5 ms·
It's pure madness that Play Services comes with this sort of backdoor. This is clearly what I would consider a deliberate RCE vulnerability.
by grishka 5y ago
It's pure madness that Play Services comes with this sort of backdoor. This is clearly what I would consider a deliberate RCE vulnerability.
- Aerroon 5y agoSomebody that's affected by this should report it as a remote code execution vulnerability in the PlayStore app.
- grishka 5y agoI'm not affected by this, but that's an interesting idea. I wonder what'll happen if I report this (assuming Google has a place to report vulnerabilities in its products). They'd probably dismiss it as "invalid" because, see, it's not an RCE if it's only exploited by a "trusted party" like Google themselves.
- hulitu 5y ago> They'd probably dismiss it as "invalid" because, see, it's not an RCE if it's only exploited by a "trusted party" like Google themselves. They never learn from Solar Winds, do they ?
- dTal 5y agoIt doesn't "come with" this backdoor. It is this backdoor. Maintaining a connection with the Google mothership is, approximately, Play Service's entire function.
- kevincox 5y agoIt does come with this backdoor, and I don't think it is necessary for Google Play to function. The client could be written so that it won't install a new app without user consent. IIUC that doesn't really affect Google Play's main functionality.