4 ms·

> I'm seriously considering changing to Apple after this. Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these

> I'm seriously considering changing to Apple after this. Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these exploits, and the various unicode/pdf etc rendering engines are responsible in many exploits. Android's open-source nature likely means that a lot of these things are found by security researchers first. Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day. Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful.

spxneo 3y ago
you changed my mind successfully thank you but what about dumb phones from late 2000s like my Samsung Alias 2? what kind of sick bastard would make zero days for this
- 1oooqooq 3y ago
  for those you don't need 0days. you can use 360*20days just fine. it's like there was any firmware update for them ever.
  - deleted 3y ago
    [deleted]
- consumer451 3y ago
  I can never pass up an opportunity to mention Justine Haupt’s Rotary Un-Smartphone. Buy: https://skysedge.com/telecom/RUSP/index.html https://skysedge.com/telecom/RUSP/index.html Story: https://www.justine-haupt.com/rotarycellphoneinfo/index.html https://www.justine-haupt.com/rotarycellphoneinfo/index.html Edit: wait, was she not able to get it certified? Does it really say it won’t connect to a US network? Oh, > This is a regulatory approval issue which will take time to resolve.
  - spxneo 3y ago
    weird why wouldn't it work with US networks...but works in other countries? not sure about the rotary thing that looks cool tho
- user_7832 3y ago
  Happy to be able to help! If we’re talking about having the microphone tapped etc, I don’t think anyone would still be developing 0-days for such old phones. If you want to be safer (assuming fear of old software having unpatched vulnerabilities) Nokia launched a dumb phone not too long ago. However… GSM networks and cell tower level tracking is much harder/almost impossible to escape short of throwing away your phone. SMSes can be hijacked, hostile agents can force downgrade the connection to 3G/2g to break encryption (iirc, please correct me if wrong), and your location is generally known to your service provider and Uncle Sam. Plus… the SIM card is its own mini computer, and lots of the firmware between that and the telephony modules is proprietary and closed source. If you’re familiar with intel ME you have an idea of what I’m talking about. Honestly, if you’re not a journalist going after big names, or a top CEO/president etc you likely don’t need to worry about any of these. But if you are, or just want to be privacy conscious, your best bet is to never use cell towers and only use Wi-Fi/internet from public or untraceable places; along with Wi-Fi calling for telephony. Btw I’m not sure but I think Google fi and a few carriers/MVNOs offer virtual numbers, which can be a good first step for privacy.
blegr 3y ago
> Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day. A random Internet search gives iOS 30% market share to Android's 70% [1], which could also explain the higher price. [1] https://www.statista.com/statistics/272698/global-market-share-held-by-mobile-operating-systems-since-2009/ https://www.statista.com/statistics/272698/global-market-sha...
- user_7832 3y ago
  You raise a good point, however iirc the values of the 2 oses were the same for a long time in the past.
- runeks 3y ago
  That's worldwide, though. I think a target is more likely to reside in e.g. the US (where iOS usage is >50%) than in Africa.
onedognight 3y ago
Apple specifically acknowledges this and has Lockdown Mode to address it. If you care about security you should enable it. Of course you’ll not be able to watch YouTube videos, but you’ll be safer.
- cute_boi 3y ago
  whats the point of carrying phone that doesn't even play youtube videos? If security is so important then they should probably carry nokia style 2000's phone where there is no chance of malaware?
  - shepherdjerred 3y ago
    I don't have YouTube on my phone and I have Safari disabled. I use my iPhone for: * Controlling smart home devices * Messaging and phone calls * Checking the weather * Recording data with Apple Health * Uploading runs to Strava * Setting wakeup alarms * Listening to Apple Music * Using Apple Maps to get around * Connecting with CarPlay
  - comex 3y ago
    I don’t think Lockdown Mode actually prevents you from watching YouTube videos. Some googling suggests that there might be issues when using the YouTube website in Safari – which makes sense, since Lockdown Mode disables a bunch of Safari features. But the YouTube app probably still works. (I haven’t tried though.)
joe_guy 3y ago
I do not believe the android Messages application is open source. I believe AOSP contains something very barebones. It has been a lot of years, am I incorrect?
- realusername 3y ago
  The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis
  - spxneo 3y ago
    that is so bizarre that something so essential requires deep integration with the OS, of course that is going to open a can of worms.
  - saagarjha 3y ago
    I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is
    - user_7832 3y ago
      I believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.
      - saagarjha 3y ago
        No it doesn’t. Blastdoor is a security mitigation that restricts what iMessage can do in a way that is denied to other third party apps.
    - realusername 3y ago
      It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app. That's why most of the exploits are targeting imessage
jwells89 3y ago
> Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful. That variability is a double-edged sword. Manufacturer-added Android bundleware is notorious for being shoddily built and could easily represent added points of ingress. Which is why I wish it were practical to replace OEM Android versions with GrapheneOS/CalyxOS or similar on the latest devices, similar to how a cutting edge PC can run one’s choice of Linux. As long as more secure or at least more standardized Android distributions can only run on devices with some age on them, their popularity will be limited even among the technically inclined.
- alwayslikethis 3y ago
  GrapheneOS and I think CalyxOS runs just fine on the latest Pixel devices. From what I see it is quite up to date most of the times.
gorbypark 3y ago
I've read (I have no sources) that while the "zerodium still pays more for an android 0-day" thing can be true, the conditions on the "top" payout are pretty strict, due to the same aforementioned variability between vendors. To get that payout you'd have to find something exploitable on nearly all vendors version of android along with working on 2-3 versions. In reality an iMessage exploit is going to pay out a lot more because it would be exploitable on nearly all iPhones running x version of iOS, for example. Finding an exploit in say "Samsung messenger" (I don't know if that even exists) would pay less than an equivalent iMessage one.

spxneo 3y ago

you changed my mind successfully thank you but what about dumb phones from late 2000s like my Samsung Alias 2? what kind of sick bastard would make zero days for this

1oooqooq 3y ago
for those you don't need 0days. you can use 360*20days just fine. it's like there was any firmware update for them ever.
- deleted 3y ago
  [deleted]
consumer451 3y ago
I can never pass up an opportunity to mention Justine Haupt’s Rotary Un-Smartphone. Buy: https://skysedge.com/telecom/RUSP/index.html https://skysedge.com/telecom/RUSP/index.html Story: https://www.justine-haupt.com/rotarycellphoneinfo/index.html https://www.justine-haupt.com/rotarycellphoneinfo/index.html Edit: wait, was she not able to get it certified? Does it really say it won’t connect to a US network? Oh, > This is a regulatory approval issue which will take time to resolve.
- spxneo 3y ago
  weird why wouldn't it work with US networks...but works in other countries? not sure about the rotary thing that looks cool tho
user_7832 3y ago
Happy to be able to help! If we’re talking about having the microphone tapped etc, I don’t think anyone would still be developing 0-days for such old phones. If you want to be safer (assuming fear of old software having unpatched vulnerabilities) Nokia launched a dumb phone not too long ago. However… GSM networks and cell tower level tracking is much harder/almost impossible to escape short of throwing away your phone. SMSes can be hijacked, hostile agents can force downgrade the connection to 3G/2g to break encryption (iirc, please correct me if wrong), and your location is generally known to your service provider and Uncle Sam. Plus… the SIM card is its own mini computer, and lots of the firmware between that and the telephony modules is proprietary and closed source. If you’re familiar with intel ME you have an idea of what I’m talking about. Honestly, if you’re not a journalist going after big names, or a top CEO/president etc you likely don’t need to worry about any of these. But if you are, or just want to be privacy conscious, your best bet is to never use cell towers and only use Wi-Fi/internet from public or untraceable places; along with Wi-Fi calling for telephony. Btw I’m not sure but I think Google fi and a few carriers/MVNOs offer virtual numbers, which can be a good first step for privacy.

blegr 3y ago

> Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day. A random Internet search gives iOS 30% market share to Android's 70% [1], which could also explain the higher price. [1] https://www.statista.com/statistics/272698/global-market-share-held-by-mobile-operating-systems-since-2009/ https://www.statista.com/statistics/272698/global-market-sha...

user_7832 3y ago
You raise a good point, however iirc the values of the 2 oses were the same for a long time in the past.
runeks 3y ago
That's worldwide, though. I think a target is more likely to reside in e.g. the US (where iOS usage is >50%) than in Africa.

onedognight 3y ago

Apple specifically acknowledges this and has Lockdown Mode to address it. If you care about security you should enable it. Of course you’ll not be able to watch YouTube videos, but you’ll be safer.

cute_boi 3y ago
whats the point of carrying phone that doesn't even play youtube videos? If security is so important then they should probably carry nokia style 2000's phone where there is no chance of malaware?
- shepherdjerred 3y ago
  I don't have YouTube on my phone and I have Safari disabled. I use my iPhone for: * Controlling smart home devices * Messaging and phone calls * Checking the weather * Recording data with Apple Health * Uploading runs to Strava * Setting wakeup alarms * Listening to Apple Music * Using Apple Maps to get around * Connecting with CarPlay
- comex 3y ago
  I don’t think Lockdown Mode actually prevents you from watching YouTube videos. Some googling suggests that there might be issues when using the YouTube website in Safari – which makes sense, since Lockdown Mode disables a bunch of Safari features. But the YouTube app probably still works. (I haven’t tried though.)

joe_guy 3y ago

I do not believe the android Messages application is open source. I believe AOSP contains something very barebones. It has been a lot of years, am I incorrect?

realusername 3y ago
The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis
- spxneo 3y ago
  that is so bizarre that something so essential requires deep integration with the OS, of course that is going to open a can of worms.
- saagarjha 3y ago
  I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is
  - user_7832 3y ago
    I believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.
    - saagarjha 3y ago
      No it doesn’t. Blastdoor is a security mitigation that restricts what iMessage can do in a way that is denied to other third party apps.
  - realusername 3y ago
    It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app. That's why most of the exploits are targeting imessage

jwells89 3y ago

> Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful. That variability is a double-edged sword. Manufacturer-added Android bundleware is notorious for being shoddily built and could easily represent added points of ingress. Which is why I wish it were practical to replace OEM Android versions with GrapheneOS/CalyxOS or similar on the latest devices, similar to how a cutting edge PC can run one’s choice of Linux. As long as more secure or at least more standardized Android distributions can only run on devices with some age on them, their popularity will be limited even among the technically inclined.

alwayslikethis 3y ago
GrapheneOS and I think CalyxOS runs just fine on the latest Pixel devices. From what I see it is quite up to date most of the times.

gorbypark 3y ago

I've read (I have no sources) that while the "zerodium still pays more for an android 0-day" thing can be true, the conditions on the "top" payout are pretty strict, due to the same aforementioned variability between vendors. To get that payout you'd have to find something exploitable on nearly all vendors version of android along with working on 2-3 versions. In reality an iMessage exploit is going to pay out a lot more because it would be exploitable on nearly all iPhones running x version of iOS, for example. Finding an exploit in say "Samsung messenger" (I don't know if that even exists) would pay less than an equivalent iMessage one.