6 ms·
Google has a very good internal security research team and there hasn't been a high impact/zero click RCE on androids that Google themselves maintain for a whil
by meibo 6y ago
Google has a very good internal security research team and there hasn't been a high impact/zero click RCE on androids that Google themselves maintain for a while.
Considering the recent iOS exploits, you're likely to be a little bit safer on a Google phone and common sense at the moment - but I'm 100% sure that a player like NSO will have an exploit for your phone as well.
Might have more luck with a dedicated "locked down" phone from a security company, there's some players that have entire custom android distributions with enhanced process/app isolation in the kernel and various stuff on top that prevents accidental leaks from "important" apps - also won't be 100% safe there but you can't even get that on iOS.
- marcan_42 6y agoApple's security architecture is leagues ahead of Android's. They have bespoke innovative protections at the hardware and hypervisor level, as well as an actual security CPU (as opposed to TrustZone on Androids, which is always swiss cheese in one way or another). This is largely possible because Apple are building their own silicon (none of the other silicon vendors are anywhere near as competent in this field). I say this as an Android user. Apple only gets hit with all these exploit chains because they are immensely valuable single target. All the Android phones are worse, it's just that hacking Android doesn't pay nearly as much (and that market is much more fragmented). Additionally, Google's public bug bounty project for Android is dysfunctional and run by contractors without the slightest clue how to handle the reports. On the other hand, since Android is a more open ecosystem, you can make simpler architectural guarantees than you can on iOS. For example, on a rooted Android you can set a long boot-time-only passphrase for full disk encryption which guarantees data security at rest, which you can't on iOS or non rooted Android (they force you to use your regular unlock passphrase, which isn't practical to make long, and in Apple's case isn't used for FDE, though Android is moving in that direction too). But none of that will save you from NSO runtime 0days, just from police seizing your phone and getting data out if you turn it off.
- computerex 6y agoAndroid dominates the mobile OS market share though. Seems like targeting it would yield a higher ROI. Much like how malware writers target Windows, because it dominates the desktop OS market share.
- PedroBatista 6y agoHope the HN crowd doesn’t take this the wrong way but, an Apple user tends to be a more valuable target. Think government brass, corporate elites and all their soft bellies, ie daddy’s teenage daughter or run of the mill mistress.
- marcan_42 6y agoAndroid is fragmented (though that is changing slowly), which means it's much harder to port and validate a single exploit chain to work on many Android phones.
- what_ever 6y agoOP asked specifically asked for Google Pixel 4a. If the market being fragmented is working in your favor, why not use it?
- jasamer 6y agoZerodium pays a little more for Android zero-click hacks, so I'm not sure about Apple being more valuable.
- whatyesaid 6y agoIn the UK, through Section 49 of RIPA, if you refused to provide your password to police you will get arrested for 2 years just on that. If they claim it could be national security related, you get 5 years.
- what_ever 6y ago> Apple are building their own silicon (none of the other silicon vendors are anywhere near as competent in this field Why is this useful when their software stack is having enough 0days on its own? Disc: Googler but nowhere close to Android/Pixel.