Slashdot Mirror
900M Android Devices Vulnerable To New 'Quadrooter' Security Flaw (cnet.com)
An anonymous Slashdot reader quotes a report from CNET:
Four newly-discovered vulnerabilities found in Android phones and tablets that ship with a Qualcomm chip could allow an attacker to take complete control of an affected device. The set of vulnerabilities, dubbed "Quadrooter," affects over 900 million phone and tablets, according to Check Point researchers who discovered the flaws. An attacker would have to trick a user into installing a malicious app, which wouldn't require any special permissions. If successfully exploited, an attacker can gain root access, which gives the attacker full access to an affected Android device, its data, and its hardware -- including its camera and microphone.
The flaw even affects several of Google's own Nexus devices, as well as the Samsung Galaxy S7 and S7 Edge, according to the article, as well as the Blackberry DTEK50, which the company describes as the "most secure Android smartphone." CNET adds that "A patch that will fix one of the flaws will not be widely released until September, a Google spokesperson confirmed."
The flaw even affects several of Google's own Nexus devices, as well as the Samsung Galaxy S7 and S7 Edge, according to the article, as well as the Blackberry DTEK50, which the company describes as the "most secure Android smartphone." CNET adds that "A patch that will fix one of the flaws will not be widely released until September, a Google spokesperson confirmed."
Being?
It's like they're the new Microsoft.
The Apple haters will be silent tonight
Eds, why not check the article and link directly to zdnet and not the 'sister' publication?
Does this mean I might get to root my otherwise unrootable phone?
I prefer my devices allow me to do as I wish with the content I already own. I like Android devices a lot better, and I'm someone who does pay for content and apps. I just refuse to do it multiple times.
What the fuck does a bug that requires social engineering and ignorant users installing sketchy software have to do with apple's alleged superiority? I have an iPad that a RARELY use. It has its place in my studio, but I haven't set that up since moving. For everything else, I prefer either my Samsung tablet with a proper screen ratio for reading comics without scrolling, or any of my other Android devices that don't try to nickle and dime me for every single fucking thing I do.
So much for Apple haters being silent.
"Oh my God. This is terrible. This is the end of my Presidency. I'm fucked."; ~ Donald J. Trump
That's what me and my mates called ur mum, she's pretty skilled taking 4 at a time.
Why no SSL to m.slashdot.org?
This is what happens when you put your trust in Google.
This is mostly fear mongering. Now if you could root my phone with an MMS or some other function that does not require me to turn of security features first, then I'll worry.
I will worry about all the cheap chinese tabs and phones that come with sideloading (and malware/crapware) installed by default.
Silence is a state of mime.
you're owned anyways.
what's so special about this? people just hit 'yes' on all permissions on android anyways. am I missing something?
Check Point has an app in the Google Play app store that scans your phone for the vulnerabilities: https://play.google.com/store/...
The Blackphone 2 uses a Qualcomm Snapdragon chip. The maintainers (Silent Circle) released a patch a week ago that 'updates to the latest Qualcomm config files' but it's unclear if that fixes this specific vulnerability.
Corruption is convincing someone that the selfless ideal is the same as their selfish ideal.
Stopped reading after that.
Mundus vult decipi, ergo decipiatur.
"..One hosts to look them up, one DNS to find them, and in the darkness BIND them."
"An attacker would have to trick a user into installing a malicious app"
Is this what slashdot is reduced to, posting bogus pseudo technical quotes from a known Microsoft shill.
FOR THE LOVE OF GOD, EXPLOIT MY BOOTLOADER, MAKE HER VULNERABLE TO ATTACK! For my Verizon Samsung Galaxy S7 remains invulnerable to any attack outside simple root base exploits. Oh script kiddy gods, I BEG YOU (no sarcasm).
So that is what you get from switching away from QNX.
If it doesn't trip knox then someone could retool the exploit to root the phones in a good way.
There's no update, and even if there were it'll come when the providers push it out. With a phone, you just have to accept that if the thing is vulnerable, it is vulnerable. You can't really do anything as a user. Anything you can do is shit you should already be doing like installing apps only from trusted sourced and running a malware scanner.
Just because Android's package format is called "APK" doesn't mean you can use a hosts file. A workaround is to use a firewall app with a DNS filter, and then plug your hosts file into that. I haven't tried NoRoot Firewall to see whether it supports a hosts file, but it does show that a firewall is possible without rooting.
I'm sure the owner does not get root. The attacker just became your parental figure.
So you can root your Android device. Some people think that is a plus.
So why wouldn't checkpoint be exploiting the vulnerability they already discovered and including it in the benign scanner app.
See subject: That'll import a custom hosts file to use on ANDROID easily (does it need to be rooted?)
APK
P.S.=> I think it's hilarious (above ALL else) that ALL THOSE YEARS of /. "FUD" of "Windows != Secure, Linux = Secure" falls RIGHT apart when ANDROID comes around (& yes, it uses a Linux kernel - that surely doesn't make it Windows or MacOS X / iOS etc.)... apk
Find the root image for your device on the XDA developers site.
But hey, at least owners of these devices have a super easy path to root without need to flash any special image.
I think the only way you can possibly make any so-called 'smartphone' secure, is to have a hardware switch that puts the entire phone into 'read only' mode, so nothing new can be installed on it. They're like cheap swisscheese: more holes than cheese. I think I'll just keep sticking with cheap-ass $50 flip-phones. If something happens to it I can break it in half, toss it into the e-waste bin, and go get another one and nothing of value is lost. At least I don't become an unwilling participant in someones bot-net this way.
Are YOU using the TOOL, or is the TOOL using YOU? Think about it!
So yeah, you could say if you put some malicious code on their OS of course it is already spyware so yeah even moreso if you installed this malicious app like some dickhead.
BUT YEAH. YES. FBI ON SLASHDOT GOT THIS OUT THERE.
Fuck you FBI. Dead spies.
See subject: I've done the ADB procedure I noted a few times for pals (who had rooted phones like op has https://mobile.slashdot.org/co... OR it sounds like he might @ least...)
APK
P.S.=> Some ANDROID builds don't use HOSTS (Google's SCARED SHITLESS of it, ala KitKat as an 'example thereof') - but in the end? All "smartphones" are TRULY "DUMBPHONES" due to ANDROID being exploited FULL OF HOLES FOR DECADES NOW almost DAILY... they're damn toys - DANGEROUS ONES @ that - & what I call "electric dogcollars" @ times (what I used to call beepers I had to wear decades ago while on the job as a 'wageslave')... apk
I've had enough with the newest vulnerability to fuck up my life. I quit this shit. I'm throwing away my smartphone, my smartTV, my smartHome, my smartWristband, my computers, my car. Back to the stoneage for me. Off teh grid. No vulnerabilities. good bye
What you do is use your phone as needed and don't explain to each other how to kill the nearest backstab spy on your phone.
Use post-it notes.
post-it notes, dark of night, and ice pick.
You CAN access the file system on your iOS device. That being said, you HAVE to KNOW what you are doing and this is as it should be; you do not want your children to have the same access to the file system you do because, in as much as they know how, knowing when and why makes more of a difference. You can do a large number of things that Android people can but it is a different way of thinking because the system is rigged against anyone who knows just enough to get into trouble. Apple wants you to either not bother learning and use the intuitive interface (and it is so good that Samsung pays Apple to use all manner of elements from it; just that, lacking iOS experience, you might not know which came first) or learn enough so that if the problem you were trying to solve was a map, you would know the adjacent sheets -good practice anyway.
Downloading an MP3 or a ringtone is not hard but installing takes a side trip to a desktop machine; moreover, it is obviously easier on a Mac. I download images all the time and in the olden days before photos synced everything, I would text them to myself (effectively producing a backup copy on the phone) or emailing them to myself which, while not providing the backup, did allow me to remove the content from storage on the phone --well, there is still, sort of a backup, the sent folder in my iCloud account but that is not physically on the phone. You can also get a PDF of a journal article and treat it in a similar manner.
So many people with Android phones speak with vile hatred of iOS devices without actually knowing iOS or its benefits that in being so busy expressing their unexplainable hatred of (IBM way back when, then it was Lotus or WordStar, then Microsoft, and now, it is Apple's turn) corporation X, they demonstrate a lack of exposure at the least and a petulant disregard or disdain for anything that might be done better or easier on an Apple device. I have used and continue to use both (in no small part due to Samsung and T-Mobile policies) and there are things that are done better by one or the other. The owners of Android phones, much like the owners of a WinTel box running some sort of windows, have a high tolerance for system failures and bugs. iOS and Mac users, accustomed to their device "just working" have a significantly lower tolerance for defects or instability. Thus, your iPhone might not have the latest hardware (IPS vs OLED) but it has been tested to the point that one would be hard pressed to fine a condition Apple has not already exposed the device. Waterproof? I have seen iOS devices soaked for hours spend a fraction of a day in rice and turn on like nothing happened and I have seen supposedly waterproof Android phones fry themselves. However, the most irksome to me remains the all too frequent restarts on Android vs just TWO restarts in the entire time I've own my iOS device. Certainly, that has to give someone a bit of pause.
Owning a Google phone or a Blackberry device is not the same as being adrift in the other side of the Android world. For all intents and purposes, the corporate entity is no different in so far as being a gigantic and faceless monstrosity whose behavior harkens back to a time of unrestrained, unrepentant, and most of all, abusive capitalism. That behavior is only restrained (rather than constrained which implies limits rather than barriers) by governmental efforts driven (when enough people scream, even politicians listen) by sufficient public outcry. Not everyone that purchases an iOS device is unable to code or repair their own hardware and not everyone that clamors for the latest device that uses Android is an absolute tech geek. However, one glaring difference exists and that is this: Apple demands and gets compliance from the carriers so that an update is available to all iPhone owners at once without regards to carrier. Google can only do anything similar -and they do not- with their own phones. For the rest of the Android world, a mishmash of manufacturers and carriers spend time blaming one a