8 ms·
Google says hackers could silently own your phone until Samsung fixes its modems
- DeathArrow 4y ago[flagged]
- deleted 4y ago[deleted]
- jeroenhd 4y agoPreviously discussed here: https://news.ycombinator.com/item?id=35190811 https://news.ycombinator.com/item?id=35190811
- gaudat 4y agoDoes that mean we can get free (as in freedom) rooting that does not trigger Knox? I will take that any day.
- neuromason1 4y agoSamsung always has a grand vulnerability each year. Like clockwork! In 2015, a vulnerability in Samsung's SwiftKey keyboard was discovered that allowed attackers to remotely execute code on the device. In 2016, researchers discovered a flaw in Samsung's Knox security software that could allow an attacker to escalate privileges and gain root access to the device. In 2017, a vulnerability was discovered that allowed attackers to take control of Samsung's SmartCam cameras. In 2018, researchers found a flaw in Samsung's Secure Boot feature that allowed attackers to install malicious firmware on the device. In 2019, researchers discovered a vulnerability in Samsung's Galaxy S10 fingerprint scanner that allowed anyone to unlock the phone with a 3D printed fingerprint.
- ChuckNorris89 4y agoSure, but which consumer products don't have security vulnerabilities discovered? That's like pointing at water and blaming it it's wet. Vulns are part and parcel of products running any kind of SW. As long as the manufacturer acknowledges it and pushes a prompt fix we should be good.
- bell-cot 4y agoSadly, it sounds like Samsung has little interest in "fix", and no interest whatever in "prompt".
- prox 4y agoBut why are they so reluctant? What’s the issue here? They aren’t a poor backwater company afaik.
- imchillyb 4y agoNo. Critical system vulnerabilities are few and far between for most companies. Samsung has much greater than average occurrences of critical root level vulnerabilities.
- Spark_Ed 4y agoI've stopped buying anything Samsung because their quality control has become non-existant. My S22 ultra has a major bug that causes the screen to no longer update until I screenshot my way to the restart button. (Their response is trade in for an S23, but at my expense). I've never had a TV fail before, much less within two years. When I first put it together, it seemed like it was designed to fail. When they do, repair means either be charged $300 for a $10 fiber optic cable or $400 for a new output box. Any appliance repair person worth their salt would tell you to never buy Samsung appliances. They're the most prone to failure, most expensive to repair. They try to appeal to consumers by appearing like a luxury brand, while having bottom of the barrel engineering inside. I am avoiding anything Samsung until their track record turns around completely.
- lallysingh 4y agoApparently that clock stopped for a few years.
- RealStickman_ 4y agoThey took a Corona break
- ChuckNorris89 4y agoWhich would be ironic as the pandemic WFH years saw a huge spike in cybercrime and security related incidents on all fronts.
- thinkingemote 4y agoWhy is this? Id be interested to read the reasons why. At the top of my head it's WFM opening up attack surfaces but it could be that hackers with more free time hacked more. Sociological reasons are more interesting for me.
- wongarsu 4y agoMultiple industries laid off large parts of their workforce. US unemployment trippled, and more tourist heavy countries fared even worse. One of the biggest drivers of crime is "it was the best option available at the time", and most cybercrime isn't highly skilled and fairly accessible. To make matters worse, "regular" crime struggled at the same time. It's harder to break into people's homes if they are at home all day, and you can't mug them in a dark alley either, neither can you pickpocket tourists.
- cronix 4y agoIn some forums I lurk in there was some hubub about massive holes in security that were opened up via people who are used to working in an environment with IT support (somewhat secure, depending), etc, to people trying to figure everything out at home on their own and using new tools (both software and hardware) to do it. Don't know how accurate it is but it makes some logical sense to me.
- webdoodle 4y agoIt's almost like it's planned obsolescence...
- yaomtc 4y agoHuh? SwiftKey was never owned by Samsung. I don't think they even had Samsung-specific builds
- mburns 4y agocontext: https://techcrunch.com/2015/06/17/no-its-samsung-not-swiftkey-that-is-to-blame-for-this-keyboard-security-scare/ https://techcrunch.com/2015/06/17/no-its-samsung-not-swiftke...
- asciii 4y ago> Although Samsung told NowSecure in March that it had sent wireless carriers a fix which could be transmitted to the phones, and not to go public on it for three months, Samsung did nothing about it. As if written today, even though it’s 8 years ago lol!
- deleted 4y ago[deleted]
- fencepost 4y agoI believe the Samsung keyboard was linked with Swype, and I believe it predated SwiftKey (or at least predated swipe-based input in SwiftKey).
- narrator 4y agoThe 3d-printed fingerprint one is not scary since it requires physical access, a 3-d printer and your fingerprint.
- ecmascript 4y agoHow do I know if my model has this chipset? I have the S22 Ultra but I cannot find what chipset it's using from the settings. Ordered it from their website and I am located in Sweden.
- rofo1 4y agoCPU-Z, the Android app, can tell you this (along with a bunch of other information that you might find useful)
- vanilla_nut 4y agoExynos chipsets contain the Samsung-designed modems with problems. Qualcomm's Snapdragon chipsets use integrated Qualcomm-designed modems (usually) that should be safe (from this vulnerability). If you still have the box or possibly a receipt, Exynos S22Us have the model number SM-S908B or SM-S908B/DS. Every other model is Snapdragon. If you just have the phone itself, try the Geekbench or CPU-Z apps. They're benchmarking apps for the most part, but they also contain pretty detailed hardware reports.
- fathyb 4y agoIt has been a while since I used Android, but I believe you can view the model number in the About section in the Settings app?
- Idiot_in_Vain 4y agoYou do have this chipset. To confirm you can install AIDA64 from the Play Store.
- izacus 4y agoThis is a duplicate of https://news.ycombinator.com/item?id=35190811 https://news.ycombinator.com/item?id=35190811 with a clickbait title.
- micromacrofoot 4y agoSamsung is remarkably good at making Android worse.
- jeffbee 4y agoAs an industry, if we can consider software broadly as one industry, it is disappointing that we simply do not have a quality and correctness and safety culture. It has been true for decades and still appears to be true that the more hidden a program is from the user, the more slapdash its implementation will be. Device firmware is universally garbage. It's just like that TPM 2.0 reference implementation thing that was on HN earlier this week. It's just written by clowns in clown language and when they find the flaws instead of fixing the process that led to the flaws they just put in one more line of ClownLang to hack around it. Something from outside the industry needs to come in with some reform mandates.
- _trampeltier 4y agoJust pure and real pain will bring changes. So the only way is more ransomeware.
- baal80spam 4y agoWell... Microsoft ditched its QA unit a while ago. My employer posts multiple (10+) marketing and sales job openings currently on Linkedin but there is no money for an additional "QA resource". The list goes on, and this is one of the effects.
- wkat4242 4y agoYes. Over-reliance on automated tests and telemetry (aka testing on the users) is a problem in the industry and Microsoft is big into these. Unit tests are great but mainly look for things you expect and focus on the low having fruit. Not complex interactions between components. Their QA teams used to test on all kinds of hardware but most of it was replaced by automated VM stuff.
- jeffbee 4y agoThe firmware industry has a variety of problems and "over-reliance on automated tests" is decidedly not among them.
- gchokov 4y agoWhy are people still buying these phones? - They fake your pictures - i.e. replacing the real moon with a fake one; - Full of vulnerabilities in the wild.. all the time; - Shady connections with Asia the list goes on and on.
- aydyn 4y agoThere are phones that fake the moon, but saying Samsung does that is a lie.
- theshrike79 4y agoIt just fakes it with AI :D
- sangnoir 4y agoIs there a top-tier phone model on the market that doesn't enhance photos in some way using AI? Not too long ago, there was an HN discussion on AI artifacts on iPhone photos thet are readily apparent when viewed from a large/hi-res display, despite looking "better" than non-enhanced pictures on the phone display.
- petre 4y agoMy partner took a photo of food not long ago, with her iPhone 14. After doing photography for years I told her a photo shouldn't look like that. Why? Because she took it with back lighting and the food looked just perfectly exposed with texture and eveything, just like food photos from magazines.
- anaganisk 4y agoI mean that's exactly the point of phone cameras, each year phone companies are pushing the edge to get the best on board image processing to do more and more with the limited camera hardware options, it would be naive to expect commercial level control (composing) on the camera and expect it to sell to masses.
- pxoe 4y ago[dead]
- myself248 4y agoHow many carriers require VoLTE for voice now? I keep getting nastygrams from my carrier telling me to upgrade my old non-VoLTE-capable phone or I'll lose voice 'any day now', with a drop-dead date that's moved several times.
- kube-system 4y agoAre you outside of the US? T-Mobile, ATT, and Verizon have all shut down 3G networks as of 2022.
- sangnoir 4y agoLTE is 4G, as is VoLTE. US carriers haven't shutdown 4G networks AFAIK.
- kube-system 4y agoI understand, the person above says they have a non-VoLTE phone, which will make voice calls on 2G or 3G.
- dilyevsky 4y agothere’s something called CSFB (circuit switch fallback) which allows you to make old school voice calls/sms without using IMS (volte) over 4g network
- BuildTheRobots 4y agoMy understanding is that CSFB works by signalling the LTE/4G handset to handover to the 3G or 2G network and continue the call setup on there. If carriers have shut down their 2G and 3G networks then there is nothing providing Circuit Switched services to fall back to.
- dilyevsky 4y ago
- dhosek 4y agoThis kind of feels like I stopped building my own computers and moved to the Apple ecosystem with prebuilt systems. It was always easy for everyone to point their fingers somewhere else when something didn’t work. It’s a problem with the hardware, no the OS, no the software, no those two peripherals conflict… There are still issues that crop up from time to time now that I’m on a Mac, but there’s also one place to turn to when there’s a problem and they generally do a pretty good job of resolving things (although the last big issue I had—which ultimately ended with my laptop going through a Ship of Theseus complete replacement took a while but that was also in November–December of 2020 when everything was pretty messed up & the service person was able to give me my choice of anything from the Apple store under $200 as compensation).
- hot_gril 4y agoThis is how I feel at work too. Someone's system is misbehaving, and I report a bug. They say it's some dependency's issue and direct me to ask someone there. No, that's your responsibility, not mine. I don't know the intricacies of your s2s interaction.
- londons_explore 4y agoAnd all that was available under $200 was a branded mousemat...
- jacooper 4y agoThey will fix this, its already fixed in the pixel 7 pro, and it should be fixed on any gpone with march 2023 patch level.
- jacooper 4y agoPhone*