4 ms·

Wow this sounds like stagefright was way back when. So for those keeping score, is Android now ahead of iOS in this aspect of security?

madeofpalk 3y ago
I never hear about Android vulnerabilities, but it seems wrong to say they haven't existed.
alphabettsy 3y ago
Maybe, but probably not. They have regular security releases that often patch critical vulnerabilities such as https://source.android.com/docs/security/bulletin/2023-08-01 https://source.android.com/docs/security/bulletin/2023-08-01 The bigger issue with Android IMO is you might not get the patches right away depending on your device and it’s age.
Etheryte 3y ago
While there's a big difference between a CVE and a CVE, Android has had 939 CVEs in 2023 alone [0]. I wouldn't necessarily hold my breath on this one. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-19997/Google-Android.html?year=2023 https://www.cvedetails.com/vulnerability-list/vendor_id-1224...
bennyg 3y ago
I’d put money on there being an Android variant of Pegasus out there in the wild right now.
Operyl 3y ago
The price of an Android zero-click is now 500k more than the price of an iOS zero-click for Zerodium now. It would appear they have a significant stock of iOS zero-clicks and a lesser amount for Android: https://zerodium.com/program.html https://zerodium.com/program.html
SigmundA 3y ago
Not sure Android just had a bunch of CVE published with little fanfare here: https://source.android.com/docs/security/bulletin/2023-09-01 https://source.android.com/docs/security/bulletin/2023-09-01
nvm0n2 3y ago
Depends what you mean by this aspect of security. If you flick through the fixes for Android CVEs, you'll notice that there are only a few remote code execution vulns and they're all in C code. The rest are bugs in the Java side but they're all logic bugs and yield exploits like local privilege escalation, or they're privacy issues. So the Android strategy of using Java a lot definitely seems to have wiped out a lot of memory corruption and RCE bugs. The remainder are a mixed bag and it's hard to imagine any sort of systematic mitigation or fix. You can't really compare Android and iOS by CVE because iOS isn't open source or distributed to vendors, so Apple fix a lot of security issues without a public CVE ever being created.

madeofpalk 3y ago

I never hear about Android vulnerabilities, but it seems wrong to say they haven't existed.

alphabettsy 3y ago

Maybe, but probably not. They have regular security releases that often patch critical vulnerabilities such as https://source.android.com/docs/security/bulletin/2023-08-01 https://source.android.com/docs/security/bulletin/2023-08-01 The bigger issue with Android IMO is you might not get the patches right away depending on your device and it’s age.

Etheryte 3y ago

While there's a big difference between a CVE and a CVE, Android has had 939 CVEs in 2023 alone [0]. I wouldn't necessarily hold my breath on this one. [0] https://www.cvedetails.com/vulnerability-list/vendor_id-1224/product_id-19997/Google-Android.html?year=2023 https://www.cvedetails.com/vulnerability-list/vendor_id-1224...

bennyg 3y ago

I’d put money on there being an Android variant of Pegasus out there in the wild right now.

Operyl 3y ago

The price of an Android zero-click is now 500k more than the price of an iOS zero-click for Zerodium now. It would appear they have a significant stock of iOS zero-clicks and a lesser amount for Android: https://zerodium.com/program.html https://zerodium.com/program.html

SigmundA 3y ago

Not sure Android just had a bunch of CVE published with little fanfare here: https://source.android.com/docs/security/bulletin/2023-09-01 https://source.android.com/docs/security/bulletin/2023-09-01

nvm0n2 3y ago

Depends what you mean by this aspect of security. If you flick through the fixes for Android CVEs, you'll notice that there are only a few remote code execution vulns and they're all in C code. The rest are bugs in the Java side but they're all logic bugs and yield exploits like local privilege escalation, or they're privacy issues. So the Android strategy of using Java a lot definitely seems to have wiped out a lot of memory corruption and RCE bugs. The remainder are a mixed bag and it's hard to imagine any sort of systematic mitigation or fix. You can't really compare Android and iOS by CVE because iOS isn't open source or distributed to vendors, so Apple fix a lot of security issues without a public CVE ever being created.