20 ms·

Pwning the all Google phone with a non-Google bug

245 points by chmaynard 4y ago

lern_too_spel 4y ago
The last section is damning for the Android security team. This is something that should be automatable.
- ocdtrekkie 4y ago
  If security patching is important to you, you aren't carrying an Android. This has never not been true. Even here, on a Google phone, where Google can't blame manufacturers for dragging their feet on releases. Over a year after Microsoft officially abandoned Windows Mobile, I was still getting security patches faster and more often than Android phones ever did. If security is important to you, you carry an iPhone. That's a sad state of affairs, Apple has all sorts of problems and a ton of things I just find weird about the way their devices tend to do things and organize information, but it's just the only actual option right now.
  - lern_too_spel 4y ago
    On the contrary, Android is the only somewhat sane popular mobile OS today. I don't want to reboot my phone to update the web browser the way MacOS and iOS update Safari and the way Windows used to update IE. The browser is the application I use the most, and it has the largest attack surface. It should update transparently and not stop updating after the OS falls out of service, like Macs with Nvidia GPUs. The problem in this case isn't Google dragging its feet on releases. It releases Chrome updates frequently and OS updates monthly. The problem here is Google failing to include security patches for known vulnerabilities in those releases. What's ridiculous is that this is something that can be automated, and after multiple failures, it should have been automated, but here we are.
    - ocdtrekkie 4y ago
      Don't get me wrong, having to reboot your device to update your browser is silly. But if the choice is between that and waiting until a vulnerability is actively exploited before it's patched, anyone who cares about security will choose the former. It's very obvious when something like Heartbleed comes around which affects a ton of operating systems, and Windows and iOS and major Linux distros are patched in like a week and then there's a chart to look at for which manufacturer and model and carrier on whether or not you'll see a fix in the next couple months or ever.
      - lern_too_spel 4y ago
        Except if you get your OS from a particular vendor, like Apple, Google, or Ubuntu, you only have to check with the vendor to see when it will be released. All three have track records of timely updates. The real problem is patch-gapping across updates (instead of within an update), which Apple also suffers from: https://blog.theori.io/research/webkit-type-confusion/ https://blog.theori.io/research/webkit-type-confusion/ I'd expect both Apple and Google to spend the resources to automate this problem away, but the article shows this hasn't happened.
  - gradeless 4y ago
    It used to be the case that iphones were way ahead of security in android. With the efforts that have gone into improving things in the last few years and Google stepping up the quality of their hardware security with their Pixel lines that is no longer the case. iPhones also have nasty (sometimes unpatchable) vulns. Android gets ever stronger protections against malicious apps, doesnt rely so much on Malware being screened from the store (malware regularly gets through onto both Play Store and Apples App Store)
    - tux2bsd 4y ago
      [dead]
  - cvalka 4y ago
    No longer true. Iphones 0-days are cheaper than Android 0-days.
  - palata 4y ago
    > If security is important to you, you carry an iPhone Ever heard of NSO's Pegasus? xD
  - heavyset_go 4y ago
    iOS exploits are cheaper than Android exploits because they're so plentiful. Apple's security model is about securing App Store revenue first and foremost.
  - howinteresting 4y ago
    This has empirically not been true for a while, as shown by open market zero-day costs. (Though I believe iOS has been catching up recently.)
  - realusername 4y ago
    > If security is important to you, you carry an iPhone. That's a sad state of affairs, Apple has all sorts of problems and a ton of things I just find weird about the way their devices tend to do things and organize information, but it's just the only actual option right now. Are you aware that the state of security on iPhone is even worse nowadays? At least on Android the system surface has been reduced to its minimum. In iOS, pretty much every system component depends on the OS update and nothing has been decoupled yet.
- IshKebab 4y ago
  It's not just Android. I think every Linux device has this problem. I seriously doubt my TV has any of these patches for example. That's not an excuse of course, but a lot of the blame does lie with the Linux devs and their general disregard for security. I suspect it is a major motivation for Fuchsia.
  - lern_too_spel 4y ago
    There are security vendors that provide services for keeping track of vulnerabilities in your third party dependencies and making sure they're patched. Eventually, device makers will use such services as standard practice, but I'd expect Google to be ahead of the ball here with its own implementation, given what they spend on security engineering. This is not a completely new type of issue but one that has bitten them many times before.
- pabs3 4y ago
  This is why regular Linux distros ship the upstream Linux stable releases. Android should too, but I guess they have too many non-merged patches/drivers.
binkHN 4y ago
Relevant headline from the article: > Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. ... the exploit that used this vulnerability to gain arbitrary kernel code execution and root on a Pixel 6 from an Android app.
- causi 4y ago
  Damn. Wish this was for Adreno GPUs instead of Mali. Would be nice to have root on my phone.
- deleted 4y ago
  [deleted]
Idiot_in_Vain 4y ago
There's an endless supply of 0-days in both Android and Windows drivers.
- deleted 4y ago
  [deleted]
- ikekkdcjkfke 4y ago
  Good then that it auto installs random vendor supplied blobs whenever I plug in a mouse
  - fbdab103 4y ago
    How is this blanket approval system acceptable? The majority of hardware vendors have lost all credibility in producing secure software, and Microsoft think it is ok to let them load a Logitech/HP wizard toolkit for funsies? Few of them offer any features of note, but I would not be at all surprised they run with elevated permissions and contain trivially exploited code.
    - fomine3 4y ago
      yeah https://www.bleepingcomputer.com/news/security/razer-bug-lets-you-become-a-windows-10-admin-by-plugging-in-a-mouse/ https://www.bleepingcomputer.com/news/security/razer-bug-let...
  - deleted 4y ago
    [deleted]
- tholdem 4y ago
  If that is true, why Android 0-days are more expensive than iOS?
  - Idiot_in_Vain 4y ago
    Are they? Does that include exploits for a specific model of an Android phone? The exploit in the article applies to a GPU driver for a GPU that's used on a minority of the phones sold in US.
AstixAndBelix 4y ago
Maybe I'm getting it wrong, but what's the problem in Google flagging this bug as "won't fix"? It's the third party driver that has a bug, not their software. Once the bug is fixed by the third party then automatically it will be fixed for Google. Maybe the author has a stricter and more negative definition of "won't fix" so it sounded wrong to him?
- dmitrygr 4y ago
  > but what's the problem in Google flagging this bug as "won't fix"? You do not get to sell hardware as "100% google" AND shitcan a kernel bug. you only get to do one of those two, and you must pick and stick with it.
  - randmeerkat 4y ago
    > You do not get to sell hardware as "100% google" AND shitcan a kernel bug. Turns out you totally can.
    - hnburnsy 4y ago
      And didn't have to pay a bug bounty. win win
  - AstixAndBelix 4y ago
    We all know not 100% of the hardware is made by google. If there was a problem with the touchscreen, fingerprint sensor or camera drivers we all would be aware it came from a third party. The author knows full well the GPU is not actually made by Google, he is not an ignorant consumer being duped by marketing, so the label is actually 100% accurate for people in-the-know
    - dmitrygr 4y ago
      GPU is not made by google, but kernel IS compiled by google, who can fix a kernel bug in said kernel
herpderperator 4y ago
It should really say all-Google in the title, as it's otherwise confusing to read. The article even uses all-Google in the first paragraph - but not the title, oddly.
- zinekeller 4y ago
  I'll bet $10 that a clueless editor mangled it.
  - bigiain 4y ago
    Or automated headline A/B testing decided it got statistically significantty more traffic when it was misleading/wrong...
- deleted 4y ago
  [deleted]
kokonoko 4y ago
No such thing as an all Google phone. Trying to market the latest pixels as "Google silicon" is a complete joke. Not only the SoCs used are mildly customized Samsung Exynos, they are also terrible at performance and battery life even by Android standards.
sigmonsays 4y ago
any grapheneOS users here who know if it's protected against this CVE?
- ylk 4y ago
  as far as I can tell GrapheneOS doesn't have the patch, yet. the most recent mention on their releases page is for the 2022120300 release: > kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro): update Mali GPU driver to r37p0 (current release is r41p0 but there are substantial changes to the driver for the Tensor SoC on Pixels and it will take substantial work to upgrade all the way) https://grapheneos.org/releases#2022120300 https://grapheneos.org/releases#2022120300 from the article: > The Arm security team were very helpful throughout and released a public patch in version r40p0 of the driver on 2022-10-07 to address the issue [...]
  - gradeless 4y ago
    The writeup of the bug states that it was patched in the January update for Pixels, which GrapheneOS has. But previous work on applying mali patches early led to GarpheneOS having a fix earlier than stock Pixels https://github.com/GrapheneOS/os-issue-tracker/issues/1914#issuecomment-1401114851 https://github.com/GrapheneOS/os-issue-tracker/issues/1914#i...
    - strcat 4y ago
      Android 13 QPR2 Beta 1 came out on December 12th. This included backports of the ARM Mali GPU driver security along with a separate update to r38p1. GrapheneOS shipped these for the kernel driver. We had already done earlier work on updating the Mali GPU kernel drivers, but it's a lot more difficult for us because ARM doesn't make the standalone security patches available to the public and we don't currently have partner access to obtain them directly. We can ship them once Google or another vendor publishes the code. Generally, this will mean we can ship them once the next Android quarterly release Beta becomes available because they ship kernel patches months early in quarterly releases.
  - strcat 4y ago
asimops 4y ago
OT: With the current state of smartphone operating systems, I would need one of those to be release every other month or so. I cannot get to data on 'my' system, because an app decided to put it in their app folder, which I cannot access at all for 'security' reasons... I mean, I get it. It should not be easy to just unlock my phone and dump all my 2FA tokens. But if I want to back them up, i.e. because steam blocks my account for 7 days if I change to a new device, I want an option to get them! Make me reboot the thing into a special state, connect it to a computer on blood moon and dance in front of the cam to authenticate myself if you must, but for fucks sake, I want to access my data.
- yoavm 4y ago
  That's why I still root my phone. It's hard to explain, but it's simply the only way to actually be in control of my own device. For the specific use case you mentioned, however, I recommend Aegis with Syncthing. Very easy to set up a periodic back up and sync, encrypted at rest and on transit.
  - remram 4y ago
    Aegis doesn't support Steam. [edit: yes it does, although Steam doesn't use the standard, Aegis has special support for it]
    - stoltzmann 4y ago
      It does (or at least did a couple months ago) - you could have it import Steam keys and generate the codes in the actual Aegis app. I'm not sure if it requires root or not.
      - tecleandor 4y ago
        IIRC (I tried to do it a couple months ago), it requires root to extract the key file.
        4y ago
roer 4y ago
I found this blog post very interesting, and would like to find more like it. Do any of you have go-to sites for this purpose?
- nhoughto 4y ago
  https://googleprojectzero.blogspot.com https://googleprojectzero.blogspot.com
femtozer 4y ago
I was not expecting an Asterix ref here. Is it well known in the US?
- rendall 4y ago
  Not as well-known as Tin-Tin but enough know about it to have the occasional fan.
- deleted 4y ago
  [deleted]
compsciphd 4y ago
I'm waiting for a public exploit for the pixel 7 so that I can do some modifications to my phone (enable call recording outside countries that google supports call recording in). I could unlock the bootloader and root the phone via "normal" methods, however, that means having something that will then fail google safetynet and the like. A root exploit enables me to make the changes to on flash DBs, and then update the device and the DB changes will persist and my phone will be secure. Of course, such an exploit could be used for more nefarious things, but as google wants to limit functionality that the phone has (that is legal where I am), I'll be patient.
- phh 4y ago
  I perfectly understand not wanting to spend time on working around Safetynet, but in case you're not aware, I just want to point out that safetynet is pretty reliably broken (Google clearly doesn't use it for security. I'm pretty confident that it's 99% for passing audits, and 1% for shows). Current stats of the Safetynet workarounds is maybe 7 days of down time per year. Also, my personal point of view of the matter is that apps that require Safetynet, 1. doesn't care about their users, 2. Do just-for-the-show security, and thus users would be better off not using them. I personally don't use any app that require it.
  - eptcyka 4y ago
    Sure, but banking, ride hailing, car/scooter rental apps all use it.
    - gradeless 4y ago
      Some apps suggest they use it when they dont. Some (most) apps use a weaker form which an android/AOSP operating system can comply with, without being registered with Google (licencing Play Services) see eg. https://grapheneos.org/usage#banking-apps https://grapheneos.org/usage#banking-apps Very few apps use the full strict version of safetynet that requires hardware attestation
    - dvngnt_ 4y ago
cat_plus_plus 4y ago
You have to remember that Arm and other chipmakers are separate companies and do not listen to anyone. CEO escalations only happen if there is major press, otherwise you need to convince some random software engineer in charge of bug triage that your issue is more important than 20 other claimed emergencies AND that he or she can figure out how to do anything about it. The last part becomes much easier when talking engineer to engineer without intermediaries, especially intermediaries from other companies. Sounds like this is exactly what happened. It's not all bad, because decentralized ecosystem means a lot of hardware choices and component makers only hiring small development teams means good value for the money. But there are definitely times when everyone drops the ball and its not clear where to go for help.
- unwind 4y ago
  As a nit, Arm does not make chips. There are no semiconductors you can buy that contain Arm processors and are manufactured by Arm. They strictly do business around licensing their various intellectual properties (i.e. designs for processor and graphics cores) [1] and let their customer integrate that and build actual chips. [1]: https://en.wikipedia.org/wiki/Arm_(company)#Operations https://en.wikipedia.org/wiki/Arm_(company)#Operations

245 points by chmaynard 4y ago

lern_too_spel 4y ago

The last section is damning for the Android security team. This is something that should be automatable.

ocdtrekkie 4y ago
If security patching is important to you, you aren't carrying an Android. This has never not been true. Even here, on a Google phone, where Google can't blame manufacturers for dragging their feet on releases. Over a year after Microsoft officially abandoned Windows Mobile, I was still getting security patches faster and more often than Android phones ever did. If security is important to you, you carry an iPhone. That's a sad state of affairs, Apple has all sorts of problems and a ton of things I just find weird about the way their devices tend to do things and organize information, but it's just the only actual option right now.
- lern_too_spel 4y ago
  On the contrary, Android is the only somewhat sane popular mobile OS today. I don't want to reboot my phone to update the web browser the way MacOS and iOS update Safari and the way Windows used to update IE. The browser is the application I use the most, and it has the largest attack surface. It should update transparently and not stop updating after the OS falls out of service, like Macs with Nvidia GPUs. The problem in this case isn't Google dragging its feet on releases. It releases Chrome updates frequently and OS updates monthly. The problem here is Google failing to include security patches for known vulnerabilities in those releases. What's ridiculous is that this is something that can be automated, and after multiple failures, it should have been automated, but here we are.
  - ocdtrekkie 4y ago
    Don't get me wrong, having to reboot your device to update your browser is silly. But if the choice is between that and waiting until a vulnerability is actively exploited before it's patched, anyone who cares about security will choose the former. It's very obvious when something like Heartbleed comes around which affects a ton of operating systems, and Windows and iOS and major Linux distros are patched in like a week and then there's a chart to look at for which manufacturer and model and carrier on whether or not you'll see a fix in the next couple months or ever.
    - lern_too_spel 4y ago
      Except if you get your OS from a particular vendor, like Apple, Google, or Ubuntu, you only have to check with the vendor to see when it will be released. All three have track records of timely updates. The real problem is patch-gapping across updates (instead of within an update), which Apple also suffers from: https://blog.theori.io/research/webkit-type-confusion/ https://blog.theori.io/research/webkit-type-confusion/ I'd expect both Apple and Google to spend the resources to automate this problem away, but the article shows this hasn't happened.
- gradeless 4y ago
  It used to be the case that iphones were way ahead of security in android. With the efforts that have gone into improving things in the last few years and Google stepping up the quality of their hardware security with their Pixel lines that is no longer the case. iPhones also have nasty (sometimes unpatchable) vulns. Android gets ever stronger protections against malicious apps, doesnt rely so much on Malware being screened from the store (malware regularly gets through onto both Play Store and Apples App Store)
  - tux2bsd 4y ago
    [dead]
- cvalka 4y ago
  No longer true. Iphones 0-days are cheaper than Android 0-days.
- palata 4y ago
  > If security is important to you, you carry an iPhone Ever heard of NSO's Pegasus? xD
- heavyset_go 4y ago
  iOS exploits are cheaper than Android exploits because they're so plentiful. Apple's security model is about securing App Store revenue first and foremost.
- howinteresting 4y ago
  This has empirically not been true for a while, as shown by open market zero-day costs. (Though I believe iOS has been catching up recently.)
- realusername 4y ago
  > If security is important to you, you carry an iPhone. That's a sad state of affairs, Apple has all sorts of problems and a ton of things I just find weird about the way their devices tend to do things and organize information, but it's just the only actual option right now. Are you aware that the state of security on iPhone is even worse nowadays? At least on Android the system surface has been reduced to its minimum. In iOS, pretty much every system component depends on the OS update and nothing has been decoupled yet.
IshKebab 4y ago
It's not just Android. I think every Linux device has this problem. I seriously doubt my TV has any of these patches for example. That's not an excuse of course, but a lot of the blame does lie with the Linux devs and their general disregard for security. I suspect it is a major motivation for Fuchsia.
- lern_too_spel 4y ago
  There are security vendors that provide services for keeping track of vulnerabilities in your third party dependencies and making sure they're patched. Eventually, device makers will use such services as standard practice, but I'd expect Google to be ahead of the ball here with its own implementation, given what they spend on security engineering. This is not a completely new type of issue but one that has bitten them many times before.
pabs3 4y ago
This is why regular Linux distros ship the upstream Linux stable releases. Android should too, but I guess they have too many non-merged patches/drivers.

binkHN 4y ago

Relevant headline from the article: > Learn about the details of CVE-2022-38181, a vulnerability in the Arm Mali GPU. ... the exploit that used this vulnerability to gain arbitrary kernel code execution and root on a Pixel 6 from an Android app.

causi 4y ago
Damn. Wish this was for Adreno GPUs instead of Mali. Would be nice to have root on my phone.
deleted 4y ago
[deleted]

Idiot_in_Vain 4y ago

There's an endless supply of 0-days in both Android and Windows drivers.

deleted 4y ago
[deleted]
ikekkdcjkfke 4y ago
Good then that it auto installs random vendor supplied blobs whenever I plug in a mouse
- fbdab103 4y ago
  How is this blanket approval system acceptable? The majority of hardware vendors have lost all credibility in producing secure software, and Microsoft think it is ok to let them load a Logitech/HP wizard toolkit for funsies? Few of them offer any features of note, but I would not be at all surprised they run with elevated permissions and contain trivially exploited code.
  - fomine3 4y ago
    yeah https://www.bleepingcomputer.com/news/security/razer-bug-lets-you-become-a-windows-10-admin-by-plugging-in-a-mouse/ https://www.bleepingcomputer.com/news/security/razer-bug-let...
- deleted 4y ago
  [deleted]
tholdem 4y ago
If that is true, why Android 0-days are more expensive than iOS?
- Idiot_in_Vain 4y ago
  Are they? Does that include exploits for a specific model of an Android phone? The exploit in the article applies to a GPU driver for a GPU that's used on a minority of the phones sold in US.

AstixAndBelix 4y ago

Maybe I'm getting it wrong, but what's the problem in Google flagging this bug as "won't fix"? It's the third party driver that has a bug, not their software. Once the bug is fixed by the third party then automatically it will be fixed for Google. Maybe the author has a stricter and more negative definition of "won't fix" so it sounded wrong to him?

dmitrygr 4y ago
> but what's the problem in Google flagging this bug as "won't fix"? You do not get to sell hardware as "100% google" AND shitcan a kernel bug. you only get to do one of those two, and you must pick and stick with it.
- randmeerkat 4y ago
  > You do not get to sell hardware as "100% google" AND shitcan a kernel bug. Turns out you totally can.
  - hnburnsy 4y ago
    And didn't have to pay a bug bounty. win win
- AstixAndBelix 4y ago
  We all know not 100% of the hardware is made by google. If there was a problem with the touchscreen, fingerprint sensor or camera drivers we all would be aware it came from a third party. The author knows full well the GPU is not actually made by Google, he is not an ignorant consumer being duped by marketing, so the label is actually 100% accurate for people in-the-know
  - dmitrygr 4y ago
    GPU is not made by google, but kernel IS compiled by google, who can fix a kernel bug in said kernel

herpderperator 4y ago

It should really say all-Google in the title, as it's otherwise confusing to read. The article even uses all-Google in the first paragraph - but not the title, oddly.

zinekeller 4y ago
I'll bet $10 that a clueless editor mangled it.
- bigiain 4y ago
  Or automated headline A/B testing decided it got statistically significantty more traffic when it was misleading/wrong...
deleted 4y ago
[deleted]

kokonoko 4y ago

No such thing as an all Google phone. Trying to market the latest pixels as "Google silicon" is a complete joke. Not only the SoCs used are mildly customized Samsung Exynos, they are also terrible at performance and battery life even by Android standards.

sigmonsays 4y ago

any grapheneOS users here who know if it's protected against this CVE?

ylk 4y ago
as far as I can tell GrapheneOS doesn't have the patch, yet. the most recent mention on their releases page is for the 2022120300 release: > kernel (Pixel 6, Pixel 6 Pro, Pixel 6a, Pixel 7, Pixel 7 Pro): update Mali GPU driver to r37p0 (current release is r41p0 but there are substantial changes to the driver for the Tensor SoC on Pixels and it will take substantial work to upgrade all the way) https://grapheneos.org/releases#2022120300 https://grapheneos.org/releases#2022120300 from the article: > The Arm security team were very helpful throughout and released a public patch in version r40p0 of the driver on 2022-10-07 to address the issue [...]
- gradeless 4y ago
  The writeup of the bug states that it was patched in the January update for Pixels, which GrapheneOS has. But previous work on applying mali patches early led to GarpheneOS having a fix earlier than stock Pixels https://github.com/GrapheneOS/os-issue-tracker/issues/1914#issuecomment-1401114851 https://github.com/GrapheneOS/os-issue-tracker/issues/1914#i...
  - strcat 4y ago
    Android 13 QPR2 Beta 1 came out on December 12th. This included backports of the ARM Mali GPU driver security along with a separate update to r38p1. GrapheneOS shipped these for the kernel driver. We had already done earlier work on updating the Mali GPU kernel drivers, but it's a lot more difficult for us because ARM doesn't make the standalone security patches available to the public and we don't currently have partner access to obtain them directly. We can ship them once Google or another vendor publishes the code. Generally, this will mean we can ship them once the next Android quarterly release Beta becomes available because they ship kernel patches months early in quarterly releases.
- strcat 4y ago

asimops 4y ago

OT: With the current state of smartphone operating systems, I would need one of those to be release every other month or so. I cannot get to data on 'my' system, because an app decided to put it in their app folder, which I cannot access at all for 'security' reasons... I mean, I get it. It should not be easy to just unlock my phone and dump all my 2FA tokens. But if I want to back them up, i.e. because steam blocks my account for 7 days if I change to a new device, I want an option to get them! Make me reboot the thing into a special state, connect it to a computer on blood moon and dance in front of the cam to authenticate myself if you must, but for fucks sake, I want to access my data.

yoavm 4y ago
That's why I still root my phone. It's hard to explain, but it's simply the only way to actually be in control of my own device. For the specific use case you mentioned, however, I recommend Aegis with Syncthing. Very easy to set up a periodic back up and sync, encrypted at rest and on transit.
- remram 4y ago
  Aegis doesn't support Steam. [edit: yes it does, although Steam doesn't use the standard, Aegis has special support for it]
  - stoltzmann 4y ago
    It does (or at least did a couple months ago) - you could have it import Steam keys and generate the codes in the actual Aegis app. I'm not sure if it requires root or not.
    - tecleandor 4y ago
      IIRC (I tried to do it a couple months ago), it requires root to extract the key file.
      - 4y ago

roer 4y ago

I found this blog post very interesting, and would like to find more like it. Do any of you have go-to sites for this purpose?

nhoughto 4y ago
https://googleprojectzero.blogspot.com https://googleprojectzero.blogspot.com

femtozer 4y ago

I was not expecting an Asterix ref here. Is it well known in the US?

rendall 4y ago
Not as well-known as Tin-Tin but enough know about it to have the occasional fan.
deleted 4y ago
[deleted]

compsciphd 4y ago

I'm waiting for a public exploit for the pixel 7 so that I can do some modifications to my phone (enable call recording outside countries that google supports call recording in). I could unlock the bootloader and root the phone via "normal" methods, however, that means having something that will then fail google safetynet and the like. A root exploit enables me to make the changes to on flash DBs, and then update the device and the DB changes will persist and my phone will be secure. Of course, such an exploit could be used for more nefarious things, but as google wants to limit functionality that the phone has (that is legal where I am), I'll be patient.

phh 4y ago
I perfectly understand not wanting to spend time on working around Safetynet, but in case you're not aware, I just want to point out that safetynet is pretty reliably broken (Google clearly doesn't use it for security. I'm pretty confident that it's 99% for passing audits, and 1% for shows). Current stats of the Safetynet workarounds is maybe 7 days of down time per year. Also, my personal point of view of the matter is that apps that require Safetynet, 1. doesn't care about their users, 2. Do just-for-the-show security, and thus users would be better off not using them. I personally don't use any app that require it.
- eptcyka 4y ago
  Sure, but banking, ride hailing, car/scooter rental apps all use it.
  - gradeless 4y ago
    Some apps suggest they use it when they dont. Some (most) apps use a weaker form which an android/AOSP operating system can comply with, without being registered with Google (licencing Play Services) see eg. https://grapheneos.org/usage#banking-apps https://grapheneos.org/usage#banking-apps Very few apps use the full strict version of safetynet that requires hardware attestation
  - dvngnt_ 4y ago

cat_plus_plus 4y ago

You have to remember that Arm and other chipmakers are separate companies and do not listen to anyone. CEO escalations only happen if there is major press, otherwise you need to convince some random software engineer in charge of bug triage that your issue is more important than 20 other claimed emergencies AND that he or she can figure out how to do anything about it. The last part becomes much easier when talking engineer to engineer without intermediaries, especially intermediaries from other companies. Sounds like this is exactly what happened. It's not all bad, because decentralized ecosystem means a lot of hardware choices and component makers only hiring small development teams means good value for the money. But there are definitely times when everyone drops the ball and its not clear where to go for help.

unwind 4y ago
As a nit, Arm does not make chips. There are no semiconductors you can buy that contain Arm processors and are manufactured by Arm. They strictly do business around licensing their various intellectual properties (i.e. designs for processor and graphics cores) [1] and let their customer integrate that and build actual chips. [1]: https://en.wikipedia.org/wiki/Arm_(company)#Operations https://en.wikipedia.org/wiki/Arm_(company)#Operations