4 ms·

You're really cavalier about whether widespread hacks happen. See any of the text message attacks from the past decade.

• rfoo 5y ago
  Except we don't live in the past decade anymore. Even though people are still sometimes reluctant to updates ("it only made my device slow!"), We made significant progress on patch distribution. In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. These bugs cost $10k~$100k now and once you mass-exploit it, they are gone.
  • onion2k 5y ago
    once you mass-exploit it, they are gone That is only true of exploits that have obvious and visible impacts, right? If an attacker found an exploit and used it to put a rootkit on millions of phones, but did nothing with that rootkit and it had no outward markers, would anyone know?
    • rvnx 5y ago
      Yes, probably the backdoors that security companies implement on the phones to exfiltrate and sell data would reveal that.
  • thfuran 5y ago
    I wonder whether even as many as half of android phones are less than, say, six months behind on security updates. They're often quite slow in releasing for any given model, and that's while the phone even gets updates.
  • IncRnd 5y ago
    > Except we don't live in the past decade anymore. You do know that is a terible attitude for a real-world security posture meant to protect non-theoretical people's property and information against actual exploits? > In the past a bug in the SMS stack could be mass exploited and still not getting fixed anytime soon. Not anymore. While you may wish for patches to always take care of exploits before any phones are compromised, that's not much more than wishful thinking. You assume that all 0day exploits are both known and fixed immediately. That is 100% false.
• theshrike79 5y ago
  Vulnerabilities on iOS are getting really scarce. People spend truckloads of money finding them and you need to pay twice that for the permission to burn said exploit. That stuff isn't burned on mass hacks on random phone users, it's way too valuable. BUT. There is a small sliver of time between the exploit being used on a high value target and Apple patching the hole. That's the spot where Joe Schmoe should be cautious.
  • bennysomething 5y ago
    You are probably right, but this attack only became visible because it had a bug. How many others are invisible currently? Well that's what I'm asking myself :)
    • theshrike79 5y ago
      A lot, but they're still only used for high-value targets. They're way too valuable to waste on some random person who happens to click a link.
      • ChuckNorris89 5y ago
        That's a bad argument for defense. If it can be used on one random person then it can be used on the hundreds of millions of random persons who use iPhone and Android. And getting even 1% of those massive user bases to click on a link and steal their money or private information, would be incredibly lucrative even for the short period until the patch rolls out, especially for the wealthier iOS userbase as a target. In my EU country, I'm still getting regular spam SMS with links to what I presume is some older Android malware that wrecked havock last year. So, if attackers are still at it, months after a patch was rolled out, it means they must be still getting returns on their "investment".