3 ms·

What percentage of those will actually be exploited in the hands of typical users? There's not exactly worm grade exploits flying around for these devices. Mos

by arsome 3y ago

What percentage of those will actually be exploited in the hands of typical users? There's not exactly worm grade exploits flying around for these devices. Most of the vulnerabilities require you to be loading sketchy apps, many of these are checked on Play Store by scanners, so unless you get very unlucky or sideload sketchy apps, probably not a concern. Web view and most other network exposed components are updated from play store, since stagefright they sandboxed all codecs, etc. It's really not that bad for a typical user to just run an unpatched phone, certainly better than a Windows machine with local admin where downloading and running one executable is all it takes. At least on an unpatched Android device they get some level of sandboxing.

johndavidback 3y ago
I tend to agree here - of course security is a concern and the horror stories are just that, horrific, but how often (specifically on mobile) do they happen? And with such a significant amount of our personal data now on devices - photos, health, financial - if there were constant massive exploitation there'd be relentless pressure to improve.
izacus 3y ago
> What percentage of those will actually be exploited in the hands of typical users? There's not exactly worm grade exploits flying around for these devices. There have been large set of attacks against modems and media decoders that do not require any kind of app installation. iMessage is a constant source of iOS CVEs. Media codecs are a constant source of headaches in the Android world as well and they require a driver update to fix (since most of them are HW decoders). Pretty much all of the big security issues in the last year required no user interaction on Android or iOS to exploit.
pizza234 3y ago
> What percentage of those will actually be exploited in the hands of typical users? There's not exactly worm grade exploits flying around for these devices. In addition to the sibling post, Bluetooth is another attack vector. A phone I had to abandon in the past was a Nexus 5X, which I believe has a set of very serious Bluetooth bugs. I don't remember the details, but they were very easily exploitable (as in: either doing nothing, or just keeping the BT menu in the foreground, which is a common operation).

by arsome 3y ago

johndavidback 3y ago

I tend to agree here - of course security is a concern and the horror stories are just that, horrific, but how often (specifically on mobile) do they happen? And with such a significant amount of our personal data now on devices - photos, health, financial - if there were constant massive exploitation there'd be relentless pressure to improve.

izacus 3y ago

> What percentage of those will actually be exploited in the hands of typical users? There's not exactly worm grade exploits flying around for these devices. There have been large set of attacks against modems and media decoders that do not require any kind of app installation. iMessage is a constant source of iOS CVEs. Media codecs are a constant source of headaches in the Android world as well and they require a driver update to fix (since most of them are HW decoders). Pretty much all of the big security issues in the last year required no user interaction on Android or iOS to exploit.

pizza234 3y ago

> What percentage of those will actually be exploited in the hands of typical users? There's not exactly worm grade exploits flying around for these devices. In addition to the sibling post, Bluetooth is another attack vector. A phone I had to abandon in the past was a Nexus 5X, which I believe has a set of very serious Bluetooth bugs. I don't remember the details, but they were very easily exploitable (as in: either doing nothing, or just keeping the BT menu in the foreground, which is a common operation).