Slashdot Mirror
Poking Holes In Samsung's Android Security
Orome1 writes "Tired of waiting for Samsung to fix a string of critical flaws in their smartphones running Android, Italian security researcher Roberto Paleari has decided to inform the public about the seriousness of the matter and maybe make the company pick up the pace. Mindful of the danger that the vulnerabilities present to the users if they are exploited by malicious individuals, he decided not to share any technical details, but to just give a broad overview of what their misuse would allow. This includes a silent installation of highly-privileged applications with no user interaction and an app performing almost any action on the victim's phone."
The Exynos memory bug (often referred to as ExynosAbuse exploit) was released publicly and fixed rather quickly. This seems to be the way for Samsung - responsible disclosure just doesn't work with them. This has been proven time and again.
I still can't use my phone as a WiFi access point without paying an additional $10-$20 per month.
On the other hand, I doubt that the rhinestone case crowd will care about this much/at all.
I have decided to warn users about a string of critical security flaws in Apple products. They allow an attacker to 0wn your pets, borrow your car one day a week and other terrible things. In the interests of safety I'm not going to detail them in any way or provide any evidence of their existence, just warn you. Take my word for it, they exist and I am in no way trolling Apple fans.
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Say what you will about Apple & the iPhone, but I appreciate the tight integration of OS & hardware and their desire to provide a consistent & reliable user experience. I own and use a (Sprint) Samsung Galaxy S2 Epic 4G Touch, and it was a series of broken promises on ever getting ICS. When finally rolled out, it wasn't the true android experience, but some half-baked Samsung-proprietary interface aka "Touchwiz." Great, that wasn't what I was sold when I purchased the device. I want android, not Samsung's half-baked, bug-filled, garbage-software-filled version of it.
Eventually, I rooted and installed JB, because Samsung sure as heck wasn't going to do that. And then, as you venture deeper into the rooting environment, you find out a bunch of hardware/software issues directly caused by Samsung, including but not limited the EMMC super-brick bug. These security issues in TFA are just more of the same. For me, their handling of their android phones and my experience with them has tarnished their image across their entire product fleet. Will I buy a Samsung brand washer/dryer? There's a lot of digital tech in even washing/drying machines nowadays. Before this, their name wasn't an issue. Now, maybe I consider some other brand.
I swore off Samsung a few years ago when the 2.5 year old HDTV I had paid $1400 for died, and they wanted as much to repair it as a new TV would cost. Their products are shoddily made, and they don't stand behind them. They could produce the snazziest Jesus phone on the market and I wouldn't touch it with a ten foot poleaxe.
No sig? Sigh...
the network carriers approve a security patch seems to be a very, VERY, long time!
Do not use ROMs dependent on the carriers.
"any patches [Samsung] develops must first be approved by the network carriers."
Well there's your problem. if I had to call up my ISP every time I wanted to patch windows I'd be screwed.
When finally rolled out, it wasn't the true android experience, but some half-baked Samsung-proprietary interface aka "Touchwiz."
Lesson learned: If you want a full-baked true Android experience, always look for the word "Nexus".
PCs don't require the user to bring in the computer to have it reprogrammed to use a different ISP. CDMA2000 without CSIM, the typical setup on U.S. prepaid carriers such as Ting and Page Plus, does.
I still can't use my phone as a WiFi access point without paying an additional $10-$20 per month.
That's an ISP problem more than an Android problem. During this transition from 2G to 3G to 4G-lite,* wireless carriers rely on subscribers not using all their monthly megabytes, and subscribers who use multiple devices on one plan tend to use more megabytes per month than subscribers who do not. Even a phone that obeys its owner (that is, one with a custom ROM) can't hide tethering-like behavior unless you run everything through a VPN. Carriers are reported to use traffic to Internet sites that host desktop OS updates, antivirus updates, and desktop application updates as evidence of tethering. By the time you've paid extra for a higher cap and paid extra for a VPN so that the ISP doesn't see what you're visiting, you might as well have paid for the tethering rider.
* "Lite" because LTE isn't really 4G.
you will pay the rest over the course of your contract
What contract? I'm on Virgin Mobile, and despite having paid for a phone up front, I still can't take it to another carrier.
Did someone try and gain attention and publication without providing any actual information? Aww, that's so cute and typical.
Revealing security flaws in Western businesses is automatic jail time lately...
For all the hostility towards Apple, you have to admit that Android isn't really up to the task of just fucking working.
I have things to do and these things do not involve messing around with making my hardware and software work properly.
Enjoy your "freedom of choice", Android fanboys.
Get free satoshi (Bitcoin) and Dogecoins
Let the phone carriers have control over their sandbox, but let me control the rest, like my linux computer. I don't want a flash light application to be able to have access to internet, my phone book, or check book app.
Most users do not have an updated version of Android to update to that is made available from their carriers.
Trend Micro’s mobile app reputation service has analyzed over 2 million mobile app samples collected from around the world and 293,091 of them have been classified as outright malicious. Almost 69,000 of those were sourced directly from Google Play, which offers around 700,000 apps in total. “It’s not just Chinese and Russian app stores.”
Disclaimer: I do not own an iPhone, Android, Blackberry, Windows Phone or any smartphone. I have a "feature phone" with a cheap phone plan.
Procrastination; I'll think of a sig tomorrow.
Every Samsung Phone has had had Touchwiz. Just like HTC uses Sense, and Motorola uses Motoblur.
Not fixing their execution of Android gives them an excuse to replace it with their own proprietary OS (including a locked down boot loader). At the very least, the anti-freedom US carriers would cheer such a move.
it's necessary to root your phone in order to change the hosts file.
Verbum caro factum est
My point is that every way I've seen of avoiding the tethering fee has noticeable drawbacks in cost, TOS, or complexity, and the cost of avoidance could approach the tethering fee itself.