12 ms·

It's probably far worse with Android users that Google is not disclosing. I'm seriously considering changing to Apple after this. Not that its secure but that

by spxneo 3y ago

It's probably far worse with Android users that Google is not disclosing. I'm seriously considering changing to Apple after this. Not that its secure but that they are willing to go to this length to communicate it.

ipaddr 3y ago
Are you a journalist or high profile target? If not, this notification isn't for the average person.
- gxs 3y ago
  Why is it hard to see that while he may not be a target for any sort of state sponsored attack, it’s a bellwether of apples stance on security. I really, really don’t think he meant he was switching to Apple because he’s a CIA spy stationed in Moscow.
  - spxneo 3y ago
    > CIA spy stationed in Moscow. Чёрт побери!
- scrollaway 3y ago
  Right it’s unthinkable you’d find high profile targets on hacker news. All you’ll find here are founders of highly funded startups and software developers at boring companies such as Google, Microsoft and Apple. No point getting into these people’s phones if you’re a state actor for sure /shrug
- consumer451 3y ago
  You don't need to be a journalist. I think many tech workers are oblivious to how juicy and obvious a target we are. Most of us publish a detailed target on our own back via LinkedIn, or our company's website About Us and Clients pages. Long ago, I co-founded a tiny startup. We had some high profile clients. I was dumb enough to put those clients on our site. I also used to be dumb enough to have a public social media profile, in my name. I was already somewhat security aware, but one day I almost fell for a spear phishing email. Someone created a gmail account 1 character different from my gf's gmail. They sent me a well worded, but simple email along the lines of "Hey baby, check this out!" and URL shortened link. She happened to be next to me, and I said to her "Hey, what's this?" "What? I didn't send that!" I then opened it in a VM and saw that it resolved to something.ru. It was a combo of identifying the juicy client of ours, seeing my name as co-founder, finding me on FB, finding my gf in my profile, getting her email, etc. I then got to learn fun new terms like threat modeling. Is it possible that someone might think that you have ssh access to a server on an interesting network? You are a target.
- ziddoap 3y ago
  Or if you are adjacent to a high profile target, working in the same company as a high profile target, working at a company that is contracted to a high profile target, friend of a friend of a high profile target.... And so on. Sure, the average person probably doesn't need this (although as another comment pointed out, HN isn't quite representative of the average)... But the net is a hell of a lot wider than just journalists.
  - standardUser 3y ago
    Years ago I worked for a non-profit in an office building in San Francisco. My office neighbors were Google, the US Secret Service and, I shit you not, China Daily (a major news outlet run by the Chinese Communist party).
user_7832 3y ago
> I'm seriously considering changing to Apple after this. Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these exploits, and the various unicode/pdf etc rendering engines are responsible in many exploits. Android's open-source nature likely means that a lot of these things are found by security researchers first. Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day. Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful.
- spxneo 3y ago
  you changed my mind successfully thank you but what about dumb phones from late 2000s like my Samsung Alias 2? what kind of sick bastard would make zero days for this
  - 1oooqooq 3y ago
    for those you don't need 0days. you can use 360*20days just fine. it's like there was any firmware update for them ever.
    - deleted 3y ago
      [deleted]
  - consumer451 3y ago
    I can never pass up an opportunity to mention Justine Haupt’s Rotary Un-Smartphone. Buy: https://skysedge.com/telecom/RUSP/index.html https://skysedge.com/telecom/RUSP/index.html Story: https://www.justine-haupt.com/rotarycellphoneinfo/index.html https://www.justine-haupt.com/rotarycellphoneinfo/index.html Edit: wait, was she not able to get it certified? Does it really say it won’t connect to a US network? Oh, > This is a regulatory approval issue which will take time to resolve.
    - spxneo 3y ago
      weird why wouldn't it work with US networks...but works in other countries? not sure about the rotary thing that looks cool tho
resource_waste 3y ago
Wait... Apple has the worst security record of any of the FAANG companies and you are switching to them because they admitted a security issue after the fact? What? Is this just regular Apple fanboy-ism?
- spxneo 3y ago
  i changed my mind after somebody reminded me Android is more secure and harder to hack due to diversity in hardware
ethbr1 3y ago
Reading between the lines, one thing that I expect Apple has but may not be discussing -- root-cause replayability post-infection, across all Apple devices. I.e. infection is eventually discovered, Apple isolates the vulnerability's entry point, then Apple has some ability to re-scan all devices to detect which may have also had the attack targeted against them Hashing some data that can serve as a fingerprint makes sense from a herd standpoint (hell, even something as simple as call stack after iMessage received)
fishywang 3y ago
>It's probably far worse with Android users that Google is not disclosing. [citation needed]
- aembleton 3y ago
  https://dictionary.cambridge.org/dictionary/english/probably https://dictionary.cambridge.org/dictionary/english/probably
slim 3y ago
Google has been doing this for a long time. I received one of those emails circa 2010
jmprspret 3y ago
Far worse with Android users? In general, sure. Google Pixel phones however nowadays comparable to Apple in terms of security. Some argue more secure. And as others have noted Google has notified people about similar before. Plus, I don't think the onus is on Google to monitor and alert for other OEM phones ala Samsung, Motorola, etc.

by spxneo 3y ago

ipaddr 3y ago

Are you a journalist or high profile target? If not, this notification isn't for the average person.

gxs 3y ago
Why is it hard to see that while he may not be a target for any sort of state sponsored attack, it’s a bellwether of apples stance on security. I really, really don’t think he meant he was switching to Apple because he’s a CIA spy stationed in Moscow.
- spxneo 3y ago
  > CIA spy stationed in Moscow. Чёрт побери!
scrollaway 3y ago
Right it’s unthinkable you’d find high profile targets on hacker news. All you’ll find here are founders of highly funded startups and software developers at boring companies such as Google, Microsoft and Apple. No point getting into these people’s phones if you’re a state actor for sure /shrug
consumer451 3y ago
You don't need to be a journalist. I think many tech workers are oblivious to how juicy and obvious a target we are. Most of us publish a detailed target on our own back via LinkedIn, or our company's website About Us and Clients pages. Long ago, I co-founded a tiny startup. We had some high profile clients. I was dumb enough to put those clients on our site. I also used to be dumb enough to have a public social media profile, in my name. I was already somewhat security aware, but one day I almost fell for a spear phishing email. Someone created a gmail account 1 character different from my gf's gmail. They sent me a well worded, but simple email along the lines of "Hey baby, check this out!" and URL shortened link. She happened to be next to me, and I said to her "Hey, what's this?" "What? I didn't send that!" I then opened it in a VM and saw that it resolved to something.ru. It was a combo of identifying the juicy client of ours, seeing my name as co-founder, finding me on FB, finding my gf in my profile, getting her email, etc. I then got to learn fun new terms like threat modeling. Is it possible that someone might think that you have ssh access to a server on an interesting network? You are a target.
ziddoap 3y ago
Or if you are adjacent to a high profile target, working in the same company as a high profile target, working at a company that is contracted to a high profile target, friend of a friend of a high profile target.... And so on. Sure, the average person probably doesn't need this (although as another comment pointed out, HN isn't quite representative of the average)... But the net is a hell of a lot wider than just journalists.
- standardUser 3y ago
  Years ago I worked for a non-profit in an office building in San Francisco. My office neighbors were Google, the US Secret Service and, I shit you not, China Daily (a major news outlet run by the Chinese Communist party).

user_7832 3y ago

> I'm seriously considering changing to Apple after this. Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these exploits, and the various unicode/pdf etc rendering engines are responsible in many exploits. Android's open-source nature likely means that a lot of these things are found by security researchers first. Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day. Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful.

spxneo 3y ago
you changed my mind successfully thank you but what about dumb phones from late 2000s like my Samsung Alias 2? what kind of sick bastard would make zero days for this
- 1oooqooq 3y ago
  for those you don't need 0days. you can use 360*20days just fine. it's like there was any firmware update for them ever.
  - deleted 3y ago
    [deleted]
- consumer451 3y ago
  I can never pass up an opportunity to mention Justine Haupt’s Rotary Un-Smartphone. Buy: https://skysedge.com/telecom/RUSP/index.html https://skysedge.com/telecom/RUSP/index.html Story: https://www.justine-haupt.com/rotarycellphoneinfo/index.html https://www.justine-haupt.com/rotarycellphoneinfo/index.html Edit: wait, was she not able to get it certified? Does it really say it won’t connect to a US network? Oh, > This is a regulatory approval issue which will take time to resolve.
  - spxneo 3y ago
    weird why wouldn't it work with US networks...but works in other countries? not sure about the rotary thing that looks cool tho

resource_waste 3y ago

Wait... Apple has the worst security record of any of the FAANG companies and you are switching to them because they admitted a security issue after the fact? What? Is this just regular Apple fanboy-ism?

spxneo 3y ago
i changed my mind after somebody reminded me Android is more secure and harder to hack due to diversity in hardware

ethbr1 3y ago

Reading between the lines, one thing that I expect Apple has but may not be discussing -- root-cause replayability post-infection, across all Apple devices. I.e. infection is eventually discovered, Apple isolates the vulnerability's entry point, then Apple has some ability to re-scan all devices to detect which may have also had the attack targeted against them Hashing some data that can serve as a fingerprint makes sense from a herd standpoint (hell, even something as simple as call stack after iMessage received)

fishywang 3y ago

>It's probably far worse with Android users that Google is not disclosing. [citation needed]

aembleton 3y ago
https://dictionary.cambridge.org/dictionary/english/probably https://dictionary.cambridge.org/dictionary/english/probably

slim 3y ago

Google has been doing this for a long time. I received one of those emails circa 2010

jmprspret 3y ago

Far worse with Android users? In general, sure. Google Pixel phones however nowadays comparable to Apple in terms of security. Some argue more secure. And as others have noted Google has notified people about similar before. Plus, I don't think the onus is on Google to monitor and alert for other OEM phones ala Samsung, Motorola, etc.