Slashdot Mirror
Samsung Decides Not To Patch Kernel Vulnerabilities In Some S4 Smartphones
An anonymous reader writes: QuarksLAB, a security research company, has stumbled upon two kernel vulnerabilities for Samsung Galaxy S4 devices, which Samsung has decided to patch only for recent devices running Android Lollipop, but not Jelly Bean or KitKat. The two vulnerabilities (kernel memory disclosure and kernel memory corruption) were discovered in February 2014 and reported to Samsung in August 2014, affecting the samsung_extdisp driver of Samsung S4 (GT-I9500) devices. Bugs break ASLR and lead to denial of service (DoS) state or even elevating attacker privileges.
The number of exploits is increasing exponentially but the vendors are scaling back security patches across the board.
MBA's FTW.
Samsung isn't apple. You can't expect them to patch things more than a year old.
The only way we are going to end up with secure infrastructure. Anyone who sells a product with software should be in the hook for a multiple of the sale price. Unlimited damages if they did knowingly sold something insecure.
Thanks Samsung, you've jsut made that decision pretty easy for me.
What kind of dumbass company is going to spend money porting a new version of an OS to an old platform, with no payday for doing so?
Mobile phone vendors make their money selling new phones. You want a new Android, get a new phone. Your contract will be up in 2 years, and at 18 months, you will be offered a new phone with early renewal, so just wait until the contract is up, re-up the contract, and get the new phone with the fix.
KTHX BAI.
I don't understand why phone manufacturers and carriers don't get sued for things like this. Carriers have typically required two year contracts for phone subsidies, and normally it's possible to buy a phone two years old and get it free. At least that's how it is in the US. That means you can buy a phone that's as much as three years old and have a reasonable expectation to use it for two years because that's the contract with your carrier. That means manufacturers and carriers should provide support for a minimum of five years. That means a phone released in October 2015 should have support until October 2020. I think a customer has a reasonable expectation of this. If nothing else, that should be grounds for a lawsuit against manufacturers and carriers. There's also the issue of delays in fixing vulnerabilities both with the manufacturers and then the carriers. Again, I think there's a reasonable expectation for security updates in a timely manner. Also, when phones ship with locked bootloaders and customers can't choose to unlock them, it makes it very difficult to install a patched version of the OS. This also voids the warranty if you're able to do it. Customers are screwed no matter what they do in this situation, which is why carriers and manufacturers should be sued in the absence of specific laws to protect customers.
I can't help but wonder if the decision to not provide software updates to older phones is partly because people don't see a huge difference between models and this is one way to push people to buy newer and more expensive phones. I can't say it for certain, but it wouldn't surprise me if that's part of the decision process.
M-I-Z
kU still sucks!
the definition of open: "mkdir android ; cd android ; repo init -u git://android.git.kernel.org/platform/manifest.git ; repo sync ; make"
You can just patch your own phone!
This article makes no sense. It says the vulnerability affects the Galaxy S4 but only if you are running an outdated firmware (like Kit kat). However, there is an official (pushed OTA) update to Jelly Bean on this device, so all you have to do to not be vulnerable is apply the update! Same as usual: if you want to avoid vulnerabilities, update your stuff regularly.
These "dumbass" companies have a few more generations of device sales before this becomes a major problem. Then something has to give.
they're to put money in a lawyers pocket and a $5 off your next phone coupon in yours. It'd probably be too hard to sue over something like this. It's too hard for a jury of 50 somethings (who are the only folks that could take 6 months off for the trial) to understand. How's that joke go? 10 people too dumb to get out of jury duty...
Hi! I make Firefox Plug-ins. Check 'em out @ https://addons.mozilla.org/en-US/firefox/addon/youtube-mp3-podcaster/
T-Mobile pulled usual case of not upgrading S4 to Lollipop.
Since it is second phone that I had with them that they did not bother to update - I recommend other vendors.
Considering the current version is fully patched, I don't understand how you would spin this into Samsung not patching kernel vulnerabilities.
"Samsung has decided to patch, but only for recent devices running Android Lollipop, and not for those with Jelly Bean or KitKat."
I want an update for my old SNES. Just because.
Remember when things were sold "as is" and there was no such thing as an "update"?
I do not fail; I succeed at finding out what does not work.
With all the screaming over trademarks (eg Pokemon), are the candy manufacturers ever going to go after Google over Android version names? Kitkat for example is trademarked. Oh hang on, the big swine on the Animal Farm don't sue one another.
iOS is worth recommending, at least to the least technical, if only because Apple *DOES* support it long-term