3 ms·

If it's in the DSP it may not need to be an app that runs the exploit. Sounds like any malicious audio or video file could do it. Could be something delivered v

by jm4 6y ago

If it's in the DSP it may not need to be an app that runs the exploit. Sounds like any malicious audio or video file could do it. Could be something delivered via a streaming site, email, audio embedded in a webpage, etc. This sounds like it could be a very big deal. It's great that Qualcomm has a fix, but most of the susceptible devices will likely never get it in an update from their manufacturers. And I wonder if there will be a performance or battery life hit like the awful performance hit in the Intel chips. That one cost me a 30% hit on my servers and resulted in 6 figures of unplanned spending to replace that lost capacity.

tpmx 6y ago
> If it's in the DSP it may not need to be an app that runs the exploit. Sounds like any malicious audio or video file could do it. Could be something delivered via a streaming site, email, audio embedded in a webpage, etc. This sounds like it could be a very big deal. Seems unlikely to me. DSP data vs DSP code - I think it's in the latter that you'll find vulnerabilities.
- blihp 6y ago
  Second paragraph in the article: malicious media (i.e. video) can exploit it
dogma1138 6y ago
The fix could also be nothing more than just disable the DSP, a specific functionality or in some other means limit it considerably (for example disabling or heavily restricting its DMA). So a fix might not be a fix for all, if this bug is in some obscure codec or some extreme edge case that no one uses the fix might be painless, Google might even find a way to soft patch it via GPS but if it’s not then you might have devices either losing key functionality or becoming vulnerable to a pretty severe exploit. Another question of exploitation is how much hand crafting is required for the payload and does the payload survive common encoders as most social media platforms re-encode or transcode media that is uploaded or shared through their platform even WhatsApp and other messaging apps do it by default (tho those do it to save bandwidth). If the exploit payload survives common encoders which are used by social media platforms it would be quite a disaster once people understand how it works and can be exploited. The patch itself also might be bypassable Apple for example fixed an exploit using SEPROM and shortly after that exploit was working again by bypassing the SEPROM boot.

by jm4 6y ago

tpmx 6y ago

> If it's in the DSP it may not need to be an app that runs the exploit. Sounds like any malicious audio or video file could do it. Could be something delivered via a streaming site, email, audio embedded in a webpage, etc. This sounds like it could be a very big deal. Seems unlikely to me. DSP data vs DSP code - I think it's in the latter that you'll find vulnerabilities.

blihp 6y ago
Second paragraph in the article: malicious media (i.e. video) can exploit it

dogma1138 6y ago

The fix could also be nothing more than just disable the DSP, a specific functionality or in some other means limit it considerably (for example disabling or heavily restricting its DMA). So a fix might not be a fix for all, if this bug is in some obscure codec or some extreme edge case that no one uses the fix might be painless, Google might even find a way to soft patch it via GPS but if it’s not then you might have devices either losing key functionality or becoming vulnerable to a pretty severe exploit. Another question of exploitation is how much hand crafting is required for the payload and does the payload survive common encoders as most social media platforms re-encode or transcode media that is uploaded or shared through their platform even WhatsApp and other messaging apps do it by default (tho those do it to save bandwidth). If the exploit payload survives common encoders which are used by social media platforms it would be quite a disaster once people understand how it works and can be exploited. The patch itself also might be bypassable Apple for example fixed an exploit using SEPROM and shortly after that exploit was working again by bypassing the SEPROM boot.