4 ms·

From the same page: > The vulnerability involves discrepancies in how Android applications are cryptographically verified & installed, allowing for APK code mo

• blinkingled 13y ago
  > (Bugs happen) Yeah that's the point - having a closed device doesn't magically make it more secure. FTA - > Apple iOS devices are considered by many to be more secure than other mobile offerings. Also the Android bug is different class - the vulnerability description doesn't really say what is required to be able to modify the APK in transit which is key to being able to exploit the bug. From the sparse description it sounds like somebody needs to do a SSL MITM or the user needs to install an APK from untrusted source and get fooled into thinking since its signature matches it must be from the original author. (Just to be sure failing to detect APK modification is horrible but whether or not it is easily exploitable is a different thing altogether.) In iOS charger case - it's clear that it's just a matter of plugging in your device to a malicious charger.
  • micampe 13y ago
    Or I can put an APK on the store or on XDA with the exploit already in it.
    • blinkingled 13y ago
      What would that accomplish? User will still need to find your APK, trust you, want your APK for some reason and then install it. Here you are relying on high level of user stupidity. It's not like this bug allows you to login to some other developer's account and replace the original APK.