Slashdot Mirror
LG G3 'Snap' Vulnerability Leaves Owners At Risk of Data Theft (betanews.com)
Mark Wilson writes: Security researchers have discovered a vulnerability in LG G3 smartphones which could be exploited to run arbitrary JavaScript to steal data. The issue has been named Snap, and was discovered by Israeli security firms BugSec and Cynet. What is particularly concerning about Snap is that it affects the Smart Notice which is installed on all LG G3s by default. By embedding malicious script in a contact, it is possible to use WebView to run server side code via JavaScript. If exploited, the vulnerability could be used to gather information from SD cards, steal data from the likes of WhatsApp, and steal private photos.
When you use javasscript in places it shouldn't, thats what you get. Next up, javascript based self driving cars.
This is, again, why I have an iPhone.
FTFY.
"Go to CNN [for a] spell-checked, fact-checked summary" -- CmdrTaco
Stop using your phone's in-house launcher.
...it should be patched by early February. In the year 2245.
Well, unless you have your G3 on Verizon, then you might just need to leave a note for Buck Rogers so that he can apply the patch. when it comes out.
Is it just my observation, or are there way too many stupid people in the world?
Exactly, that's a nice list of patched vulnerabilities. Every one of those seems to be present in versions prior 9.2.
Considering that the most prevalent version of Android is 4.4 Kit Kat, released in September 2013, this is also why I have an iPhone.
While the G3 may (or may not) get an update to that specific piece of software, there are no guarantees. A similar vulnerability in an iOS would definitely be patched in the newest update.
This is, again, why I have an iPhone
Yes, because no iphone has ever had a security vulnerability, now or in the future. It's impossible, IOS is simply impossible to hack, spoof, or do anything bad to, ever. It just can't be done, there is no way to do it. No one has ever hacked an IOS device and no one ever will. Ever. It's just completely out of the question. The words "vulnerability" and "IOS" should never even be found in the same paragraph, let alone the same sentence. IOS has never had a security vulnerability and never will, updates are strictly there to add exciting new features. Everyone knows that.
Just cruising through this digital world at 33 1/3 rpm...
This is also why I only have a Nexus, most of these security issues are with third party android handsets with most never getting timely updates (Google really needs to fix this issue). I buy a Nexus for the same reason you get an iphone, up_to_date_security_patches. Yes many of you will say "but, but you can use xyz third party android roms and they don't have this issue". The issue with that is android is now mainstream so 98% of android device owners do not have the ability or the knowledge to change the firmware. The fix is simple, Google needs to start enforcing better security policies on companies who want too use the Google android(tm) brand. People are just going to get sick of not having updates and move to GASP! Windows or Apple.
you do realise the security through obscurity theory doesn't work either, there have been cases were there have been black hat hacks for i-devices for months and Apple didn't find out until it became a very public issue.
These are all before 9.2 so have been patched on all devices from the 4S onwards. My Note 2 is still on KitKat and has numerous security vulnerabilities which Samsung don't give a shit about fixing.
That's two words and an up to date CM isn't available for every phone. The version available for my old Note 2 for example is based on KitKat. Even if CM supported every phone 100% that's still no excuse for the manufacturers to abandon their customers. The Note 2 was an expensive flagship phone. It should be getting the same kind of support that iPhones get. That's why I abandoned Android. The only Nexus available at the time was a ridiculously huge 6in one and I wanted one below 5in. For a high spec phone that left me two options: Apple or Sony and I didn't have any faith that Sony would update their handset in a reasonable time.
All they have to do is wait for the user to upload them to facebook.
"Transparent" is a shit show that trades on every stereotype going. A man in drag is NOT a transsexual.
My Note 2 is still on KitKat and has numerous security vulnerabilities which Samsung don't give a shit about fixing.
To be fair, your KitKat Note 2 is using the latest Chromium webview that even Android Marshmallow is using (because Google is doing an end-run around the manufacturer updates for some of its component updates).
I'm not sure why the LG G3 is not doing the same with SmartNotice. It looks like LG G3 is purposefully going out of its way not to use it for its SmartNotice functionality, despite the fact that it is indeed using the right most-up-to-date version of webview for everything else.
Two words : my buddy's LG phone is stuck on Android 4.1 and there appears to be *nothing* else available for it.
Your point is irrelevant. Apple fixes its bugs and provides updates to devices that are over 4 years old. How many 4 year old Android phones are on Marshmallow? My old Note 2 from by far the biggest Android OEM is still on KitKat. I like Android but the fragmentation situation is ridiculous. Just buy a Nexus is a crap answer as well. The OEMs and carriers should be providing these updates in a timely manner but they aren't.
There are many other unpatched bugs. The Note 2 took over a year to get Kitkat and there were no updates in between. It's really poor from the biggest Android OEM.
Your point is irrelevant. Apple fixes its bugs and provides updates to devices that are over 4 years old.
BLASPHEMY!! No Apple product has ever had a security vulnerability, now or in the future. It's impossible. Apple is perfect and godlike, and death to the unbelievers!
Just cruising through this digital world at 33 1/3 rpm...
That one's fixed too.
That one's fixed too.
Thank goodness there will never again be another vulnerability in IOS.
Just cruising through this digital world at 33 1/3 rpm...
And that one too. I can do this all day. Where's the security fixes for my old Note 2 which is newer than the iPhone 4s? Nowhere in sight unless I install a ROM that may or may not support my hardware. The Android ecosystem sucks hard, regardless of the merits of the OS itself (which I like and use). I don't know why you're so ardently defending Samsung / HTC / Sony et al when they don't give a shit about your security. Apple are a bunch of scumbags, but a bunch of scumbags that actually fix their software, rather than leaving their users hanging out to dry.