5 ms·

Google Pixel phones sold with security vulnerability, report finds

31 points by alamortsubite 2y ago

nope1000 2y ago
> “This was very deleterious of trust, to have third-party, unvetted insecure software on it,” Dane Stuckey, Palantir’s chief information security officer, That is pretty funny
zoklet-enjoyer 2y ago
So is this just on phones locked to Verizon or all of them?
- deleted 2y ago
  [deleted]
- ycombinatrix 2y ago
  Probably all of them. Even the OG non-verizon pixel had verizon garbage baked into it.
dp-hackernews 2y ago
Interesting addition to his statement: "Fernandez said the software was made “for Verizon in-store demo devices and is no longer being used,” adding that Google has “seen no evidence of any active exploitation.” How would they know?
- deleted 2y ago
  [deleted]
kimixa 2y ago
"The app was inactive by default and had to be manually enabled" So I don't really see it as a big deal - I probably have lots of software that's not running but exists on my PC that would be a security risk if "manually enabled". Though it's good to remove it if it's not necessary, I hardly see it as an emergency thing or really warrant this sort of breathless media drama.
angry_octet 2y ago
This is a beat up generated by Palantir and iVerify, both the Verge and WIRED swallowed the bait. "By Gaby Del Valle, a policy reporter. Her past work has focused on immigration politics, border surveillance technologies, and the rise of the New Right." Sorry Gaby, you're out of your depth. Somehow Lily Hay Newman (WIRED), who should know better, was also taken in by this. Don't install iVerify, it's practically malware.
topun 2y ago
[flagged]
OutOfHere 2y ago
It doesn't quite make sense to change the policy for all Android phones if an issue is with Verizon-branded Pixels.
- ycombinatrix 2y ago
  Don't verizon and play store pixels use the same os image? Sounds like an issue for all pixels.
ChrisArchitect 2y ago
Related sources already submitted: Google Pixel Phones Have Unpatched Flaw in Hidden Android App https://www.wired.com/story/google-android-pixel-showcase-vulnerability/ https://www.wired.com/story/google-android-pixel-showcase-vu... (https://news.ycombinator.com/item?id=41256122 https://news.ycombinator.com/item?id=41256122) Google sold Android phones with hidden insecure feature, companies find https://www.washingtonpost.com/technology/2024/08/15/google-sold-android-phones-with-hidden-insecure-feature-companies-find/ https://www.washingtonpost.com/technology/2024/08/15/google-... (https://news.ycombinator.com/item?id=41255631 https://news.ycombinator.com/item?id=41255631) iVerify Discovers Android Vulnerability Impacting Millions of Devices https://iverify.io/press-releases/iverify-discovers-severe-android-vulnerability-impacting-millions-of-devices-around-the-world https://iverify.io/press-releases/iverify-discovers-severe-a... (https://news.ycombinator.com/item?id=41255798 https://news.ycombinator.com/item?id=41255798)
ycombinatrix 2y ago
how come verizon gets this special access to insert their code into pixel factory images? one can find crap like "VzwOmaTrigger.apk" built into the OS even on the original pixel
- hollerith 2y ago
  Because Google needs Verizon's consent for their phones to work on Verizon's network.
  - ycombinatrix 2y ago
    What makes verizon special compared to e.g. t-mobile? i didn't see any t-mobile code in the factory OS.
    - deleted 2y ago
      [deleted]

31 points by alamortsubite 2y ago

> “This was very deleterious of trust, to have third-party, unvetted insecure software on it,” Dane Stuckey, Palantir’s chief information security officer, That is pretty funny

zoklet-enjoyer 2y ago

So is this just on phones locked to Verizon or all of them?

deleted 2y ago
[deleted]
ycombinatrix 2y ago
Probably all of them. Even the OG non-verizon pixel had verizon garbage baked into it.

dp-hackernews 2y ago

Interesting addition to his statement: "Fernandez said the software was made “for Verizon in-store demo devices and is no longer being used,” adding that Google has “seen no evidence of any active exploitation.” How would they know?

deleted 2y ago
[deleted]

kimixa 2y ago

"The app was inactive by default and had to be manually enabled" So I don't really see it as a big deal - I probably have lots of software that's not running but exists on my PC that would be a security risk if "manually enabled". Though it's good to remove it if it's not necessary, I hardly see it as an emergency thing or really warrant this sort of breathless media drama.

angry_octet 2y ago

This is a beat up generated by Palantir and iVerify, both the Verge and WIRED swallowed the bait. "By Gaby Del Valle, a policy reporter. Her past work has focused on immigration politics, border surveillance technologies, and the rise of the New Right." Sorry Gaby, you're out of your depth. Somehow Lily Hay Newman (WIRED), who should know better, was also taken in by this. Don't install iVerify, it's practically malware.

topun 2y ago

[flagged]

OutOfHere 2y ago

It doesn't quite make sense to change the policy for all Android phones if an issue is with Verizon-branded Pixels.

ycombinatrix 2y ago
Don't verizon and play store pixels use the same os image? Sounds like an issue for all pixels.

ChrisArchitect 2y ago

Related sources already submitted: Google Pixel Phones Have Unpatched Flaw in Hidden Android App https://www.wired.com/story/google-android-pixel-showcase-vulnerability/ https://www.wired.com/story/google-android-pixel-showcase-vu... (https://news.ycombinator.com/item?id=41256122 https://news.ycombinator.com/item?id=41256122) Google sold Android phones with hidden insecure feature, companies find https://www.washingtonpost.com/technology/2024/08/15/google-sold-android-phones-with-hidden-insecure-feature-companies-find/ https://www.washingtonpost.com/technology/2024/08/15/google-... (https://news.ycombinator.com/item?id=41255631 https://news.ycombinator.com/item?id=41255631) iVerify Discovers Android Vulnerability Impacting Millions of Devices https://iverify.io/press-releases/iverify-discovers-severe-android-vulnerability-impacting-millions-of-devices-around-the-world https://iverify.io/press-releases/iverify-discovers-severe-a... (https://news.ycombinator.com/item?id=41255798 https://news.ycombinator.com/item?id=41255798)

ycombinatrix 2y ago

how come verizon gets this special access to insert their code into pixel factory images? one can find crap like "VzwOmaTrigger.apk" built into the OS even on the original pixel

hollerith 2y ago
Because Google needs Verizon's consent for their phones to work on Verizon's network.
- ycombinatrix 2y ago
  What makes verizon special compared to e.g. t-mobile? i didn't see any t-mobile code in the factory OS.
  - deleted 2y ago
    [deleted]