6 ms·

Alright - I'll bite. This is a smartphone, not a windows PC with a bunch of services. There is Zero listening on any port. There is no attack surface for any

Alright - I'll bite. This is a smartphone, not a windows PC with a bunch of services. There is Zero listening on any port. There is no attack surface for any kernel - the only thing there would be a bug in mms. Please share your source for kernel attacks, on any android version, that's not an attack on an app - but on the kernel. No, this is not a google play attack, or an attack on an outdated app - which are updated fine. In addition, I'm unsure why you think you can't update the kernel on a phone. In fact, updating the kernel is standard procedure for... pretty much all directions on flashing a custom ROM. I had my nexus6 on kernel 4.9.3. There are literally new phones, right now, selling with that kernel version and earlier, with android11. This is like saying windows server 2016 has a kernel that's outdated, or that windows 10 which came out in 2015 is outdated. I think you are extremely confused. >I really don’t recommend Which is a good thing, because you should not be recommending about things you do not understand on even a basic level. >After that, it’s probably left up to the community. right. the entire point of my post. you can load stuff from the community. which includes the community of things like lineage - a big official community that's an llc - a corporation like redhat. A phone is not a server. It is not a security risk to run an outdated kernel. there are no services running a hacker can connect to. You don't connect to a kernel over the internet. A kernel which is by no means out of date, and is currently running in many datacenters.

TimeBearingDown 5y ago
Smartphones aren’t servers, but they run tons of services that interact with the surrounding world. Bluetooth, WiFi, etc… The kernel also still plays a vital and security-meaningful role in processing calls from applications. Running an out of date kernel could mean strangers ransoming your data, or could mean an attack becomes persistent and starts logging and uploading through reboots. Running an out of date kernel often does not result in this, and that higher level security matters first. However, the kernel does have an attack surface through those higher levels, and pwning the kernel still means something. Those datacenters are running LTS kernels with minor versions updated, or have security patches backported, or have far more limited connections to the world than your phone — only one protocol, one port, one service, for example. One example, since you asked: https://thehackernews.com/2019/10/android-kernel-vulnerability.html https://thehackernews.com/2019/10/android-kernel-vulnerabili...
- soylentnewsorg 5y ago
  We are not talking about datacenter servers - we are talking about smartphones. you can run a 4.9 kernel with all security patches applied, just like you can run windows10 with all security patches applied. You can update bluetooth and wifi modems without going to a later kernel version. We call those drivers, not kernels. The issue you note is only exploitable via a bug if you have an outdated version of the chrome browser. You don't need to update the kernel, in order to update an application. Seriously, I feel like I'm talking to my wife here, who is not a tech person. Why are you and the other couple of people being purposely dense, and purposely ignoring the content of your own links that doesn't fit your viewpoint? BTW, after you said smartphones aren't servers, you go on to talk about why an older kernel is bad on servers. But since you asked, the latest 4.9.3 kernel running on that nexus6 from 2014, that's been compiled appears to be from the end of the year 2019.
  - kaba0 5y ago
    Good luck finding drivers for phone wifi, bluetooth, etc. That’s the fking problem — linux doesn’t have a stable driver api, so the binary blobs drivers will not allow people upgrading major linux kernel versions. If everyone around you is stupid, then maybe you don’t understand the topic at hand?
    - soylentnewsorg 5y ago
      finding drivers for the official google phones? with about 12 years of kernel support, officially from google? https://source.android.com/devices/architecture/kernel/android-common https://source.android.com/devices/architecture/kernel/andro... not a problem at all. now your samsung or some unknown brand, who knows. I'm sure your 12 year old iphone got the latest and current bluetooth driver though. not everyone around me is stupid. just the guy being purposely dense. you.
- dotancohen 5y ago
  > Smartphones aren’t servers, but they run tons of services that > interact with the surrounding world. Bluetooth, WiFi, etc… Sounds like a server to me. Maybe not a webserver, or an SMTP server, or database server, but it is a server running world-accessible services.
nullify88 5y ago
> There is no attack surface for any kernel - the only thing there would be a bug in mms. Please share your source for kernel attacks, on any android version This is after one hasty search. https://source.android.com/security/bulletin/2016-10-01 https://source.android.com/security/bulletin/2016-10-01 There are various kernel level vulnerabilities listed. Some weakening privacy over tcp connections, others locally exploitable via a malicious app such as Pegasus. I don't understand why you call him confused. Perhaps you can approach with curiosity instead.
- soylentnewsorg 5y ago
  I'll start by saying I spent a full 5 minutes reading through those and gave up. I asked for an example, you pasted twenty pages of random garbage and said "here, maybe you'll find something in this dump I took - why don't you spend some time and maybe I'll prove you wrong." In those five minutes of looking through your garbage dump, I found Zero vulnerabilities that do not need either you installing a virus, which then gets root (the vulnerability), or a bug in an application running as root that's out of date, which then of course gives the attacker of the application root. None of those are valid examples, and I'm now bored digging through random garbage. Any hack, in Any application, will give the attacker root - we're running rooted phones (for the extra functionality). If you want to make a point, note the actual bug listed that does not need a compromised application. You installing a virus then the virus getting root does not count. The thread is about a kernel bug giving a remote attacker control of your phone. Applications and drivers like your modem can be updated without you updating the kernel. The latest N6 kernel is 4.9.3, with updates from the end of 2019.
  - sa1 5y ago
    There’s an example of it on HN front page right now, where a terminal application without privileges can trigger a kernel bug.
    - soylentnewsorg 5y ago
      for those times when I run that terminal application on my phone. which is already rooted, so it's doesn't need the kernel bug to get root. it can just run.
ksml 5y ago
I think you're terribly naive if you think a phone kernel has no attack surface. It is absolutely a security risk to run an outdated kernel. It has nothing to do with whether there are services running for a hacker to connect to; it's about whether it's possible for an attacker to trigger buggy behavior somehow, whether that's sending malformed packets or Bluetooth frames or invoking patterns of syscalls that cause bad things to happen. Heck, here's an obscure bug in Linux on the front page of HN right now, which Android is based on: https://googleprojectzero.blogspot.com/2021/10/how-simple-linux-kernel-memory.html?m=1 https://googleprojectzero.blogspot.com/2021/10/how-simple-li... Also, I know GP was specifically talking about upgrading the kernel, but keeping drivers patched is much harder without vendor support, and there's likely to be more attack surface there.
- soylentnewsorg 5y ago
  your phone is not a linux server. yes, if you install a virus or an outdated app, someone can daisychain a priv escalation using a kernel bug. no need for that though - my phone is already rooted. Your car has pieces that run linux too. Guess an attacker can make you crash. > drivers since this is about iphone and android comparison, guess what has those same driver blobs form those same exact manufacturers. apple doesn't make their own bluetooth chips. oh, btw, the drivers get updated just fine, since that's part of the kernel and os, which all get updated just fine. google supports kernel 4.1 till 2024 for android 11. the nexus from 2014 runs 4.9. so probably 2026 kernel and android, fully patched - 12 years. oh, sorry, did you forget this thread started with a guy claiming ios is great because you can put later versions of the OS on there? where's that iphone from 12 years ago running the latest version of ios, and still performing fast? because that's what this thread is about.
  - ksml 5y ago
    I really don't get why you're so hung up on this server thing. Yes, a phone is not a server. But it still runs a lot of complicated software. Software has bugs. We haven't found all the bugs yet. Hence, it's important to keep all of the software as up-to-date as possible for when people find some of the bugs. > Your car has pieces that run linux too. Guess an attacker can make you crash. Actually, yes... https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig... http://www.autosec.org/pubs/cars-usenixsec2011.pdf http://www.autosec.org/pubs/cars-usenixsec2011.pdf > the drivers get updated just fine, since that's part of the kernel and os, which all get updated just fine. Just because the kernel is getting updated does not mean the drivers and firmware are also getting updated. Drivers are specific to hardware, and if a vendor stops shipping updates for some chip that is no longer used in newer phones, then you aren't going to get updates for that chip. > since this is about iphone and android comparison This isn't about iphone and android comparison, not for me. You made naive claims about kernels not having attack surface and unimportance of staying updated, and I am responding to those claims.
DCKing 5y ago
I'm not sure I'm the one confused here. Not really willing to get combative on what security priorities one should have, but I'll stick to mine. > I had my nexus6 on kernel 4.9.3. I find this very hard to believe, as no evidence of Nexus 6 kernels that are not Google's original 3.10 shipped exists that I can find. Even PostmarketOS that looks to update kernels links to LineageOS fork of the 3.10 kernel on their page for shamu/Nexus 6. Unless you mean a custom kernel from "some guy on XDA" that names itself 4.9.3 like this one - which is just kernel 3.10 with some branding on it. It says so right in its description: https://forum.xda-developers.com/t/kernel-sm-4-9-3-o3-graphite-despair-kernel-r3.2956283/ https://forum.xda-developers.com/t/kernel-sm-4-9-3-o3-graphi... . Kernel 4.9.3 is a weirdly specific point release to be on in modern times anyway - there's kernel 4.9.0 all the way up to 4.9.287 - so it'd definitely be oddly specific if that's what you had. Outside of valiant community efforts like Replicant and PostmarketOS, who have an extremely hard time getting working or feature complete kernels running, Android devices getting new kernels is almost unheard of. Even with vendor support. Community ROMs have to stick with what the vendor gave them to have a functional device.

TimeBearingDown 5y ago

Smartphones aren’t servers, but they run tons of services that interact with the surrounding world. Bluetooth, WiFi, etc… The kernel also still plays a vital and security-meaningful role in processing calls from applications. Running an out of date kernel could mean strangers ransoming your data, or could mean an attack becomes persistent and starts logging and uploading through reboots. Running an out of date kernel often does not result in this, and that higher level security matters first. However, the kernel does have an attack surface through those higher levels, and pwning the kernel still means something. Those datacenters are running LTS kernels with minor versions updated, or have security patches backported, or have far more limited connections to the world than your phone — only one protocol, one port, one service, for example. One example, since you asked: https://thehackernews.com/2019/10/android-kernel-vulnerability.html https://thehackernews.com/2019/10/android-kernel-vulnerabili...

soylentnewsorg 5y ago
We are not talking about datacenter servers - we are talking about smartphones. you can run a 4.9 kernel with all security patches applied, just like you can run windows10 with all security patches applied. You can update bluetooth and wifi modems without going to a later kernel version. We call those drivers, not kernels. The issue you note is only exploitable via a bug if you have an outdated version of the chrome browser. You don't need to update the kernel, in order to update an application. Seriously, I feel like I'm talking to my wife here, who is not a tech person. Why are you and the other couple of people being purposely dense, and purposely ignoring the content of your own links that doesn't fit your viewpoint? BTW, after you said smartphones aren't servers, you go on to talk about why an older kernel is bad on servers. But since you asked, the latest 4.9.3 kernel running on that nexus6 from 2014, that's been compiled appears to be from the end of the year 2019.
- kaba0 5y ago
  Good luck finding drivers for phone wifi, bluetooth, etc. That’s the fking problem — linux doesn’t have a stable driver api, so the binary blobs drivers will not allow people upgrading major linux kernel versions. If everyone around you is stupid, then maybe you don’t understand the topic at hand?
  - soylentnewsorg 5y ago
    finding drivers for the official google phones? with about 12 years of kernel support, officially from google? https://source.android.com/devices/architecture/kernel/android-common https://source.android.com/devices/architecture/kernel/andro... not a problem at all. now your samsung or some unknown brand, who knows. I'm sure your 12 year old iphone got the latest and current bluetooth driver though. not everyone around me is stupid. just the guy being purposely dense. you.
dotancohen 5y ago
> Smartphones aren’t servers, but they run tons of services that > interact with the surrounding world. Bluetooth, WiFi, etc… Sounds like a server to me. Maybe not a webserver, or an SMTP server, or database server, but it is a server running world-accessible services.

nullify88 5y ago

> There is no attack surface for any kernel - the only thing there would be a bug in mms. Please share your source for kernel attacks, on any android version This is after one hasty search. https://source.android.com/security/bulletin/2016-10-01 https://source.android.com/security/bulletin/2016-10-01 There are various kernel level vulnerabilities listed. Some weakening privacy over tcp connections, others locally exploitable via a malicious app such as Pegasus. I don't understand why you call him confused. Perhaps you can approach with curiosity instead.

soylentnewsorg 5y ago
I'll start by saying I spent a full 5 minutes reading through those and gave up. I asked for an example, you pasted twenty pages of random garbage and said "here, maybe you'll find something in this dump I took - why don't you spend some time and maybe I'll prove you wrong." In those five minutes of looking through your garbage dump, I found Zero vulnerabilities that do not need either you installing a virus, which then gets root (the vulnerability), or a bug in an application running as root that's out of date, which then of course gives the attacker of the application root. None of those are valid examples, and I'm now bored digging through random garbage. Any hack, in Any application, will give the attacker root - we're running rooted phones (for the extra functionality). If you want to make a point, note the actual bug listed that does not need a compromised application. You installing a virus then the virus getting root does not count. The thread is about a kernel bug giving a remote attacker control of your phone. Applications and drivers like your modem can be updated without you updating the kernel. The latest N6 kernel is 4.9.3, with updates from the end of 2019.
- sa1 5y ago
  There’s an example of it on HN front page right now, where a terminal application without privileges can trigger a kernel bug.
  - soylentnewsorg 5y ago
    for those times when I run that terminal application on my phone. which is already rooted, so it's doesn't need the kernel bug to get root. it can just run.

ksml 5y ago

I think you're terribly naive if you think a phone kernel has no attack surface. It is absolutely a security risk to run an outdated kernel. It has nothing to do with whether there are services running for a hacker to connect to; it's about whether it's possible for an attacker to trigger buggy behavior somehow, whether that's sending malformed packets or Bluetooth frames or invoking patterns of syscalls that cause bad things to happen. Heck, here's an obscure bug in Linux on the front page of HN right now, which Android is based on: https://googleprojectzero.blogspot.com/2021/10/how-simple-linux-kernel-memory.html?m=1 https://googleprojectzero.blogspot.com/2021/10/how-simple-li... Also, I know GP was specifically talking about upgrading the kernel, but keeping drivers patched is much harder without vendor support, and there's likely to be more attack surface there.

soylentnewsorg 5y ago
your phone is not a linux server. yes, if you install a virus or an outdated app, someone can daisychain a priv escalation using a kernel bug. no need for that though - my phone is already rooted. Your car has pieces that run linux too. Guess an attacker can make you crash. > drivers since this is about iphone and android comparison, guess what has those same driver blobs form those same exact manufacturers. apple doesn't make their own bluetooth chips. oh, btw, the drivers get updated just fine, since that's part of the kernel and os, which all get updated just fine. google supports kernel 4.1 till 2024 for android 11. the nexus from 2014 runs 4.9. so probably 2026 kernel and android, fully patched - 12 years. oh, sorry, did you forget this thread started with a guy claiming ios is great because you can put later versions of the OS on there? where's that iphone from 12 years ago running the latest version of ios, and still performing fast? because that's what this thread is about.
- ksml 5y ago
  I really don't get why you're so hung up on this server thing. Yes, a phone is not a server. But it still runs a lot of complicated software. Software has bugs. We haven't found all the bugs yet. Hence, it's important to keep all of the software as up-to-date as possible for when people find some of the bugs. > Your car has pieces that run linux too. Guess an attacker can make you crash. Actually, yes... https://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/ https://www.wired.com/2015/07/hackers-remotely-kill-jeep-hig... http://www.autosec.org/pubs/cars-usenixsec2011.pdf http://www.autosec.org/pubs/cars-usenixsec2011.pdf > the drivers get updated just fine, since that's part of the kernel and os, which all get updated just fine. Just because the kernel is getting updated does not mean the drivers and firmware are also getting updated. Drivers are specific to hardware, and if a vendor stops shipping updates for some chip that is no longer used in newer phones, then you aren't going to get updates for that chip. > since this is about iphone and android comparison This isn't about iphone and android comparison, not for me. You made naive claims about kernels not having attack surface and unimportance of staying updated, and I am responding to those claims.

DCKing 5y ago

I'm not sure I'm the one confused here. Not really willing to get combative on what security priorities one should have, but I'll stick to mine. > I had my nexus6 on kernel 4.9.3. I find this very hard to believe, as no evidence of Nexus 6 kernels that are not Google's original 3.10 shipped exists that I can find. Even PostmarketOS that looks to update kernels links to LineageOS fork of the 3.10 kernel on their page for shamu/Nexus 6. Unless you mean a custom kernel from "some guy on XDA" that names itself 4.9.3 like this one - which is just kernel 3.10 with some branding on it. It says so right in its description: https://forum.xda-developers.com/t/kernel-sm-4-9-3-o3-graphite-despair-kernel-r3.2956283/ https://forum.xda-developers.com/t/kernel-sm-4-9-3-o3-graphi... . Kernel 4.9.3 is a weirdly specific point release to be on in modern times anyway - there's kernel 4.9.0 all the way up to 4.9.287 - so it'd definitely be oddly specific if that's what you had. Outside of valiant community efforts like Replicant and PostmarketOS, who have an extremely hard time getting working or feature complete kernels running, Android devices getting new kernels is almost unheard of. Even with vendor support. Community ROMs have to stick with what the vendor gave them to have a functional device.