding is that each android phone model is unique Sure, but each PC is also 'unique' in that sense, in fact I'd happily bet that there are more different kinds of hardware combinations for PCs than there are android phone models. And yet, that never was a problem.
    - zozbot234 7y ago
      Plug-and-Play and then ACPI have been used to get around this. Hardware discovery just doesn't seem to be a thing on these embedded SoC platforms, and even the hardware support itself (drivers, etc.) is extremely sub-par if you expect to run the ordinary, mainline kernel.
- nicolaslem 7y ago
  This is why my next phone will be a Librem 5. I know that it will probably suck but at least it's moving things in the right direction.
  - madez 7y ago
    I'm in the same boat. If it moves things in the right direction, then it doesn't suck.
    - prox 7y ago
      Indeed! I usually get “but it’s still a closed source modem” as a counterpoint ... sigh
      - squarefoot 7y ago
        The closed source modem, or network firmware for that matter, isn't much of a problem if it can't see clear data and/or access to system memory or execute instructions. I'd see it more of a black box not unlike old RS232 connected modems: they could see all data going back and forth, but encrypting that data would be enough since they could never access the system memory to see the data before encryption or after decryption. Librem 5 and Pinephone should work along these lines. Having everything 100% open would be better, but in this case being closed doesn't create security concerns since all personal data is unavailable to these subsystems; only the main system, which is entirely open and where the user is king, can access them.
  - ekianjo 7y ago
    > my next phone will be a Librem 5. Better go with a Pinephone if everything that's been written about Librem as a company is even half-true.
- papermachete 7y ago
  What are some 2018+ sub-$200 smartphones that run first-party LineageOS to no disadvantage over the stock ROM?
  - pmlnr 7y ago
    There aren't any, unless you go second hand. LOS and nearly all custom ROMs are aiming at widespread, mostly high end devices, which is one of the big problems.
    - myself248 7y ago
      I've learned this lesson. If I have $200 to spend on a phone, I will not buy a low-end 2019 $200 phone. I will buy a used (or new-old-stock) flagship that was $700 when it came out a few years ago, and is now $200 on the used market. The older flagship will have similar specs to today's low-end junk, but also all the enthusiast support, better accessory availability, and probably better build quality overall, because it was originally intended to be the highest of the high-end.
      - steerablesafe 7y ago
        Flagships have the most idiotic designs though, as far as I looked around. Low-end current year $200 phones often have removable batteries, headphone jack and dual sim support. Flagships typically have none of that.
        papermachete 7y ago
        I mean if you can go so far as to install or build third party ROMs, it'd be an interesting weekend hobby to repair electronics yourself. I've saved hundreds of dollars of technology on trivial home repairs instead of buying replacements.
      - mavhc 7y ago
        You'll also have to replace the battery though
- kop316 7y ago
  I hope you realize that with the exception of freescale, there are no phone and tablet devices where the vendor actually cooperate and does that. Many of the devices that are documented are because of the open source community that actually bother to dig in and do this (without any vendor support). That means there is no Android or Apple device on the market today that accomplishes what you say. The only phones that are out there that can do that are the Pinephone and Librem 5. I have beta devices of both, and while I am extremely excited to see them mature and turn into daily drivers, the fact is neither can actually be a daily driver today.
- tremon 7y ago
  > There are alternatives Can you name one smartphone device with open internals? I'd love to buy one, but I don't think they exist. From Replicant's recommendations [1]: If compromising on privacy/security is not an option, or anything serious is at stake (e.g. political activism or journalism in a sensitive area), it is advised to avoid using a telephony-enabled device at all. My impression from the smartphone market is that phone platforms have become less open, not more, over the last ten years. The PinePhone isn't generally available yet, and the Librem 5 current iterations don't have working audio calls. [1] https://www.replicant.us/freedom-privacy-security-issues.php#recommendations https://www.replicant.us/freedom-privacy-security-issues.php...
  - madez 7y ago
    Openness isn't binary. One significant step is support for the mainline Linux kernel. Another significant step is free information about the hardware on a high-level, such as PCB schematics and documentation about the used chips. Here are some projects that I'm aware of: Mainline Linux: https://pocket.popcorncomputer.com/ https://pocket.popcorncomputer.com/ https://necunos.com/shop/ https://necunos.com/shop/ Mainline Linux + high-level hardware documentation: https://puri.sm/products/librem-5/ https://puri.sm/products/librem-5/ https://www.pine64.org/pinephone/ https://www.pine64.org/pinephone/
- munificent 7y ago
  That would work better mobile phones were anywhere in the vicinity of an efficient market. It's not. * The barrier of entry is very high: You need a top-tier manufacturing system and supply chain. An operating system. An entire suite and market of applications. All of the apps users expect and rely on (mail, navigation, Facebook, chat, Instagram, etc.) must be supported. The hardware is only profitable if you manufacture at very high scale. * Information asymmetry is very high. Users have almost no insight into how secure one platform is versus another. In fact, they have access to paradoxical information. The most secure platforms are the ones with the most transparent security flaw handling, but those are also the ones that appear the least secure because the vulnerabilities are more widely reported. * Products are nowhere near commoditized. A phone is a very large constellation of hardware, operating system, and software features. There is no apples to apples comparison between phones. Maybe you like the camera on one but not the screen on the other. One has better apps but the other a more stable OS. This is not a market where consumer choice will effectively drive solutions to diffuse problems.
- toast0 7y ago
  Do you want two OpenMoko phones sitting in my drawer? They're about as useful now as they were then.
- tripzilch 7y ago
  That solution is also rather terrible. We need a better solution than "vote with our wallets", I'm not prepared to give disproportionate voting power to those with disproportionally more money. Because money does not make one more right, more qualified and most definitely not more likely to make a decision that is fair to everybody. "Voting with your wallet" only leads to good outcomes if the incentives are right. I mean it's money, the VAST majority of it is spent not for the greater good but for small, inefficient egotistical purposes.
rjmunro 7y ago
In the UK I always wonder if it's possible to bring a claim under Part 1 Chapter 2 of the Consumer Rights Act 2015. The goods must be 'satisfactory'. Remove code execution over bluetooth is not satisfactory, even if it only became apparent 3 years later. https://www.moneysavingexpert.com/shopping/consumer-rights-refunds-exchange/ https://www.moneysavingexpert.com/shopping/consumer-rights-r...
- 867-5309 7y ago
  a legal battle with a phone manufacturer will cost much more than the phone itself. 99% of retailers will say it's nothing to do with them, take it up with the manufacturer. phones are relatively cheap and transient commodities compared to something like houses, where "consumer rights" might actually mean something
  - jacquesm 7y ago
    If consumer rights don't mean anything for > $500 devices then there might as well be no consumer rights.
  - rjmunro 7y ago
    > a legal battle with a phone manufacturer will cost much more than the phone itself You'd only need to do it once to set a precedent, and everyone can get their phones fixed or replaced. The problem is that the law applies to the retailer, not to the manufacturer. As I didn't buy my phone direct, I'd have to get the retailer to replace it, and as I went to a high street retailer who is suffering from competition from Amazon etc, and closing branches, it feels bad to give the problem to them. If I'd bought the phone from the manufacturer direct, from Amazon, or from a phone network, I'd gladly go ahead with the action because those retailers would have enough clout that the manufacturer would care about loosing their business.
  - michaelhoffman 7y ago
    In the UK it is really easy and inexpensive to file a small claim, and there are limits to how much cases on the small claims track can cost you. https://www.gov.uk/make-money-claim https://www.gov.uk/make-money-claim I've done it myself and got paid by an intransigent phone retailer relatively promptly after that point. My lawsuit was about a contractual dispute rather than faulty goods though.
kop316 7y ago
Yep. Even Google's own devices that are not supported anymore will permanently be vulnerable to this: https://developers.google.com/android/images https://developers.google.com/android/images I have a Pixel C that will never have an official patch to this exploit. I wonder if this is a user space exploit too, and if so, that would mean there's no technical reason for why they can't update it.
- zozbot234 7y ago
  I'm pretty sure that Pixel C (dragon) is in the PostmarketOS wishlist - you might want to get involved! It does already have LineageOS support.
  - kop316 7y ago
    Yep it does, I have it on Lineage. However Lineage cannot update the Kernel (due to no vendor support), it's stuck on 3.10. I'll take a look at Postmarket, I didn't know they were working on it. My issue is that I use the tablet primarily as my music workstation, and there are several apps I use that depend on Google Play. I do have a Pinephone, and I would honestly prefer to use my time to get a matured OS for that. EDIT: I looked around on PostmarketOS, I did not see anything for the Pixel C? I just saw an external resource on how to boot Linux onto the Pixel C
    - PhilippGille 7y ago
      > I didn't know they were working on it. > ... > I did not see anything for the Pixel C He was just talking about the wishlist I think, which is this one I guess: https://wiki.postmarketos.org/wiki/Device_Wishlist https://wiki.postmarketos.org/wiki/Device_Wishlist But I don't see it there either.
DangerousPie 7y ago
FWIW, the situation is significantly better in the Apple phone market.
- oauea 7y ago
  Where can I buy a $200 apple phone? And how do I develop software for it without buying a $1000 macbook? Oh, and I have to pay $100/year for the privilege of being able to develop software for my own hardware, right?
  - nxc18 7y ago
    Buy a $400 device and hold onto it for a few years. The android device needs to be replaced every 2 years and subjects you to misery for the last half of its life. The old iPhone is going to work as well as, if not better than, a new android device - Apple tends to be about 5 years ahead of Qualcomm in performance, and they actually service their devices. My mom is using my iPhone 6S from 2015 that feels about as snappy as my 2018 XR. And that feels snappier than a pixel 4. Very few people are software developers so the Mac req to develop is a non-issue.
    - khill 7y ago
      Not true - I replace my Android phones every 4-5 years.
    - oauea 7y ago
      My phone is older than that, and it's working perfectly fine. It's still getting updates, too. No idea what you're talking about or where you're getting your information from, but it's clearly wrong and biased. Makes sense I suppose, when you've spent so much money to buy into the apple ecosystem you just can't help but defend it.
  - heavyset_go 7y ago
    Don't forget that GPL software is banned from the App Store.
neilsimp1 7y ago
My current phone (Samsung Note 5) is too old to receive updates and I'm still on Android 7. I hardly use Bluetooth but I'm still a little upset.
32gbsd 7y ago
this, hardware has become a the ugly ducklin to software.
dspillett 7y ago
At least there is the mitigation that it isn't exploitable unless the device is scanning for new devices to pair with, at least by my reading of the reports I've seen. Phones are not usually in that state unless the BT settings screen is open. Otherwise it would drain excess battery in normal use.
- londons_explore 7y ago
  No - it is always exploitable, but you need to know the Mac address to pull off the exploit. While scanning for devices, a phone reveals the Mac address. There are other ways to know the Mac address too.
mtgx 7y ago
> The industry forces us to throw away perfectly fine hardware after just 3 years or so. And even if you don't care about software or security updates, it's still true in the sense that most don't have replaceable batteries now, and they tend to use batteries that start to die out after about 2 years. They do this on purpose, but it's quite difficult to prove they were doing it as "planned obsolescence". This is why I'd fully support laws that make it illegal to make battery-powered devices that can't have their batteries easily replaced by the consumer (not the iFixit guys).
ChrisCinelli 7y ago
> That's heavy Almost every month there are security patches for "critical" problems. Just skim throught the blog pages. This is Jan 2020 for example: https://source.android.com/security/bulletin/2020-01-01 https://source.android.com/security/bulletin/2020-01-01 Consider this: if I remember correctly somebody on HN was saying that in these days the average time from releasing a patch and exploit found in the wild is 4 days. Consider that the patches hit the open source code a lot before they are deployed. Consider that beside Google, any other Android phone manufacturer take around a month before releasing the patches even on current models. The situation has no easy solutions.
- arendtio 7y ago
  > Consider that beside Google, any other Android phone manufacturer take around a month before releasing the patches even on current models. Still the biggest problem. For my PC I can install updates on a daily basis. For my smartphone, I can be happy if there are any updates at all.
  - ChrisCinelli 7y ago
    If your OS is open sourced, the question is: how long does it take from the time the patch is discussed in open places (ex: mailing list or bug trackers for patch approval) and when the patch is deployed?
ChrisCinelli 7y ago
I agree with you that it is a shame that perfectly working hardware is left highly insecure after just 3 years (that is actually worse for some other manufacturers). The worst part is that people keep using the phones because are not tech savvy or grossly underway the risk and they do not feel that they need to spend money on a new phone.
silenussays 7y ago
But unlike Apple's closed source walled garden ecosystem, Android is open source! That means you can patch it yourself! Right guys?
shadowgovt 7y ago
> The industry forces us to throw away perfectly fine hardware after just 3 years or so. Possibly because of things like this; when a vulnerability isn't going to get patched, churn (with new hardware running newest OS) protects the ecosystem against mass-compromise. We can bemoan the lack of patches, but who's paying for the patches?
- DiabloD3 7y ago
  We are, thats the problem. When you can make a ridiculous profit on a flagship phone and sell it for $500-700 (say, a OnePlus, for a good example), but they sell it for $800-1400 (Samsung, Apple, et al), then what am I paying for? It's supposed to be for better support and a smoother experience when things go wrong. You know who has historically stabbed me in the back the least? OnePlus. I'm not going to say it has been perfect, but for a phone I spent $550 on, they've screwed me far less times than other alternatives would have. So, we are paying for the patches to be delivered on a meaningful schedule for more than 3 years. I seem to be getting it what I paid for, and you don't. There is something massively wrong with this picture.
  - megablast 7y ago
    You are paying for apple stores, and instant access to support and replacement. You are paying for 5 years of updates. And a superior phone.
loeg 7y ago
You can shorten 3 years to 1.5 for typical Android vendors (i.e., Samsung) and maybe extend it to 4 or 5 years for Apple. There is a marked difference in the two ecosystems' approach to support for older hardware.
xtat 7y ago
mobile is the tire fire that keeps on giving

m1r3k 7y ago

My OnePlus 3 phone just got its last security patch and is now out of support from the manufacturer. I use bluetooth constantly for my smartwatch and headphones. I think it's time for custom firmware just because of this. Goodby banking apps and Google Pay, because apparently a newer but unofficial OS is more insecure [1]. [1] https://developer.android.com/training/safetynet https://developer.android.com/training/safetynet

guimoz 7y ago
You can usually still pass safetynet with latest magisk, even on custom Roms. Go check the xda forums and you might find that.
- m1r3k 7y ago
  I know there are means to defeat safetynet but honestly I was glad not to tweak my phones anymore and happy without a rooted firmware. I remember the times of endless tweaking and patching after some Google Play services update a few years ago.
- zozbot234 7y ago
  > You can usually still pass safetynet with latest magisk, even on custom Roms. It's unreliable by definition. You're better off keeping a device around with the stock OS on it, that you only use for SafetyNet-required stuff.

Brave-Steak 7y ago

> Keep your device non-discoverable. Most are only discoverable if you enter the Bluetooth scanning menu. Nevertheless, some older phones might be discoverable permanently. Does this mean your MAC address isn't visible while on, non-discoverable and connected to a BT device?

baybal2 7y ago
Actually Android keep bluetooth on even when UI says off for Google to radiolocate your position.
- rjmunro 7y ago
  Are you sure? I know they keep some WiFi on, but I didn't think there was much location value in bluetooth signals because most bluetooth devices people use are portable (headphones, cars, etc.)
  - baybal2 7y ago
    Actually yes, I did investigate that. Can post a screenshot.
    - whatisthiseven 7y ago
      Did you also disable that setting under the "location" submenu, which explicitly says it works even if bluetooth is off? Not that this is good design, mind you, but if you turned both settings off and still say BT activity, then that is much different.
      - baybal2 7y ago
        If you do that, it will disable it. Yes, it's a well hidden option deep in the menu.
- gruez 7y ago
  That can be turned off.

2T1Qka0rEiPr 7y ago

> Keep in mind that most Bluetooth enabled headphones also support wired analog audio. Is this true?

lathiat 7y ago
I would say the reverse is true. There is absolutely a subset that support this but I doubt most is close.
lima 7y ago
Actual headphones, yes - many of them have an analog jack. But I haven't ever seen a bluetooth headset that support analog audio.
- zeisss 7y ago
  My Bose QuietComfort 35 has a cable and jack for analog audio. It is quite common among germans, afaict.
  - rahuldottech 7y ago
    Those are headphones. I think OP was talking about wireless earphones.
- Munksgaard 7y ago
  My Jabra Elite 85h has jack in addition to bluetooth.
  - rahuldottech 7y ago
    Again, those are headphones. OP was talking about earphones, I think.
tushar-r 7y ago
Headphones, yep. Earphones? Mostly no.

tjoff 7y ago

> Only enable Bluetooth if strictly necessary. Keep in mind that most Bluetooth enabled headphones also support wired analog audio. Reason #4373 that ditching the headphone jack is pure insanity. Sigh.

gchokov 7y ago
I haven’t missed the jack for a single day.
- flir 7y ago
  How do you deal with the latency in games?
  - zozbot234 7y ago
    BT latency is annoying enough when listening to media. I'm used to pressing the pause button and having the audio stop promptly, with no perceptible delay. The video desync (if applicable) can also be very annoying.
    - tommit 7y ago
      That's odd, I have literally never experienced that before. What kind of setup are you using? I just tried it now, thinking maybe I just never really paid attention to any play/pause delay when listening to music or watching videos. Nope, it's pretty much instant as far as I can tell. I'm using the AirPods Pro and had Gen 1 AirPods before that -- can't recall ever having that problem in the past 3 years.
      - avian 7y ago
        Not GP. It really depends on the device in my experience. My Denon system has seconds of lag over Bluetooth, enough to even make the volume slider on the phone annoying to use. On the other hand, my wireless headphones from Sony have as far as I can tell zero discernable lag. Both used from the same Android phone.

markhenrry 7y ago

https://www.printerrepairnearme.com/troubleshooting/fix-hp-printer-offline-windows-10-issue/ https://www.printerrepairnearme.com/troubleshooting/fix-hp-p...

magicalhippo 7y ago

> For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address. Which ones would that be? Anyone know?

billpg 7y ago

"We could roll out the patches, or we could make all our customers buy new phones!" Stagefright again.

est31 7y ago

Judging by the three commits added by the android-9.0.0_r53 tag in the platform/system/bt android subcomponent, the vulns seem to be UAF + OOB write. All vulnerabilities thus belong into the class of vulnerabilities that safe Rust eliminates. https://android.googlesource.com/platform/system/bt/+/1d788d25a8e1632eee1bfdb2b7c42176ad24b43a%5E%21/ https://android.googlesource.com/platform/system/bt/+/1d788d... https://android.googlesource.com/platform/system/bt/+/c20f248f7530252c749004c1efe6e1074f92e72d%5E%21/ https://android.googlesource.com/platform/system/bt/+/c20f24... https://android.googlesource.com/platform/system/bt/+/abc3023b05872f49a1e0e5c078a33dc055b62afb%5E%21/ https://android.googlesource.com/platform/system/bt/+/abc302...

userbinator 7y ago
It's an 8-bit counter... just allocate a fixed 256 entries and be done with it. That reads like code written by people without any embedded/low-level experience. Keeping code simple and without unnecessary abstraction is a far more valuable skill than $safe-language-trend-of-the-day.
- reyqn 7y ago
  It's a valuable skill for sure, but there apparently isn't enough people with this skill on the market, which is why $safe-language-trend-of-the-day is being developed and gains momentum.
  - bluejekyll 7y ago
    How long must a language be around and prove it’s staying power before people will stop brushing it aside with the “$safe-language-trend-of-the-day“ quip? 1 year? 2 years? 5 years? 50? How many people must use it? 1k? 10k? 100k? It’s pointless to argue with someone who throws Rust into that category at this point because it means nothing. It’s a slight to allow them to feel ok, that eventually this language too will pass, and so it will be ignored.
  - zamalek 7y ago
    > there apparently isn't enough people with this skill on the market Judging by the number of memory vulnerabilities found each year in mainstream operating systems (which are developed by some of the best programmers around), there aren't any people on the market with this skill. This is very likely because all programmers are human beings. Manually managing memory isn't difficult, it has been proven to be practically impossible. I wouldn't care if it were Linus claiming otherwise, it's ignoring incredible amounts of evidence to the contrary and is much like flat-earther.

photon-torpedo 7y ago

> only the Bluetooth MAC address of the target devices has to be known Android has a feature of "Bluetooth scanning" to improve device location (similar to Wifi scanning). I'm not sure, but even if Bluetooth is disabled in the menu, this might still activate Bluetooth occasionally and perhaps reveal the Bluetooth MAC to the (nearby) world?

dspillett 7y ago
IIRC that doesn't enable BT if disabled, only uses it if available.
- bepvte 7y ago
  It says "Bluetooth scanning — Let apps use Bluetooth for more accurate location detection, even when Bluetooth is off." I doubt it makes the device discoverable though.

nickcw 7y ago

> As soon as we are confident that patches have reached the end users, we will publish a technical report on this vulnerability including a description of the exploit as well as Proof of Concept code. It is likely to be a long time to never for most Android phones to receive patches for this :-(

microcolonel 7y ago

Gotta say, having worked with the Android Bluetooth stack, I'd be surprised if there weren't lots of serious issues like this. The handling of pointers in there is often both clever and not helpful.

aedron 7y ago

So some questions: > with the privileges of the Bluetooth daemon Which priviliges is that? Can it access user data? Snoop on input/output? > For some devices, the Bluetooth MAC address can be deduced from the WiFi MAC address So if wifi is off, I'm safe? I have bluetooth on all the time, because it automatically pairs with my car for cellular and audio, and turning it on and off would be a hassle. I rarely, however, use wifi unless I have to download a very big amount of data, which is almost never.

oauea 7y ago
> So if wifi is off, I'm safe? No, the connection packets can still be sniffed from the air once your device connects to your car. Then the attacker knows your mac address and can initiate the exploit.
e12e 7y ago
> Which priviliges is that? Can it access user data? Snoop on input/output? This is somewhat addressed in a comment/reply by jorge: https://insinuator.net/2020/02/critical-bluetooth-vulnerability-in-android-cve-2020-0022/#comment-103506 https://insinuator.net/2020/02/critical-bluetooth-vulnerabil... > Hi, the Bluetooth daemon is a process on the Android system that runs in the background (daemon) that is responsible for managing the Bluetooth controller and handling of various Bluetooth related protocols, such as HCI, L2CAP and GATT. As it has to process attacker-controlled input it is susceptible to attacks. In addition, it has to run with high privileges (not as ‘root’ like on Linux) to support features like: – file transfer => read files – share Internet connection => configure network and VPN – Human Interaction Devices => emulate keyboard and mouse

matchbok 7y ago

Android is such a mess. Google needs to do a rewrite and dump legacy support.

drummer 7y ago
Quite possibly the worst piece of software ever. Hot garbage.
- deleted 7y ago
  [deleted]
eximius 7y ago
I mean, they kind of are... https://en.wikipedia.org/wiki/Google_Fuchsia https://en.wikipedia.org/wiki/Google_Fuchsia

mavhc 7y ago

Why haven't most of the billions of Android phones been hacked already? Most never get updates and seems like there's 100 ways to hack them.

anotheryou 7y ago
I think phones are also relatively hardened so the attack surfaces are not super convenient. Bluetooth: get in reach of an attacker (and from another comment: have your device searching for bluetooth devices) Web-stuff: if a patched browser doesn't help you are still relatively safe browsing all the non-infecting websites in the world. file-stuff: you have to be stupid enough to open files, on your phone, from phishy mails (unless you are targeted they are always suspiciously generic, even when spreading from a hacked acquaintance ) I guess if there was a vulnerability where you could remotely gain full control over a phone without any action on the phone side you'd indeed have phone botnets. Looks like there are no such vulnerabilities. Take what I write with a grain of salt, I'm actually just a noob trying to make sense of this, too.
- tgsovlerkhgsel 7y ago
  > Bluetooth: get in reach of an attacker This part looks very different if the attack is a worm. How many phones are not in reach of another vulnerable phones at least once a workday?
  - sieabahlpark 7y ago
    Ding ding ding! Attack one and get them all. Can't wait for the next DNS attack that takes down the internet from this.
- mavhc 7y ago
  The stagefright stuff was never fixed for most people I'd bet, it's just odd that no one's just decided to try to take over a billion phones. 90% of them don't seem to get monthly patches in a timely manner/at all, or are so old there's no patch anyway.

butz 7y ago

Great, because of limited Android updates I have to get a new phone.

joelthelion 7y ago

On the plus side, could this be used to root phones?

gaius_baltar 7y ago

I'm now wondering if I can use this to root my phone.

FraKtus 7y ago

Am I right to understand that this vulnerability only works when Bluetooth is in discoverable mode? If yes, then most phones are safe even if they have this vulnerability, it's only when you go in the Bluetooth menu that you are at risk...

dmatech 7y ago

I hate to say it, but it seems like only a large-scale worm outbreak that gets media coverage would be enough to fix the utterly broken Android patching landscape. From the description, this appears wormable (especially in crowds and possibly in vehicles). And unlike other wormable vulnerabilities that go through a service (like Google or even the phone company), this is just two phones with no intermediary to protect devices.

zepto 7y ago

Surprising that Project Zero didn’t catch this.

beatgammit 7y ago

It's exactly this type of reason that I'm excited for the Librem 5 and PinePhone. I don't use many apps, and I value security updates, so using a community supported phone based on standard Linux sounds a lot more appealing to me than getting another Android phone. My current phone is an Android One device and so should still be getting updates, so hopefully I can stay reasonably secure until those phones are usable as replacements.