9 ms·

Pixel smartphones delivered with secret but inactive remote maintenance

126 points by qwertox 2y ago

deleted 2y ago
[deleted]
TaylorAlexander 2y ago
My next question is does Verizon know the users passwords (possibly via some other exploit we don’t know about) and did some state agency encourage Verizon to request that software so that access to confiscated devices was a subpoena or fisa court order away.
- 0xEF 2y ago
  The smart money assumes "yes" at this point. After Snowden, we are fools if we think otherwise.
  - TaylorAlexander 2y ago
    Agreed! Snowden taught us a lot and sadly most people don’t seem to realize what it means. People say “the government can’t get in to Signal it’s encrypted and the protocol is well tested” and it’s like… yeah unless they can directly access the keys on your phone, and funny we keep seeing long standing vulnerabilities so actually no normal computer has ever been “secure”. Idk people aren’t paranoid enough. But I’m glad you get it!
- slashtab 2y ago
  https://grapheneos.social/@GrapheneOS/112967309987371034 https://grapheneos.social/@GrapheneOS/112967309987371034
mdp2021 2y ago
This specific to the submission is uninstalled normally (can be uninstalled by the user), I understand. Otherwise one could try: pm uninstall --user 0 the.unwanted.package I have to research about how effective the above is (uninstall only for this user - what you can do with "system" packages) to remove spyware.
- kelnos 2y ago
  IIRC if it's a system package, that will just disable it, not remove it, and it can be re-enabled fairly easily.
  - mdp2021 2y ago
    > can be re-enabled fairly easily Right, but remotely? If the package is disabled, and not re-enabled by third parties, and this operation can disable spyware... As said, I do not quite know yet how effective this can be in practice.
    - hollow-moe 2y ago
      you can safely assume google has full remote access to your android devices [0] [0] https://www.bbc.com/news/technology-45546276 https://www.bbc.com/news/technology-45546276
      - mdp2021 2y ago
        And when Apple did it with the iPhone "1" they said in press conference that "we decided that if we did not put the feature in, we would later regret it". The (BBC) article confirms that some Android implementations allow remote access from Google. The question remains, how much can `pm uninstall --user 0` limit the unwanted. For example, that remote access to the configurations the article discusses.
        mattl 2y ago
        Can you provide a source for that quote? I can’t seem to find it.
        jml78 2y ago
        I am not the person you are replying to but it is blantantly obvious that IF you have google play services on your phone, they have full access to your device. They have accidentally shown their hand previously by turning on battery saver mode on everyone's phone on accident. https://tech.hindustantimes.com/tech/news/google-can-remotely-change-your-device-s-settings-and-it-did-for-some-users-story-jerMVfd9kD19YbFruY4bII.html#:~:text=This%20was%20an%20internal%20experiment,said%20in%20a%20Reddit%20post https://tech.hindustantimes.com/tech/news/google-can-remotel.... They can try to say it is limited to whatever, but I think all the smoke means there is fire. I used to exclusively use Android devices until this incident happened. At the end of the day, I realize that even if I buy a google phone, I am still the product. I do not believe it is the same with Apple. Do I trust apple? No way, but I feel they have more incentive to not treat my data as a product to be sold and my device to be used to spy on me.
progbits 2y ago
> ... but only if the perpetrator has physical access to the device, enters the user's password ... Clickbait title. If you have physical access and password of course you can do whatever. That is the point of the password.
- croes 2y ago
  Where is the clickbait? The software is there but inactive. That's exactly the case.
  - TheDong 2y ago
    Did you know linux is delivered with a secret but inactive remote shell for hackers to attack your box? It can be enabled with: socat file:`tty`,raw,echo=0 TCP-L:1022 Or: awk 'BEGIN {s = "/inet/tcp/0/0.0.0.0/1022"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null Better uninstall awk or else you're "vulnerable to spyware", from the wording of the article. The article is clearly playing this up far more than it should be. The title is very clearly angling at "this is malicious, it's bad", when it sounds totally benign if it's just like the socat thing above, where you need to already be on the other side of the airtight door to use it https://devblogs.microsoft.com/oldnewthing/20221004-00/?p=107246 https://devblogs.microsoft.com/oldnewthing/20221004-00/?p=10...
    - sureglymop 2y ago
      Or even better... While booting, using either grub or systemd-boot, enter a uefi shell and change the kernel parameters to include 'init=/bin/bash rw'. Boot like that and you'll get a rw root shell. The point is.. a system someone has physics access to is never secure. One thing that helps a little bit is using LUKS full disk encryption.
      - bitwize 2y ago
        Apple has made significant progress in terms of developing evil-maid-resistant systems. "No system is secure when you have physical access" is one of those canards that was true ten or so years ago, but was not an iron law even then and has been falsified by recent developments. Kinda like "there's no such thing as unbreakable DRM" in an era when the Xbox DRM is indeed, for all intents and purposes, unbreakable.
homero 2y ago
So what? There's people who need remote support
- nusl 2y ago
  [flagged]
  - hoppyhoppy2 2y ago
    >Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that". https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
- croes 2y ago
  This what >According to iVerify, once activated, the application downloads a configuration file via an insecure connection, which can result in system-level code being executed. The configuration file is retrieved from a domain hosted by AWS over unsecured HTTP, which leaves the configuration and the device vulnerable to malicious code, spyware and data wiping.
  - deleted 2y ago
    [deleted]
  - diffeomorphism 2y ago
    https://xkcd.com/463/ https://xkcd.com/463/ The "unsecured HTTP" is about as relevant as lactose is for a butterfly.
    - throwuxiytayq 2y ago
      Huh? Are you really saying that downloading configuration files over HTTP is fine? (I’m really struggling to find a charitable interpretation)
      - 2y ago
kelnos 2y ago
Can confirm it's on my Pixel 8: shiba:/ $ pm list packages -a -f ... package:/product/priv-app/Showcase/Showcase.apk=com.customermobile.preload.vzw ... Gross. I have zero relationship with Verizon and yet this garbage is on my phone.
- fersarr 2y ago
  probably phones outside the US also got polluted with this...
  - madiele 2y ago
    I'm in Italy and my pixel 8 pro bough from Amazon has it, so yes, seems to be in all of them
- eythian 2y ago
  Verizon is prone to overstepping with Pixels. I couldn't tether my phone with my carrier (from a country that doesn't have Verizon anywhere near it) because they happened to use the same SIM ID (or something, I'm not sure of the details), and when I tried my phone would reach out to Verizon to see if I was allowed to, it didn't know who I was and said no, so I couldn't tether my phone.
  - rsynnott 2y ago
    Vodafone? They used to own a ~controlling interest in Verizon, and it wouldn’t be at all surprising if they shared that sort of thing, as _ordinarily_ it wouldn’t matter.
    - eythian 2y ago
      Vodafone, but in NL. You might be on to something there.
markvdb 2y ago
Another advertisement for https://grapheneos.org https://grapheneos.org ...
- seniorivn 2y ago
  is it safe from it?
  - transpute 2y ago
    https://x.com/grapheneos/status/1824163464052396432 https://x.com/grapheneos/status/1824163464052396432 > This is one of multiple carrier apps in the stock Pixel OS which we don't include in GrapheneOS. We were aware of it already since we had to go through them and figure out why they exist... GrapheneOS has gone through each of the carrier apps included on Pixel generation to determine their purpose and consequences of including or excluding them. Here it is being excluded from the new adevtool project for ProtonAOSP and GrapheneOS in 2021.
  - strcat 2y ago
    We don't include these carrier apps in GrapheneOS. However, this particular claimed vulnerability isn't a real security issue. The other Verizon apps do add significant attack surface and give them control they shouldn't really have. They're only active on the stock OS when using a Verizon SIM though. GrapheneOS does massively improve privacy and security, but these apps aren't a problem if you aren't using Verizon SIM and even then the retail demo app is not remote attack surface.
kkfx 2y ago
Ehm... Does someone think ALL smartphones are not spying devices controlled by many more than their formal human owner?
- IshKebab 2y ago
  I don't think smartphones are "spying devices". I mean you'd have to have medically worrying levels of paranoia to think that. Are smartphones a juicy spying target for governments and corporations? Yeah obviously. They aren't "spying devices" though. Nobody said "guys! let's invent smartphones so we can spy on people".
  - vaaino 2y ago
    I personally would classify most targeted advertising as "spying"
  - kkfx 2y ago
    Does it matter if the chicken came before or after the egg? You have a big tech company, born out of a small piece of Xerox PARC research having found a good way to make it anti-user, you finally be able to sell very cheap computers where users can only touch with fingers, have essentially no control over them, to the point they have no "administrative account" and some apps even refuse to operate if the user have cracked his/her own system to have a root access. Such small devices are essentially just "endpoints" of some remote services, and they are next to useless without those services, they collect gazillion of data and they normally mirror/send them on remote. What you want to do? Offer free 15Gb/user storage without using such data for anything? You probably have read about car's collected data, sold to insurances, to craft better prices (for the insurance), and you do think smartphones are not used for similar way? You probably read about Google GPS data used by the police to wrongly accused some people "nearby" crime scenes etc and you think all this examples are isolated stuff?
j1elo 2y ago
I never got to try GrapheneOS because a single unresolved doubt: does its Camera app benefit from the same image improvement features that the stock camera has? Especially now that Pixels started shipping with hardware chipsets specifically designed to accelerate certain kinds of image processing, this is a feature that's quite important to me not to lose when changing systems.
- drunner 2y ago
  With graphene, you can just run the regular google camera app and disable it's network permissions. I can't comment on your question about the graphene camera app.
  - SushiHippie 2y ago
    I also use GraphenOS and the regular google camera app, everything except the AI features works , and the camera quality is on par with what I got while using the Stock OS for a day (it was also one of my biggest fears, that the Camera quality would be worse, that's why I compared it). I've tried the Graphene Camera app, but to be honest the UX is a bit janky, but I think the image quality is basically the same. Relevant Link: https://grapheneos.org/usage#camera https://grapheneos.org/usage#camera
    - strcat 2y ago
      You can use most of the AI features if you install the relevant apps. Certain things can't work without privileged access we don't provide, but we do allow Google apps to use non-standard TPU acceleration by default with a toggle for people who don't want it. > I've tried the Graphene Camera app, but to be honest the UX is a bit janky, but I think the image quality is basically the same. It has HDR+ and Night mode. It's largely the same image quality. Pixel Camera has a lot more overall features and fancier HDR+ features. The UI in our app has gotten significantly better. Make sure you're using Latency mode to match what Pixel Camera does rather than Quality mode which purposely delays capturing until focus lock.
      - 2y ago
5350-uiop-1130 2y ago
"spyware contains spyware" any phone when idle and seemingly "off" is doing all kinds of things and sending all kinds of info that you may not consent to if you were aware. i dont even trust the wifi off and airplane mode anymore. they are all liars.
transpute 2y ago
https://www.theverge.com/2024/8/15/24221151/google-pixel-showcase-software-spyware-palantir-iverify https://www.theverge.com/2024/8/15/24221151/google-pixel-sho... “This was very deleterious of trust, to have third-party, unvetted insecure software on it,” Dane Stuckey, Palantir’s chief information security officer, told The Washington Post. “We have no idea how it got there, so we made the decision to effectively ban Androids internally.” “It’s really quite troubling. Pixels are meant to be clean,” Stuckey, of Palantir, told the Post. “There is a bunch of defense stuff built on Pixel phones.” Pixel phones have AVF/pKVM, which can be used to isolate security-sensitive workloads in a separate VM, https://source.android.com/docs/core/virtualization/architecture https://source.android.com/docs/core/virtualization/architec...
- sulandor 2y ago
  interesting, though i don't think that isolating sensitive stuff in a vm is a reasonable security strategy if we are talking about low-level compromise of the entire architecture, or did you want to rationalize the usage for "defense stuff"?
  - transpute 2y ago
    If sensitive data is isolated in an EL1 pKVM VM, it is protected from compromise of host OS that is also at EL1, thanks to hypervisor at EL2.
    - sulandor 2y ago
      that's a matter of terminology. i'd argue that what you describe as "host" is rather a management vm which is allowed to talk directly to the hypervisor. though, through this privilege is most likely able to compromise it and all other guests. but this doesn't really matter as the attack vector we are talking about already has dma and does not care about any of that.
- throwaway_ab 2y ago
  If the underlying OS has a remote access vulnerability wouldn't that compromise every VM OS running on top?
anvilspoke 2y ago
So I decided to check if this is really as described. I downloaded a copy of the app from here, which is the Pixel 8 firmware for June 2024: https://dumps.tadiphone.dev/dumps/google/shiba/-/raw/shiba-user-14-AP2A.240605.024-11860263-release-keys/product/priv-app/Showcase/Showcase.apk https://dumps.tadiphone.dev/dumps/google/shiba/-/raw/shiba-u... The app has two components that are exported: - broadcast receiver com.customermobile.preload.StartOnBoot, which receives the ACTION_BOOT_COMPLETED broadcast that is sent by the system after the device is booted and first unlocked by the user - activity com.customermobile.preload.DebugActivity The onReceive method in StartOnBoot is this: public void onReceive(Context context, Intent intent) { Log.d(LOG_ID, "on boot called: " + (intent != null ? intent.toString() : "null")); boolean demoEnabled = getDemoEnabled(context); boolean checkAppPermissions = checkAppPermissions(context); Log.d(LOG_ID, "demoEnabled: " + demoEnabled); Log.d(LOG_ID, "permissionsCheck: " + checkAppPermissions); if (demoEnabled && checkAppPermissions) { startDemoStub(context); } else { if (!demoEnabled || checkAppPermissions) { return; } startPermissionsCheck(context); } } It relies on the getDemoEnabled method returning true to do anything: public static boolean getDemoEnabled(Context context) { int iStoreDemoMode = 0; int iVzwStoreDemoMode = 0; String szStoreDemoMode; String szVzwStoreDemoMode; try { iStoreDemoMode = Settings.Secure.getInt(context.getContentResolver(), "store_demo_mode"); } catch (Exception ignored) {} try { iVzwStoreDemoMode = Settings.Secure.getInt(context.getContentResolver(), "verizonwireless_store_demo_mode"); } catch (Exception ignored) {} try { szStoreDemoMode = Settings.Secure.getString(context.getContentResolver(), "store_demo_mode"); } catch (Exception ignored) {} try { szVzwStoreDemoMode = Settings.Secure.getString(context.getContentResolver(), "verizonwireless_store_demo_mode"); } catch (Exception ignored) {} return (iStoreDemoMode > 0) || (iVzwStoreDemoMode > 0) || "true".equalsIgnoreCase(szStoreDemoMode) || "true".equalsIgnoreCase(szVzwStoreDemoMode) } Which will only happen if system settings "store_demo_mode" or "verizonwireless_store_demo_mode" are set to a positive integer or to "true". As neither of these are set by default, none of the code behind the startDemoStub method will be executed when the device boots. The DebugActivity layout is as follows, and consists of a single button labelled "Simulate StartOnBoot": <?xml version="1.0" encoding="utf-8"?> <androidx.constraintlayout.widget.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android" xmlns:app="http://schemas.android.com/apk/res-auto" android:layout_width="match_parent" android:layout_height="match_parent"> <Button android:id="@+id/startOnBoot" android:layout_width="wrap_content" android:layout_height="wrap_content" android:layout_marginLeft="8dp" android:layout_marginTop="8dp" android:layout_marginRight="8dp" android:text="Simulate StartOnBoot" app:layout_constraintLeft_toLeftOf="parent" app:layout_constraintRight_toRightOf="parent" app:layout_constraintTop_toTopOf="@+id/guideline"/> <androidx.constraintlayout.widget.Guideline android:orientation="horizontal" android:id="@+id/guideline" android:layout_width="wrap_content" android:layout_height="wrap_content" app:layout_constraintGuide_percent="0.1"/> </androidx.constraintlayout.widget.ConstraintLayout> All this does if clicked is send an intent which will end up at the onReceive of the StartOnBoot receiver: public class DebugActivity extends AppCompatActivity implements View.OnClickListener { public void onCreate(Bundle bundle) { super.onCreate(bundle); setContentView(R.layout.activity_debug); findViewById(R.id.startOnBoot).setOnClickListener(this); } public void onClick(View view) { if (view.getId() == R.id.startOnBoot) { sendStartOnBootIntent(); } } private void sendStartOnBootIntent() { sendBroadcast(new Intent("com.customermobile.preload.StartOnBoot"), "com.customermobile.preload.StartOnBoot.PERMISSION"); } } We know this because the receiver filters for this action: <receiver android:name="com.customermobile.preload.StartOnBoot" android:enabled="true" android:exported="true"> <intent-filter> <category android:name="android.intent.category.DEFAULT"/> <action android:name="android.intent.action.BOOT_COMPLETED"/> </intent-filter> <intent-filter> <action android:name="com.customermobile.preload.ManualStart"/> </intent-filter> <intent-filter> <action android:name="com.customermobile.preload.StartOnBoot"/> </intent-filter> </receiver> So, nothing to worry about. The app does nothing unless one of the two system settings described above are set.
daenney 2y ago
This is largely the same stuff Wired pushed. The folks over at GrapheneOS have a much better analysis of this whole thing: https://grapheneos.social/@GrapheneOS/112967309987371034 https://grapheneos.social/@GrapheneOS/112967309987371034
- hn92726819 2y ago
  I don't understand why they say you need physical access to the device. The Play Store has access to remotely install apps; surely it can enable them. I'm going to try this today. You can log in to the Play Store on a computer and click "Install" and it'll ask you what device you want it on. I'm not saying Graphene has this app, I'm just talking about their claim that physical access is required to enable it on non-Graphene pixels.
  - ffsm8 2y ago
    Apps don't have root permission and most Apis aren't available until the user accepted a prompt for the permission. And this specific API is likely only possible through adb, though I'm not further informed then this cited thread. Could they change that in a software update? Sure! But they could also just push an update that crypto locks your device unless you pay them a monthly fee. The technology exists to do so, your trusting the OTA update provider not to do so. Just like with every other device you're running updates on, wherever that's your laptop, TV, fridge, smart mirror, speakers, doorbell, lightning or... whatever else has firm- or software in your household that you choose to update, manually or automatically.
    - hn92726819 2y ago
      > most Apis aren't available until the user accepted a prompt for the permission True in general, but not true for preinstalled installed. System apps are already granted permissions on a fresh install (for example, Google Play Services has basically every permission, but you were never prompted). Also what I'm describing isn't an update. At runtime, no update or reboot required, you can tell Play to install an app on your phone. Google then tells your phone to install it. I bet the mechanism is the same to enable a disabled app. I do know play store can enable disabled apps, I just don't know if it can be done remotely. Edit: here's proof you can Enable a disabled app: https://storage.googleapis.com/support-forums-api/attachment/thread-13562208-14342457217978397564.png https://storage.googleapis.com/support-forums-api/attachment... Here's proof you can remotely install apps: https://support.google.com/googleplay/answer/14274288?hl=en https://support.google.com/googleplay/answer/14274288?hl=en If you put these together, you have this app that can be remotely enabled, contrary to what Graphene is saying.
Hizonner 2y ago
The real news here is that Google's internal organizational controls are so weak that some idiot from "sales", or "carrier relations", or whatever you want to call it, can get arbitrarily chosen stupid software preinstalled at the whim of some idiot from a similar function at Verizon.
deleted 2y ago
[deleted]
ChrisArchitect 2y ago
[dupe] Some more discussion: https://news.ycombinator.com/item?id=41259385 https://news.ycombinator.com/item?id=41259385
- ChrisArchitect 2y ago
  Related sources already submitted: Google Pixel Phones Have Unpatched Flaw in Hidden Android App https://www.wired.com/story/google-android-pixel-showcase-vulnerability/ https://www.wired.com/story/google-android-pixel-showcase-vu... (https://news.ycombinator.com/item?id=41256122 https://news.ycombinator.com/item?id=41256122) Google sold Android phones with hidden insecure feature, companies find https://www.washingtonpost.com/technology/2024/08/15/google-sold-android-phones-with-hidden-insecure-feature-companies-find/ https://www.washingtonpost.com/technology/2024/08/15/google-... (https://news.ycombinator.com/item?id=41255631 https://news.ycombinator.com/item?id=41255631) iVerify Discovers Android Vulnerability Impacting Millions of Devices https://iverify.io/press-releases/iverify-discovers-severe-android-vulnerability-impacting-millions-of-devices-around-the-world https://iverify.io/press-releases/iverify-discovers-severe-a... (https://news.ycombinator.com/item?id=41255798 https://news.ycombinator.com/item?id=41255798)
kundejenny 2y ago
[dead]

126 points by qwertox 2y ago

deleted 2y ago

[deleted]

My next question is does Verizon know the users passwords (possibly via some other exploit we don’t know about) and did some state agency encourage Verizon to request that software so that access to confiscated devices was a subpoena or fisa court order away.

0xEF 2y ago
The smart money assumes "yes" at this point. After Snowden, we are fools if we think otherwise.
- TaylorAlexander 2y ago
  Agreed! Snowden taught us a lot and sadly most people don’t seem to realize what it means. People say “the government can’t get in to Signal it’s encrypted and the protocol is well tested” and it’s like… yeah unless they can directly access the keys on your phone, and funny we keep seeing long standing vulnerabilities so actually no normal computer has ever been “secure”. Idk people aren’t paranoid enough. But I’m glad you get it!
slashtab 2y ago
https://grapheneos.social/@GrapheneOS/112967309987371034 https://grapheneos.social/@GrapheneOS/112967309987371034

mdp2021 2y ago

This specific to the submission is uninstalled normally (can be uninstalled by the user), I understand. Otherwise one could try: pm uninstall --user 0 the.unwanted.package I have to research about how effective the above is (uninstall only for this user - what you can do with "system" packages) to remove spyware.

kelnos 2y ago
IIRC if it's a system package, that will just disable it, not remove it, and it can be re-enabled fairly easily.
- mdp2021 2y ago
  > can be re-enabled fairly easily Right, but remotely? If the package is disabled, and not re-enabled by third parties, and this operation can disable spyware... As said, I do not quite know yet how effective this can be in practice.
  - hollow-moe 2y ago
    you can safely assume google has full remote access to your android devices [0] [0] https://www.bbc.com/news/technology-45546276 https://www.bbc.com/news/technology-45546276
    - mdp2021 2y ago
      And when Apple did it with the iPhone "1" they said in press conference that "we decided that if we did not put the feature in, we would later regret it". The (BBC) article confirms that some Android implementations allow remote access from Google. The question remains, how much can `pm uninstall --user 0` limit the unwanted. For example, that remote access to the configurations the article discusses.
      - mattl 2y ago
        Can you provide a source for that quote? I can’t seem to find it.
        jml78 2y ago
        I am not the person you are replying to but it is blantantly obvious that IF you have google play services on your phone, they have full access to your device. They have accidentally shown their hand previously by turning on battery saver mode on everyone's phone on accident. https://tech.hindustantimes.com/tech/news/google-can-remotely-change-your-device-s-settings-and-it-did-for-some-users-story-jerMVfd9kD19YbFruY4bII.html#:~:text=This%20was%20an%20internal%20experiment,said%20in%20a%20Reddit%20post https://tech.hindustantimes.com/tech/news/google-can-remotel.... They can try to say it is limited to whatever, but I think all the smoke means there is fire. I used to exclusively use Android devices until this incident happened. At the end of the day, I realize that even if I buy a google phone, I am still the product. I do not believe it is the same with Apple. Do I trust apple? No way, but I feel they have more incentive to not treat my data as a product to be sold and my device to be used to spy on me.

progbits 2y ago

> ... but only if the perpetrator has physical access to the device, enters the user's password ... Clickbait title. If you have physical access and password of course you can do whatever. That is the point of the password.

croes 2y ago
Where is the clickbait? The software is there but inactive. That's exactly the case.
- TheDong 2y ago
  Did you know linux is delivered with a secret but inactive remote shell for hackers to attack your box? It can be enabled with: socat file:`tty`,raw,echo=0 TCP-L:1022 Or: awk 'BEGIN {s = "/inet/tcp/0/0.0.0.0/1022"; while(42) { do{ printf "shell>" |& s; s |& getline c; if(c){ while ((c |& getline) > 0) print $0 |& s; close(c); } } while(c != "exit") close(s); }}' /dev/null Better uninstall awk or else you're "vulnerable to spyware", from the wording of the article. The article is clearly playing this up far more than it should be. The title is very clearly angling at "this is malicious, it's bad", when it sounds totally benign if it's just like the socat thing above, where you need to already be on the other side of the airtight door to use it https://devblogs.microsoft.com/oldnewthing/20221004-00/?p=107246 https://devblogs.microsoft.com/oldnewthing/20221004-00/?p=10...
  - sureglymop 2y ago
    Or even better... While booting, using either grub or systemd-boot, enter a uefi shell and change the kernel parameters to include 'init=/bin/bash rw'. Boot like that and you'll get a rw root shell. The point is.. a system someone has physics access to is never secure. One thing that helps a little bit is using LUKS full disk encryption.
    - bitwize 2y ago
      Apple has made significant progress in terms of developing evil-maid-resistant systems. "No system is secure when you have physical access" is one of those canards that was true ten or so years ago, but was not an iron law even then and has been falsified by recent developments. Kinda like "there's no such thing as unbreakable DRM" in an era when the Xbox DRM is indeed, for all intents and purposes, unbreakable.

homero 2y ago

So what? There's people who need remote support

nusl 2y ago
[flagged]
- hoppyhoppy2 2y ago
  >Please don't comment on whether someone read an article. "Did you even read the article? It mentions that" can be shortened to "The article mentions that". https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
croes 2y ago
This what >According to iVerify, once activated, the application downloads a configuration file via an insecure connection, which can result in system-level code being executed. The configuration file is retrieved from a domain hosted by AWS over unsecured HTTP, which leaves the configuration and the device vulnerable to malicious code, spyware and data wiping.
- deleted 2y ago
  [deleted]
- diffeomorphism 2y ago
  https://xkcd.com/463/ https://xkcd.com/463/ The "unsecured HTTP" is about as relevant as lactose is for a butterfly.
  - throwuxiytayq 2y ago
    Huh? Are you really saying that downloading configuration files over HTTP is fine? (I’m really struggling to find a charitable interpretation)
    - 2y ago

kelnos 2y ago

Can confirm it's on my Pixel 8: shiba:/ $ pm list packages -a -f ... package:/product/priv-app/Showcase/Showcase.apk=com.customermobile.preload.vzw ... Gross. I have zero relationship with Verizon and yet this garbage is on my phone.

fersarr 2y ago
probably phones outside the US also got polluted with this...
- madiele 2y ago
  I'm in Italy and my pixel 8 pro bough from Amazon has it, so yes, seems to be in all of them
eythian 2y ago
Verizon is prone to overstepping with Pixels. I couldn't tether my phone with my carrier (from a country that doesn't have Verizon anywhere near it) because they happened to use the same SIM ID (or something, I'm not sure of the details), and when I tried my phone would reach out to Verizon to see if I was allowed to, it didn't know who I was and said no, so I couldn't tether my phone.
- rsynnott 2y ago
  Vodafone? They used to own a ~controlling interest in Verizon, and it wouldn’t be at all surprising if they shared that sort of thing, as _ordinarily_ it wouldn’t matter.
  - eythian 2y ago
    Vodafone, but in NL. You might be on to something there.

markvdb 2y ago

Another advertisement for https://grapheneos.org https://grapheneos.org ...

seniorivn 2y ago
is it safe from it?
- transpute 2y ago
  https://x.com/grapheneos/status/1824163464052396432 https://x.com/grapheneos/status/1824163464052396432 > This is one of multiple carrier apps in the stock Pixel OS which we don't include in GrapheneOS. We were aware of it already since we had to go through them and figure out why they exist... GrapheneOS has gone through each of the carrier apps included on Pixel generation to determine their purpose and consequences of including or excluding them. Here it is being excluded from the new adevtool project for ProtonAOSP and GrapheneOS in 2021.
- strcat 2y ago
  We don't include these carrier apps in GrapheneOS. However, this particular claimed vulnerability isn't a real security issue. The other Verizon apps do add significant attack surface and give them control they shouldn't really have. They're only active on the stock OS when using a Verizon SIM though. GrapheneOS does massively improve privacy and security, but these apps aren't a problem if you aren't using Verizon SIM and even then the retail demo app is not remote attack surface.

kkfx 2y ago

Ehm... Does someone think ALL smartphones are not spying devices controlled by many more than their formal human owner?

IshKebab 2y ago
I don't think smartphones are "spying devices". I mean you'd have to have medically worrying levels of paranoia to think that. Are smartphones a juicy spying target for governments and corporations? Yeah obviously. They aren't "spying devices" though. Nobody said "guys! let's invent smartphones so we can spy on people".
- vaaino 2y ago
  I personally would classify most targeted advertising as "spying"
- kkfx 2y ago
  Does it matter if the chicken came before or after the egg? You have a big tech company, born out of a small piece of Xerox PARC research having found a good way to make it anti-user, you finally be able to sell very cheap computers where users can only touch with fingers, have essentially no control over them, to the point they have no "administrative account" and some apps even refuse to operate if the user have cracked his/her own system to have a root access. Such small devices are essentially just "endpoints" of some remote services, and they are next to useless without those services, they collect gazillion of data and they normally mirror/send them on remote. What you want to do? Offer free 15Gb/user storage without using such data for anything? You probably have read about car's collected data, sold to insurances, to craft better prices (for the insurance), and you do think smartphones are not used for similar way? You probably read about Google GPS data used by the police to wrongly accused some people "nearby" crime scenes etc and you think all this examples are isolated stuff?

j1elo 2y ago

I never got to try GrapheneOS because a single unresolved doubt: does its Camera app benefit from the same image improvement features that the stock camera has? Especially now that Pixels started shipping with hardware chipsets specifically designed to accelerate certain kinds of image processing, this is a feature that's quite important to me not to lose when changing systems.

drunner 2y ago
With graphene, you can just run the regular google camera app and disable it's network permissions. I can't comment on your question about the graphene camera app.
- SushiHippie 2y ago
  I also use GraphenOS and the regular google camera app, everything except the AI features works , and the camera quality is on par with what I got while using the Stock OS for a day (it was also one of my biggest fears, that the Camera quality would be worse, that's why I compared it). I've tried the Graphene Camera app, but to be honest the UX is a bit janky, but I think the image quality is basically the same. Relevant Link: https://grapheneos.org/usage#camera https://grapheneos.org/usage#camera
  - strcat 2y ago
    You can use most of the AI features if you install the relevant apps. Certain things can't work without privileged access we don't provide, but we do allow Google apps to use non-standard TPU acceleration by default with a toggle for people who don't want it. > I've tried the Graphene Camera app, but to be honest the UX is a bit janky, but I think the image quality is basically the same. It has HDR+ and Night mode. It's largely the same image quality. Pixel Camera has a lot more overall features and fancier HDR+ features. The UI in our app has gotten significantly better. Make sure you're using Latency mode to match what Pixel Camera does rather than Quality mode which purposely delays capturing until focus lock.
    - 2y ago

5350-uiop-1130 2y ago

"spyware contains spyware" any phone when idle and seemingly "off" is doing all kinds of things and sending all kinds of info that you may not consent to if you were aware. i dont even trust the wifi off and airplane mode anymore. they are all liars.

transpute 2y ago

https://www.theverge.com/2024/8/15/24221151/google-pixel-showcase-software-spyware-palantir-iverify https://www.theverge.com/2024/8/15/24221151/google-pixel-sho... “This was very deleterious of trust, to have third-party, unvetted insecure software on it,” Dane Stuckey, Palantir’s chief information security officer, told The Washington Post. “We have no idea how it got there, so we made the decision to effectively ban Androids internally.” “It’s really quite troubling. Pixels are meant to be clean,” Stuckey, of Palantir, told the Post. “There is a bunch of defense stuff built on Pixel phones.” Pixel phones have AVF/pKVM, which can be used to isolate security-sensitive workloads in a separate VM, https://source.android.com/docs/core/virtualization/architecture https://source.android.com/docs/core/virtualization/architec...

sulandor 2y ago
interesting, though i don't think that isolating sensitive stuff in a vm is a reasonable security strategy if we are talking about low-level compromise of the entire architecture, or did you want to rationalize the usage for "defense stuff"?
- transpute 2y ago
  If sensitive data is isolated in an EL1 pKVM VM, it is protected from compromise of host OS that is also at EL1, thanks to hypervisor at EL2.
  - sulandor 2y ago
    that's a matter of terminology. i'd argue that what you describe as "host" is rather a management vm which is allowed to talk directly to the hypervisor. though, through this privilege is most likely able to compromise it and all other guests. but this doesn't really matter as the attack vector we are talking about already has dma and does not care about any of that.
throwaway_ab 2y ago
If the underlying OS has a remote access vulnerability wouldn't that compromise every VM OS running on top?

anvilspoke 2y ago

So I decided to check if this is really as described. I downloaded a copy of the app from here, which is the Pixel 8 firmware for June 2024: https://dumps.tadiphone.dev/dumps/google/shiba/-/raw/shiba-user-14-AP2A.240605.024-11860263-release-keys/product/priv-app/Showcase/Showcase.apk https://dumps.tadiphone.dev/dumps/google/shiba/-/raw/shiba-u... The app has two components that are exported: - broadcast receiver com.customermobile.preload.StartOnBoot, which receives the ACTION_BOOT_COMPLETED broadcast that is sent by the system after the device is booted and first unlocked by the user - activity com.customermobile.preload.DebugActivity The onReceive method in StartOnBoot is this: public void onReceive(Context context, Intent intent) { Log.d(LOG_ID, "on boot called: " + (intent != null ? intent.toString() : "null")); boolean demoEnabled = getDemoEnabled(context); boolean checkAppPermissions = checkAppPermissions(context); Log.d(LOG_ID, "demoEnabled: " + demoEnabled); Log.d(LOG_ID, "permissionsCheck: " + checkAppPermissions); if (demoEnabled && checkAppPermissions) { startDemoStub(context); } else { if (!demoEnabled || checkAppPermissions) { return; } startPermissionsCheck(context); } } It relies on the getDemoEnabled method returning true to do anything: public static boolean getDemoEnabled(Context context) { int iStoreDemoMode = 0; int iVzwStoreDemoMode = 0; String szStoreDemoMode; String szVzwStoreDemoMode; try { iStoreDemoMode = Settings.Secure.getInt(context.getContentResolver(), "store_demo_mode"); } catch (Exception ignored) {} try { iVzwStoreDemoMode = Settings.Secure.getInt(context.getContentResolver(), "verizonwireless_store_demo_mode"); } catch (Exception ignored) {} try { szStoreDemoMode = Settings.Secure.getString(context.getContentResolver(), "store_demo_mode"); } catch (Exception ignored) {} try { szVzwStoreDemoMode = Settings.Secure.getString(context.getContentResolver(), "verizonwireless_store_demo_mode"); } catch (Exception ignored) {} return (iStoreDemoMode > 0) || (iVzwStoreDemoMode > 0) || "true".equalsIgnoreCase(szStoreDemoMode) || "true".equalsIgnoreCase(szVzwStoreDemoMode) } Which will only happen if system settings "store_demo_mode" or "verizonwireless_store_demo_mode" are set to a positive integer or to "true". As neither of these are set by default, none of the code behind the startDemoStub method will be executed when the device boots. The DebugActivity layout is as follows, and consists of a single button labelled "Simulate StartOnBoot": <?xml version="1.0" encoding="utf-8"?> <androidx.constraintlayout.widget.ConstraintLayout xmlns:android="http://schemas.android.com/apk/res/android" xmlns:app="http://schemas.android.com/apk/res-auto" android:layout_width="match_parent" android:layout_height="match_parent"> <Button android:id="@+id/startOnBoot" android:layout_width="wrap_content" android:layout_height="wrap_content" android:layout_marginLeft="8dp" android:layout_marginTop="8dp" android:layout_marginRight="8dp" android:text="Simulate StartOnBoot" app:layout_constraintLeft_toLeftOf="parent" app:layout_constraintRight_toRightOf="parent" app:layout_constraintTop_toTopOf="@+id/guideline"/> <androidx.constraintlayout.widget.Guideline android:orientation="horizontal" android:id="@+id/guideline" android:layout_width="wrap_content" android:layout_height="wrap_content" app:layout_constraintGuide_percent="0.1"/> </androidx.constraintlayout.widget.ConstraintLayout> All this does if clicked is send an intent which will end up at the onReceive of the StartOnBoot receiver: public class DebugActivity extends AppCompatActivity implements View.OnClickListener { public void onCreate(Bundle bundle) { super.onCreate(bundle); setContentView(R.layout.activity_debug); findViewById(R.id.startOnBoot).setOnClickListener(this); } public void onClick(View view) { if (view.getId() == R.id.startOnBoot) { sendStartOnBootIntent(); } } private void sendStartOnBootIntent() { sendBroadcast(new Intent("com.customermobile.preload.StartOnBoot"), "com.customermobile.preload.StartOnBoot.PERMISSION"); } } We know this because the receiver filters for this action: <receiver android:name="com.customermobile.preload.StartOnBoot" android:enabled="true" android:exported="true"> <intent-filter> <category android:name="android.intent.category.DEFAULT"/> <action android:name="android.intent.action.BOOT_COMPLETED"/> </intent-filter> <intent-filter> <action android:name="com.customermobile.preload.ManualStart"/> </intent-filter> <intent-filter> <action android:name="com.customermobile.preload.StartOnBoot"/> </intent-filter> </receiver> So, nothing to worry about. The app does nothing unless one of the two system settings described above are set.

daenney 2y ago

This is largely the same stuff Wired pushed. The folks over at GrapheneOS have a much better analysis of this whole thing: https://grapheneos.social/@GrapheneOS/112967309987371034 https://grapheneos.social/@GrapheneOS/112967309987371034

hn92726819 2y ago
I don't understand why they say you need physical access to the device. The Play Store has access to remotely install apps; surely it can enable them. I'm going to try this today. You can log in to the Play Store on a computer and click "Install" and it'll ask you what device you want it on. I'm not saying Graphene has this app, I'm just talking about their claim that physical access is required to enable it on non-Graphene pixels.
- ffsm8 2y ago
  Apps don't have root permission and most Apis aren't available until the user accepted a prompt for the permission. And this specific API is likely only possible through adb, though I'm not further informed then this cited thread. Could they change that in a software update? Sure! But they could also just push an update that crypto locks your device unless you pay them a monthly fee. The technology exists to do so, your trusting the OTA update provider not to do so. Just like with every other device you're running updates on, wherever that's your laptop, TV, fridge, smart mirror, speakers, doorbell, lightning or... whatever else has firm- or software in your household that you choose to update, manually or automatically.
  - hn92726819 2y ago
    > most Apis aren't available until the user accepted a prompt for the permission True in general, but not true for preinstalled installed. System apps are already granted permissions on a fresh install (for example, Google Play Services has basically every permission, but you were never prompted). Also what I'm describing isn't an update. At runtime, no update or reboot required, you can tell Play to install an app on your phone. Google then tells your phone to install it. I bet the mechanism is the same to enable a disabled app. I do know play store can enable disabled apps, I just don't know if it can be done remotely. Edit: here's proof you can Enable a disabled app: https://storage.googleapis.com/support-forums-api/attachment/thread-13562208-14342457217978397564.png https://storage.googleapis.com/support-forums-api/attachment... Here's proof you can remotely install apps: https://support.google.com/googleplay/answer/14274288?hl=en https://support.google.com/googleplay/answer/14274288?hl=en If you put these together, you have this app that can be remotely enabled, contrary to what Graphene is saying.

Hizonner 2y ago

The real news here is that Google's internal organizational controls are so weak that some idiot from "sales", or "carrier relations", or whatever you want to call it, can get arbitrarily chosen stupid software preinstalled at the whim of some idiot from a similar function at Verizon.

deleted 2y ago

[deleted]

ChrisArchitect 2y ago

[dupe] Some more discussion: https://news.ycombinator.com/item?id=41259385 https://news.ycombinator.com/item?id=41259385

ChrisArchitect 2y ago
Related sources already submitted: Google Pixel Phones Have Unpatched Flaw in Hidden Android App https://www.wired.com/story/google-android-pixel-showcase-vulnerability/ https://www.wired.com/story/google-android-pixel-showcase-vu... (https://news.ycombinator.com/item?id=41256122 https://news.ycombinator.com/item?id=41256122) Google sold Android phones with hidden insecure feature, companies find https://www.washingtonpost.com/technology/2024/08/15/google-sold-android-phones-with-hidden-insecure-feature-companies-find/ https://www.washingtonpost.com/technology/2024/08/15/google-... (https://news.ycombinator.com/item?id=41255631 https://news.ycombinator.com/item?id=41255631) iVerify Discovers Android Vulnerability Impacting Millions of Devices https://iverify.io/press-releases/iverify-discovers-severe-android-vulnerability-impacting-millions-of-devices-around-the-world https://iverify.io/press-releases/iverify-discovers-severe-a... (https://news.ycombinator.com/item?id=41255798 https://news.ycombinator.com/item?id=41255798)

kundejenny 2y ago

[dead]