5 ms·

Pixel 2 is not impacted by this vulnerability as it doesn't have a Samsung modem.

by arsome 4y ago

MBCook 4y ago
No but if their Pixel 2 is no longer receiving security updates then figuring out a replacement plan (even if you don’t plan to do it yet) seems like a good idea.
- arsome 4y ago
  Honestly, unless it's a remote, worm-grade exploit or you're a high value target, you can probably just stop caring about software updates. Your threat model might be different but I don't get out of bed for anything but RCE personally, let alone spend a penny.
  - mikepurvis 4y ago
    I guess, but it sure is nice that on Apple hardware you generally don’t need to worry about doing this calculus because they deliver updates in a timely manner to even five year old devices. It bums me out that them doing this hasn’t been effective in shaming everyone else into following suit.
    - ryukafalz 4y ago
      The iPod Touch Gen 7 lasted just under 3 years from release. They may be better than many others but I just got bit by that one.
      - mikepurvis 4y ago
        That is unfortunate. Certainly the trend has been for them to lengthen the support window over time— see this article for a decent summary: https://www.macworld.com/article/675021/how-long-does-apple-support-iphones.html https://www.macworld.com/article/675021/how-long-does-apple-... I wonder if Apple views the "iPod" branding as being more associated with gaming and consumption and therefore less important from a security standpoint. I don't think I necessarily would agree with such a stance when the exact same hardware can carry sensitive stuff like a password manager, banking and medical apps, and so-on. But I imagine their telemetry showed that that overwhelmingly wasn't the case, so it was easy not to prioritize it.
        saagarjha 4y ago
        No, it's more that Apple has always released iPod with older chips, and in this case it also decided to discontinue that product line, which meant that they dropped software support for it relatively soon.
      - GeekyBear 4y ago
        Every flagship iPhone since 2011 has gotten at least five years of both OS updates and security updates, with some newer devices (including the $399 iPhone SE) getting as many as seven years. Even after official support completely ends, Apple tends to go back and issue patches for active exploits. The nine year old iPhone 5s just got another security update a couple of months ago.
      - gcanyon 4y ago
        This may be a special case: "With the release [of iOS 16], Apple dropped support for iPhone and iPod Touch models with A9 and A10 Fusion chips (the iPhone 6S/6S Plus, the 1st gen iPhone SE, the iPhone 7/7 Plus and the 7th gen iPod Touch) due to hardware limitations and Chinese government's border stringent in response of COVID-19 pandemic." https://en.wikipedia.org/wiki/IOS_version_history#iOS_16_/_iPadOS_16 https://en.wikipedia.org/wiki/IOS_version_history#iOS_16_/_i...
      - mlyle 4y ago
        > The iPod Touch Gen 7 lasted just under 3 years from release. It was released May 2019, and it just received its latest security update (15.7.3) January 23, 2023. Presumably that is not the last security update for iOS 15.
        mikepurvis 4y ago
        That’s an important note— getting the latest iOS is nice, but Apple continues to patch the 3-4 most recent versions. I’m not aware that Android gets anything like this, even in the era of Google Play Services.
    - barbazoo 4y ago
      According to Wikipedia the Pixel 2 received security updates for less than 3 years. None of their devices got more than 3 years 3 months of updates. That should be illegal honestly, couldn't be more clear that they don't care about sustainability. https://en.m.wikipedia.org/wiki/Google_Pixel https://en.m.wikipedia.org/wiki/Google_Pixel
      - jay_kyburz 4y ago
        If you could demonstrate harm from a vulnerability, you could probably ask a court for some compensation. Just like if your lawnmower exploded with a known flaw, you would sue the lawnmower manufacturer.
      - jvolkman 4y ago
        Qualcomm's lack of support for older chipsets has been blamed for the short lifecycles of these phones. Pixel 6 and 7, which don't use Qualcomm SoCs, both get at least 5 years of security updates.
        mikepurvis 4y ago
        Google is ten times the size of Qualcomm— there's no way they wouldn't be able to extract those commitments upfront.
        jvolkman 4y ago
        Google is, but most of Google isn't (wasn't) purchasing SoCs from Qualcomm. Its hardware division is tiny.
      - pjmlp 4y ago
        I still remember when phones did not receive any updates, and the few lucky models required developer tools to manually upload the firmware updates, which most of those few selected models only got one in their lifetime.
        mikepurvis 4y ago
  - jeffparsons 4y ago
    Well, I use a web browser on the phone. Chrome et al. are still receiving updates for my phone, but I'm guessing they use some system components that are not receiving updates? So my main worry is something like an ad network loading an exploit. You don't need to be a high value target to get caught in an extremely wide net like that. (Yes, I know: get a better ad blocker, etc. — I'd rather have fewer weak links, though, and a lack of basic OS updates is a pretty big weak link.)
    - arsome 4y ago
      Not really - Android has for many versions now been updating the embedded webview component via play services.
      - jeffparsons 4y ago
        Huh, that's somewhat comforting, I guess. And all image codecs etc. are statically linked?
        saagarjha 4y ago
        Many are. However, you'd still be vulnerable via API calls to other things, like Binder exploits.
  - prophesi 4y ago
    With a cursory search I found CVE-2021-0316. This one's just for bluetooth, but it's an RCE with no user interaction discovered in 2021. Pixel 2 had its last security patch in November 2020.
    - arsome 4y ago
      Yes, it exists, but is it actively exploitable? A cursory search turns up no working exploit code. Given modern exploit mitigations many theoretical vulnerabilities turn out to be nothing-burgers, as far as I can see there's certainly no worm running around popping phones with it. For sure, if you're paranoid or a high-value target, update, buy a new phone. But normal users don't need to care unless there's actually something on the line.
      - prophesi 4y ago
        Android's security advisory page shows what vulnerabilities have been found in the wild. Security researcher Maddie Stone from Google's Project Zero: https://twitter.com/maddiestone/status/1395004346996248586 https://twitter.com/maddiestone/status/1395004346996248586 Not sure what to say about encouraging users to throw caution to the wind. We got to this point of such good exploit mitigation because it's good for everyone for these devices to be secured.
        arsome 4y ago
        A bit silly to link a page about malware that Play Protect prevents, largely local privescs that are being detected by the OS or Google Play beforehand. An average user installing apps from Play Store has nothing to worry about for those. That's kind of the point. It's great for these devices to be patched - I'd love it if Google would take more control over the ecosystem to be able to patch this sort of thing, but it's much worse for users to just throw out otherwise working devices with limited-to-no real-world security issues.
        prophesi 4y ago
        Um, no? Most of the RCE's I'm seeing are at the OS level and would require upgrading to a newer Android OS version that older devices won't have support for.
  - caconym_ 4y ago
    A phone (or any kind of internet-connected computer) that's been completely unsupported for years will presumably be low-hanging fruit for even the cheapest and crustiest of exploit kits.
    - arsome 4y ago
      Most code that interacts with the internet is updated via other mechanisms. For example, web browsers are kept up to date via Play Store: Firefox for Android, Chrome and even the embedded WebView are all updated there.
      - caconym_ 4y ago
        https://www.cvedetails.com/version-list/1224/19997/1/Google-Android.html https://www.cvedetails.com/version-list/1224/19997/1/Google-...
    - userbinator 4y ago
      That is, to put nicely, forced-obsolescence FUD. They want to scare you away with words like "unsupported" so they can keep you on their leash. With the state of software development today, I'd be more worried about how many other holes they've added in the process of fixing something or introducing unwanted new "features"[1]. Here's some interesting statistics to look at and compare... https://www.cvedetails.com/product/462/Microsoft-Windows-98se.html?vendor_id=26 https://www.cvedetails.com/product/462/Microsoft-Windows-98s... - 30 RCEs in 7 years https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.html?vendor_id=26 https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.... - 276 RCEs in 20 years https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... - 664 RCEs in 8 years https://www.cvedetails.com/product/102217/Microsoft-Windows-11.html?vendor_id=26 https://www.cvedetails.com/product/102217/Microsoft-Windows-... - 157 RCEs in 2 years More relevantly: https://www.cvedetails.com/version-list/1224/19997/1/Google-Android.html https://www.cvedetails.com/version-list/1224/19997/1/Google-... [1] https://news.ycombinator.com/item?id=28449607 https://news.ycombinator.com/item?id=28449607
      - 4y ago

Pixel 2 is not impacted by this vulnerability as it doesn't have a Samsung modem.

by arsome 4y ago

Pixel 2 is not impacted by this vulnerability as it doesn't have a Samsung modem.

No but if their Pixel 2 is no longer receiving security updates then figuring out a replacement plan (even if you don’t plan to do it yet) seems like a good idea.

arsome 4y ago
Honestly, unless it's a remote, worm-grade exploit or you're a high value target, you can probably just stop caring about software updates. Your threat model might be different but I don't get out of bed for anything but RCE personally, let alone spend a penny.
- mikepurvis 4y ago
  I guess, but it sure is nice that on Apple hardware you generally don’t need to worry about doing this calculus because they deliver updates in a timely manner to even five year old devices. It bums me out that them doing this hasn’t been effective in shaming everyone else into following suit.
  - ryukafalz 4y ago
    The iPod Touch Gen 7 lasted just under 3 years from release. They may be better than many others but I just got bit by that one.
    - mikepurvis 4y ago
      That is unfortunate. Certainly the trend has been for them to lengthen the support window over time— see this article for a decent summary: https://www.macworld.com/article/675021/how-long-does-apple-support-iphones.html https://www.macworld.com/article/675021/how-long-does-apple-... I wonder if Apple views the "iPod" branding as being more associated with gaming and consumption and therefore less important from a security standpoint. I don't think I necessarily would agree with such a stance when the exact same hardware can carry sensitive stuff like a password manager, banking and medical apps, and so-on. But I imagine their telemetry showed that that overwhelmingly wasn't the case, so it was easy not to prioritize it.
      - saagarjha 4y ago
        No, it's more that Apple has always released iPod with older chips, and in this case it also decided to discontinue that product line, which meant that they dropped software support for it relatively soon.
    - GeekyBear 4y ago
      Every flagship iPhone since 2011 has gotten at least five years of both OS updates and security updates, with some newer devices (including the $399 iPhone SE) getting as many as seven years. Even after official support completely ends, Apple tends to go back and issue patches for active exploits. The nine year old iPhone 5s just got another security update a couple of months ago.
    - gcanyon 4y ago
      This may be a special case: "With the release [of iOS 16], Apple dropped support for iPhone and iPod Touch models with A9 and A10 Fusion chips (the iPhone 6S/6S Plus, the 1st gen iPhone SE, the iPhone 7/7 Plus and the 7th gen iPod Touch) due to hardware limitations and Chinese government's border stringent in response of COVID-19 pandemic." https://en.wikipedia.org/wiki/IOS_version_history#iOS_16_/_iPadOS_16 https://en.wikipedia.org/wiki/IOS_version_history#iOS_16_/_i...
    - mlyle 4y ago
      > The iPod Touch Gen 7 lasted just under 3 years from release. It was released May 2019, and it just received its latest security update (15.7.3) January 23, 2023. Presumably that is not the last security update for iOS 15.
      - mikepurvis 4y ago
        That’s an important note— getting the latest iOS is nice, but Apple continues to patch the 3-4 most recent versions. I’m not aware that Android gets anything like this, even in the era of Google Play Services.
  - barbazoo 4y ago
    According to Wikipedia the Pixel 2 received security updates for less than 3 years. None of their devices got more than 3 years 3 months of updates. That should be illegal honestly, couldn't be more clear that they don't care about sustainability. https://en.m.wikipedia.org/wiki/Google_Pixel https://en.m.wikipedia.org/wiki/Google_Pixel
    - jay_kyburz 4y ago
      If you could demonstrate harm from a vulnerability, you could probably ask a court for some compensation. Just like if your lawnmower exploded with a known flaw, you would sue the lawnmower manufacturer.
    - jvolkman 4y ago
      Qualcomm's lack of support for older chipsets has been blamed for the short lifecycles of these phones. Pixel 6 and 7, which don't use Qualcomm SoCs, both get at least 5 years of security updates.
      - mikepurvis 4y ago
        Google is ten times the size of Qualcomm— there's no way they wouldn't be able to extract those commitments upfront.
        jvolkman 4y ago
        Google is, but most of Google isn't (wasn't) purchasing SoCs from Qualcomm. Its hardware division is tiny.
    - pjmlp 4y ago
      I still remember when phones did not receive any updates, and the few lucky models required developer tools to manually upload the firmware updates, which most of those few selected models only got one in their lifetime.
      - mikepurvis 4y ago
- jeffparsons 4y ago
  Well, I use a web browser on the phone. Chrome et al. are still receiving updates for my phone, but I'm guessing they use some system components that are not receiving updates? So my main worry is something like an ad network loading an exploit. You don't need to be a high value target to get caught in an extremely wide net like that. (Yes, I know: get a better ad blocker, etc. — I'd rather have fewer weak links, though, and a lack of basic OS updates is a pretty big weak link.)
  - arsome 4y ago
    Not really - Android has for many versions now been updating the embedded webview component via play services.
    - jeffparsons 4y ago
      Huh, that's somewhat comforting, I guess. And all image codecs etc. are statically linked?
      - saagarjha 4y ago
        Many are. However, you'd still be vulnerable via API calls to other things, like Binder exploits.
- prophesi 4y ago
  With a cursory search I found CVE-2021-0316. This one's just for bluetooth, but it's an RCE with no user interaction discovered in 2021. Pixel 2 had its last security patch in November 2020.
  - arsome 4y ago
    Yes, it exists, but is it actively exploitable? A cursory search turns up no working exploit code. Given modern exploit mitigations many theoretical vulnerabilities turn out to be nothing-burgers, as far as I can see there's certainly no worm running around popping phones with it. For sure, if you're paranoid or a high-value target, update, buy a new phone. But normal users don't need to care unless there's actually something on the line.
    - prophesi 4y ago
      Android's security advisory page shows what vulnerabilities have been found in the wild. Security researcher Maddie Stone from Google's Project Zero: https://twitter.com/maddiestone/status/1395004346996248586 https://twitter.com/maddiestone/status/1395004346996248586 Not sure what to say about encouraging users to throw caution to the wind. We got to this point of such good exploit mitigation because it's good for everyone for these devices to be secured.
      - arsome 4y ago
        A bit silly to link a page about malware that Play Protect prevents, largely local privescs that are being detected by the OS or Google Play beforehand. An average user installing apps from Play Store has nothing to worry about for those. That's kind of the point. It's great for these devices to be patched - I'd love it if Google would take more control over the ecosystem to be able to patch this sort of thing, but it's much worse for users to just throw out otherwise working devices with limited-to-no real-world security issues.
        prophesi 4y ago
        Um, no? Most of the RCE's I'm seeing are at the OS level and would require upgrading to a newer Android OS version that older devices won't have support for.
- caconym_ 4y ago
  A phone (or any kind of internet-connected computer) that's been completely unsupported for years will presumably be low-hanging fruit for even the cheapest and crustiest of exploit kits.
  - arsome 4y ago
    Most code that interacts with the internet is updated via other mechanisms. For example, web browsers are kept up to date via Play Store: Firefox for Android, Chrome and even the embedded WebView are all updated there.
    - caconym_ 4y ago
      https://www.cvedetails.com/version-list/1224/19997/1/Google-Android.html https://www.cvedetails.com/version-list/1224/19997/1/Google-...
  - userbinator 4y ago
    That is, to put nicely, forced-obsolescence FUD. They want to scare you away with words like "unsupported" so they can keep you on their leash. With the state of software development today, I'd be more worried about how many other holes they've added in the process of fixing something or introducing unwanted new "features"[1]. Here's some interesting statistics to look at and compare... https://www.cvedetails.com/product/462/Microsoft-Windows-98se.html?vendor_id=26 https://www.cvedetails.com/product/462/Microsoft-Windows-98s... - 30 RCEs in 7 years https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.html?vendor_id=26 https://www.cvedetails.com/product/739/Microsoft-Windows-Xp.... - 276 RCEs in 20 years https://www.cvedetails.com/product/32238/Microsoft-Windows-10.html?vendor_id=26 https://www.cvedetails.com/product/32238/Microsoft-Windows-1... - 664 RCEs in 8 years https://www.cvedetails.com/product/102217/Microsoft-Windows-11.html?vendor_id=26 https://www.cvedetails.com/product/102217/Microsoft-Windows-... - 157 RCEs in 2 years More relevantly: https://www.cvedetails.com/version-list/1224/19997/1/Google-Android.html https://www.cvedetails.com/version-list/1224/19997/1/Google-... [1] https://news.ycombinator.com/item?id=28449607 https://news.ycombinator.com/item?id=28449607
    - 4y ago