6 ms·

I can't believe this is not a "drop everything and get it fixed ASAP" bug. This makes me think there's probably tons of other similar bugs out there being explo

I can't believe this is not a "drop everything and get it fixed ASAP" bug. This makes me think there's probably tons of other similar bugs out there being exploited right now even with disclosure.

urthor 4y ago
I forget which Pixel generation. For one generation Google I believe never shipped the ability to unlock your phone with your face. Despite having all the hardware on the phone, it just didn't have the feature. This was a serious feature deficit viz a viz the relevant iPhone at the time. The gossip was, the feature was finished, completely. Had to be ripped out after external pen-testing bypassed it with Facebook photos. They have many, big, problems.
- mschuster91 4y ago
  > This was a serious feature deficit viz a viz the relevant iPhone at the time. IIRC, the iPhone uses not just a photo from the selfie cam, but adds infrared to construct a sort-of-3d-ish depth map of your face as well - that is what defeats a simple attempt at unlocking with photos. Now, the really interesting thing to research is if a silicone molded face mask could be used to fool the iPhone into unlocking. Photos or videos of the subject in multiple angles should be enough to create a decent enough 3D face copy.
  - jerpint 4y ago
    A video rotating around a subject + nerfs could maybe get you the 3D face copy pretty easily
  - endisneigh 4y ago
    Won’t work - https://9to5mac.com/2019/12/16/3d-mask/amp/ https://9to5mac.com/2019/12/16/3d-mask/amp/ Muscle movement is also now necessary so it’s pretty difficult to circumvent
    - rkagerer 4y ago
      Betcha someone will make a silicone mask that twitches.
    - Dylan16807 4y ago
      That just sounds like you need a proper mask that can be worn. And it doesn't sound like it even needs to fit.
- foverzar 4y ago
  > Despite having all the hardware on the phone Did Pixel phones really have a frontal lidar?
  - makeitdouble 4y ago
    Pixel 4 had dedicated hardware (project Soli)
    - deleted 4y ago
      [deleted]
    - llampx 4y ago
      Incidentally, I said to myself I would buy a Pixel 5 if it had Soli as well because it would show that Google was becoming serious about supporting features for more than 1 generation. Predictably, I never bought a Pixel 5 or 6 or 7.
    - krzyk 4y ago
      Soli != hardware for face unlock. It had 2xIR cameras, flood illuminator and a dot project for that purpose. Soli was a gimmick on top of that, so it would enable that hardware above when you were reaching with your hand for the phone. In my case it was a gimmick because I don't see much difference between face unlock times when I reach for the phone and the most useful feature for me (swiping to change music) was working also when my windshield had wipers working. I dream of a Pixel with normal face unlock (like in Pixel 4, not the crippled on in Pixel 7) but without Soli. I can't believe that they ditched it after just one generation, now I'm stuck. And only reason to upgrade would be a Pixel that has photos >12mpix (not just the sensor).
- AuthorizedCust 4y ago
  Pixel is on generation 7. Only two supported face unlock: 4 and 7. 6 was rumored to have it, but it was never delivered. 6 and 7 are equivalent hardware-wise for face unlock: neither has the sensors to do it in a highly secure manner. 7’s face unlock therefore doesn’t give you access to the most sensitive stuff, like bank accounts, requiring supplemental, secure authentication, such as fingerprint.
- sorenjan 4y ago
  Android introduced face unlocking in 2011[0]. It used the regular front camera and hence had no depth information, which makes it vulnerable to photos[1]. It was removed in Android 10, when a new face authentication interface[2] was added. Face unlocking without specialized hardware such as what iPhones have is not secure. [0] https://www.androidauthority.com/face-unlock-android-4-0-ice-cream-sandwich-most-personal-feature-27693/ https://www.androidauthority.com/face-unlock-android-4-0-ice... [1] https://www.androidauthority.com/android-jelly-bean-face-unlock-blink-hacking-105556/ https://www.androidauthority.com/android-jelly-bean-face-unl... [2] https://source.android.com/docs/security/features/biometric/face-authentication https://source.android.com/docs/security/features/biometric/...
- izacus 4y ago
  I'm not really sure what you're talking about - the only generation that had LIDAR was Pixels 4/4XL and those shipped with face unlock. There WAS a rumor about Pixel 6, but it doesn't have any special face unlocking camera. Pixel 7 does support face unlock without special hardware with caveat that it's less secure.
notyourday 4y ago
There's exactly one drop everything and get it fixed ASAP bug at Google - something broke the ad platform.
- llampx 4y ago
  If its not a "Bank error in your favor - collect $200" error that favors Google.
robertwt7 4y ago
yeah right? after the article mentioned that he waited 2 months, I was already shocked, then he mentioned 3 months, and so on.. sometimes it's just annoying to report something really important and still you don't get enough attention.
lrvick 4y ago
The security researchers only mistake was letting Google fart around for so long. You give them 90 days, then you go public. That is the policy Google Project Zero holds other companies to, so it is only fair to hold Google to the same standard. People using their device for high risk applications need to be informed in a timely manner, and Google needs to pay a reputational price for their negligence.
- lzooz 4y ago
  If you use a Pixel for high risk applications you are a bit at fault here
  - phh 4y ago
    If you use any always-listening (see rooting exploits over wifi beacons) general purpose computer for high risk applications, it's a bit your fault.
  - gambiting 4y ago
    What a weird argument. So if the law enforcement of your country uses this technique to unlock your phone without your permission(or you know, some criminal does that), that's your fault for using a Pixel phone? You should have known better than you know, buying a phone from one of the largest software houses on the planet? I smell a fair hint of victim blaming here.
    - biglearner1day 4y ago
      > I smell a fair hint of victim blaming here. Why is that a bad thing? You should absolutely blame and hold the victim responsible and accountable for their part.
      - gambiting 4y ago
        So let me rephrase my question - what part of the blame should be assigned to the victim here, if their "fault" was buying a phone made and marketed by one of the largest and most well known software developers on the planet? Also, this is an interesting discussion in general. If someone forgets to lock their door and a thief gets in and robs them, do you think it's fair to "blame" the person who forgot to lock their door? Or do you think that maybe we should recognize that 100% of the blame should be on you know, the person doing the robbing?
cle 4y ago
I've seen multiple instances of Google failing to correctly triage critical security issues. I can only conclude from these organizational failures that Google leadership doesn't really take security seriously. Here's another example of a critical vulnerability in GCP that Google sat on for 9 months: https://github.com/irsl/gcp-dhcp-takeover-code-exec https://github.com/irsl/gcp-dhcp-takeover-code-exec
deleted 4y ago
[deleted]
pstation 4y ago
This was kind of my experience with reporting a bug to Google as well. Some years ago I managed to upload a SWF file to "google.com" which allowed me to do an XSS and access anyone's gmail, contacts, etc. I reported it and they just initially never responded and I had to constantly follow up. It was seemingly a simple bug to fix but it took them a couple months and they eventually only paid $500. Being able to exfiltrate data out of someone's gmail account always seemed high priority to me but I guess not lol.
- MerelyMortal 4y ago
  Do you mind sharing a weite-up about that bug?

I can't believe this is not a "drop everything and get it fixed ASAP" bug. This makes me think there's probably tons of other similar bugs out there being exploited right now even with disclosure.

urthor 4y ago

I forget which Pixel generation. For one generation Google I believe never shipped the ability to unlock your phone with your face. Despite having all the hardware on the phone, it just didn't have the feature. This was a serious feature deficit viz a viz the relevant iPhone at the time. The gossip was, the feature was finished, completely. Had to be ripped out after external pen-testing bypassed it with Facebook photos. They have many, big, problems.

mschuster91 4y ago
> This was a serious feature deficit viz a viz the relevant iPhone at the time. IIRC, the iPhone uses not just a photo from the selfie cam, but adds infrared to construct a sort-of-3d-ish depth map of your face as well - that is what defeats a simple attempt at unlocking with photos. Now, the really interesting thing to research is if a silicone molded face mask could be used to fool the iPhone into unlocking. Photos or videos of the subject in multiple angles should be enough to create a decent enough 3D face copy.
- jerpint 4y ago
  A video rotating around a subject + nerfs could maybe get you the 3D face copy pretty easily
- endisneigh 4y ago
  Won’t work - https://9to5mac.com/2019/12/16/3d-mask/amp/ https://9to5mac.com/2019/12/16/3d-mask/amp/ Muscle movement is also now necessary so it’s pretty difficult to circumvent
  - rkagerer 4y ago
    Betcha someone will make a silicone mask that twitches.
  - Dylan16807 4y ago
    That just sounds like you need a proper mask that can be worn. And it doesn't sound like it even needs to fit.
foverzar 4y ago
> Despite having all the hardware on the phone Did Pixel phones really have a frontal lidar?
- makeitdouble 4y ago
  Pixel 4 had dedicated hardware (project Soli)
  - deleted 4y ago
    [deleted]
  - llampx 4y ago
    Incidentally, I said to myself I would buy a Pixel 5 if it had Soli as well because it would show that Google was becoming serious about supporting features for more than 1 generation. Predictably, I never bought a Pixel 5 or 6 or 7.
  - krzyk 4y ago
    Soli != hardware for face unlock. It had 2xIR cameras, flood illuminator and a dot project for that purpose. Soli was a gimmick on top of that, so it would enable that hardware above when you were reaching with your hand for the phone. In my case it was a gimmick because I don't see much difference between face unlock times when I reach for the phone and the most useful feature for me (swiping to change music) was working also when my windshield had wipers working. I dream of a Pixel with normal face unlock (like in Pixel 4, not the crippled on in Pixel 7) but without Soli. I can't believe that they ditched it after just one generation, now I'm stuck. And only reason to upgrade would be a Pixel that has photos >12mpix (not just the sensor).
AuthorizedCust 4y ago
Pixel is on generation 7. Only two supported face unlock: 4 and 7. 6 was rumored to have it, but it was never delivered. 6 and 7 are equivalent hardware-wise for face unlock: neither has the sensors to do it in a highly secure manner. 7’s face unlock therefore doesn’t give you access to the most sensitive stuff, like bank accounts, requiring supplemental, secure authentication, such as fingerprint.
sorenjan 4y ago
Android introduced face unlocking in 2011[0]. It used the regular front camera and hence had no depth information, which makes it vulnerable to photos[1]. It was removed in Android 10, when a new face authentication interface[2] was added. Face unlocking without specialized hardware such as what iPhones have is not secure. [0] https://www.androidauthority.com/face-unlock-android-4-0-ice-cream-sandwich-most-personal-feature-27693/ https://www.androidauthority.com/face-unlock-android-4-0-ice... [1] https://www.androidauthority.com/android-jelly-bean-face-unlock-blink-hacking-105556/ https://www.androidauthority.com/android-jelly-bean-face-unl... [2] https://source.android.com/docs/security/features/biometric/face-authentication https://source.android.com/docs/security/features/biometric/...
izacus 4y ago
I'm not really sure what you're talking about - the only generation that had LIDAR was Pixels 4/4XL and those shipped with face unlock. There WAS a rumor about Pixel 6, but it doesn't have any special face unlocking camera. Pixel 7 does support face unlock without special hardware with caveat that it's less secure.

notyourday 4y ago

There's exactly one drop everything and get it fixed ASAP bug at Google - something broke the ad platform.

llampx 4y ago
If its not a "Bank error in your favor - collect $200" error that favors Google.

robertwt7 4y ago

yeah right? after the article mentioned that he waited 2 months, I was already shocked, then he mentioned 3 months, and so on.. sometimes it's just annoying to report something really important and still you don't get enough attention.

lrvick 4y ago

The security researchers only mistake was letting Google fart around for so long. You give them 90 days, then you go public. That is the policy Google Project Zero holds other companies to, so it is only fair to hold Google to the same standard. People using their device for high risk applications need to be informed in a timely manner, and Google needs to pay a reputational price for their negligence.

lzooz 4y ago
If you use a Pixel for high risk applications you are a bit at fault here
- phh 4y ago
  If you use any always-listening (see rooting exploits over wifi beacons) general purpose computer for high risk applications, it's a bit your fault.
- gambiting 4y ago
  What a weird argument. So if the law enforcement of your country uses this technique to unlock your phone without your permission(or you know, some criminal does that), that's your fault for using a Pixel phone? You should have known better than you know, buying a phone from one of the largest software houses on the planet? I smell a fair hint of victim blaming here.
  - biglearner1day 4y ago
    > I smell a fair hint of victim blaming here. Why is that a bad thing? You should absolutely blame and hold the victim responsible and accountable for their part.
    - gambiting 4y ago
      So let me rephrase my question - what part of the blame should be assigned to the victim here, if their "fault" was buying a phone made and marketed by one of the largest and most well known software developers on the planet? Also, this is an interesting discussion in general. If someone forgets to lock their door and a thief gets in and robs them, do you think it's fair to "blame" the person who forgot to lock their door? Or do you think that maybe we should recognize that 100% of the blame should be on you know, the person doing the robbing?

cle 4y ago

I've seen multiple instances of Google failing to correctly triage critical security issues. I can only conclude from these organizational failures that Google leadership doesn't really take security seriously. Here's another example of a critical vulnerability in GCP that Google sat on for 9 months: https://github.com/irsl/gcp-dhcp-takeover-code-exec https://github.com/irsl/gcp-dhcp-takeover-code-exec

deleted 4y ago

[deleted]

pstation 4y ago

This was kind of my experience with reporting a bug to Google as well. Some years ago I managed to upload a SWF file to "google.com" which allowed me to do an XSS and access anyone's gmail, contacts, etc. I reported it and they just initially never responded and I had to constantly follow up. It was seemingly a simple bug to fix but it took them a couple months and they eventually only paid $500. Being able to exfiltrate data out of someone's gmail account always seemed high priority to me but I guess not lol.

MerelyMortal 4y ago
Do you mind sharing a weite-up about that bug?