Slashdot Mirror
Google Fixes Rooting Vulnerabilities In Android (csoonline.com)
itwbennett writes: Google released over-the-air firmware updates for its Nexus devices Monday and will publish the patches to the Android Open Source Project (AOSP) repository by Wednesday, fixing a new batch of vulnerabilities in Android that could allow hackers to take over devices remotely or through malicious applications. The new patches address six critical, two high and five moderate vulnerabilities. The most serious flaw is located in the mediaserver Android component, a core part of the operating system that handles media playback and corresponding file metadata parsing.
And everyone else will get these fixes by 2017 if ever?
That means end users will be able to use these to root their devices for the next 12-18 months since the patches won't be applied by most OEM's before then. On the downside it means you can be spearfished through an MMS.
There are 4 boxes to use in the defense of liberty: soap, ballot, jury, ammo. Use in that order. Starting now.
Learn to count.... This one, then: Posted by samzenpus on Tuesday January 05, 2016 @08:12AM from the new-weapon dept Posted by samzenpus on Monday January 04, 2016 @02:41PM from the like-a-sieve dept. So that's 1 a day, and I stopped looking after hitting "older" 4 or 5 times and not finding a single one. So you are complaining about 3 articles from the same source in 3 days? Have you seen the amount of DICE crap on here? Jesus.
Glad I'm an Android. Wouldn't you like to be an Android too?
If I want to read CSO articles I'll just visit it.
You could say that about any Slashdot summary. So why come here at all?
systemd is Roko's Basilisk.
A friend of mine uses an android phone offline. He never connects to the internet and never receives any MMS . He only uses inbuilt apps and text and calling . What is the kind of risk he is exposed to ?
P.S. he is not interested in android updates and is only using an android phone because Nokia went bust.
...Google used APP instead of LUDDITE AOSP!
Apps!
And Google still sucks at life.
The article is about Nexus devices, they are supported for many years.
"The likes of Facebook and WhatsApp are free to those whose privacy is of zero value."
Do not tell that to Nexus S owners. Still, it is good that at least Google keeps promising long term support.
It was so clever of Google to write their own multimedia stack instead of just using one that already existed and had these embarrassingly obvious security holes fixed years ago... In some cases by Google themselves via Chrome.
They just had to do their own incompetent version. When Adobe Flash seems to beat you in security, it would be a good time to think very long and hard about your development process.
Many Android devices have a guaranteed update period of time. eg: 2 years for the Moto G (180$).
Is that two years after you buy one new or just two years after release day? Some carriers sell previous generation phones as entry-level devices. They're "new" in the sense of never having been used since burn-in by the manufacturer, but they're new old stock.
Android is open sores.
First-stage bootloaders often are not. Nor are device drivers on most phones. And that's even without considering Google Play Store/Services.
'many years' meaning ~2 years. There's no updates for Nexus 7 2012 or Nexus 4 devices.
Or don't. If you don't know that 85% of Android devices won't ever get proper security/platform updates due to Phone/Tablet OEMs being completely clueless regarding security then go back to sleep. Phone companies just want to concentrate on billing you as much as possible per GB and Tablet OEMs? Don't get me started on the glut of crappy Android tablets that have been rushed out the door over the years.
A total disservice to a solid OS.
If you wanna get rich, you know that payback is a bitch
I'd like to fix my mediaserver and stagefright. I'd run Cyanogenmod, but Verzion prevents me from using an unsigned kernel.
If I follow these instructions for my Samsung phone, can I pull the mediaserver and stagefright libraries out of the resulting .zip and load them in place of the existing binaries, can I have a running system that closes the exploits? I can likely use the nm utility on the resulting .so and check that all the symbols in the old libraries exist in the new.
The build process appears to pull from both aosp and cyanogenmod, and I understand that aosp Kitkat has been retroactively patched.
Yeah, I love Android but the update policy is atrocious. I'm not for Google gaining an Apple-like control of the OS - I think the enhancements by the OEMs are sometimes valuable - but security updates should definitely be managed in a better way
Do not tell that to Nexus S owners. Still, it is good that at least Google keeps promising long term support.
Google doesn't "keep promising" long-term support. Google has a specific support policy for Nexus devices: Security patches are provided for three years from the date the device goes on sale in the Play Store, or 18 months from the date the last device is sold from the Play Store, whichever is longer. Major upgrades are provided for two years from the date the device goes on sale.
Some may wish those support durations were longer, but AFAIK, Google is the only seller of mobile devices that offers any firm (and legally binding) commitment on updates. In practice, Apple does a reasonably good job with supporting older hardware, but they do not make any commitments.
The Nexus S was released in 2010, so it has been out of support for both security fixes and upgrades for quite some time.
I wasn't aware that U.S. carriers were even allowing international calls by default without letting the subscriber set up and agree to a rate plan for them. Otherwise, an app that takes the dialer permission for itself would just get "This number is blocked."
'many years' meaning ~2 years. There's no updates for Nexus 7 2012 or Nexus 4 devices.
Upgrades for two years. Security updates for three years, or 18 months from the date the device is withdrawn from the Play Store, whichever is longer.
The article is about Nexus devices, they are supported for many years.
Well that's the point isn't it. The updates are available for Nexus devices but the vulnerabilities are in Android...of which the vast majority are not Nexus devices and do not have, and never will have, security updates for these vulns.
blindly antisocialist = antisocial
Why is file metadata parsing and media playback executing as root in the first place?
The article is about Nexus devices
Which is all well and good, but that doesn't change the fact that the vulnerability is a part of Android, hence why Google is also having to push the fixes out to AOSP. As such, while the OP may be trolling a bit, their concern remains a valid one: how many of the handset manufacturers that have utilized a vulnerable version of AOSP will push these fixes out to their handsets?
I have toss my perfectly good Galaxy Nexus into the bin, and buy a new phone? How sweet! The upgrade treadmill is fully operational..
“He’s not deformed, he’s just drunk!”
Just in time! I got the Lolipop update with the Stagefright fix on my Verizon Moto G two months ago.
Since then I was starting to get the DTs from not having any Android vulnerabilities. Thanks all around!
Just to be sure, did you mean ClockworkMod Helium (formerly Carbon), or did you mean Carbonite? I'm guessing Carbonite is responsible for the rename to Helium.
And here's another point: Google made their support promise for Nexus devices legally binding, while other manufacturers, including Apple have not. If you want guaranteed support for some predetermined period, you get a Nexus device, period. If you really don't care about getting updates or security (in which case, shut the hell up already), then you buy something else.
While Apple has generally been good about long term device support, there is nothing indicating that they will continue to be. As my wife is an iPhone user and her and I are both iPad users, I certainly hope the keep it up, but I'll be neither surprised not disappointed if they do not; I knew what I was buying when I bought it.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Nexus 7 2012 and Nexus 4 are not getting security patches, look at the official image build versions, they are not current for lollipop.
The article is about Nexus devices, they are supported for many years.
Well that's the point isn't it. The updates are available for Nexus devices but the vulnerabilities are in Android...of which the vast majority are not Nexus devices and do not have, and never will have, security updates for these vulns.
You get what you pay for. Stop buying cheap piece-of-shit devices.
And here's another point: Google made their support promise for Nexus devices legally binding, while other manufacturers, including Apple have not. If you want guaranteed support for some predetermined period, you get a Nexus device, period. If you really don't care about getting updates or security (in which case, shut the hell up already), then you buy something else.
While Apple has generally been good about long term device support, there is nothing indicating that they will continue to be. As my wife is an iPhone user and her and I are both iPad users, I certainly hope the keep it up, but I'll be neither surprised not disappointed if they do not; I knew what I was buying when I bought it.
Sure, and I knew what I was buying when I got my Android based Marshall music player (which also happens to be a normal Android phone but I chose it for the sound quality so I'm calling it a music player ;-) ), and I accept the fact that it's insecure - which does not mean that I like the fact that it's insecure.
As such, until and unless the Android model changes I'll continue to complain about it as publicly as possible in the hope that enough people will complain to Google that something gets done about it.
blindly antisocialist = antisocial
And Google can do approximately...nothing about it. Google isn't the one realeasing, then not updating, devices.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
And Google can do approximately...nothing about it. Google isn't the one realeasing, then not updating, devices.
Sorry but no.
Google owns the OS, the architecture for the OS and the model of distribution for that OS.
If Google were to abstract the hardware layer from the rest of said OS, allowing hardware vendors to provide only drivers and forcing telephone service providers to not block the distribution of Android then there would be no problem.
The model is broken.
blindly antisocialist = antisocial
Uhm... It's Linux, the hardware layer is abstracted, it does use drivers, and hardware manufacturers need only provide drivers. Also, whether the hardware layer is abstracted from the OS or not has nothing to do with whether or not providers can block distribution of firmware; the manufacturers work out their own contracts under which the carrier sells their devices and the carrier often demands this. Google has no say in a carrier's negotiations with a device manufacturer. My pipe is empty, can you please share some of whatever it is that you're smoking? Seems like some good stuff and I could use a good day trip.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
"My pipe is empty, can you please share some of whatever it is that you're smoking? Seems like some good stuff and I could use a good day trip."
Why do people on this site have to be dicks?
blindly antisocialist = antisocial
If, by that, yku mean why do theh have to spout off about thungs they don't understand, that's a question for you to answer. I've grown tired of trying to educate people and getting shit on for it, so this has become my approach: the pre-emptive attack. Blame your fellow slashdotters for making me this way, because it's a relatively recent development.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
If, by that, yku mean why do theh have to spout off about thungs they don't understand, that's a question for you to answer. I've grown tired of trying to educate people and getting shit on for it, so this has become my approach: the pre-emptive attack. Blame your fellow slashdotters for making me this way, because it's a relatively recent development.
Take responsibility for your own actions.
Have a wonderful day :-D
blindly antisocialist = antisocial
Likewise. You know, for spouting off about shit you don't understand.
APK quotes people (including myself) without context and should not be trusted. Just thought you should know.
Hi Licht,
My mouse failed when I was moderating one of your Windows 10 comments, and I accidentally selected "Redundant" instead of "Insightful". I wanted to let you know, and this was the only way I knew how without undoing my other mods.