Android Devices Can Be Fatally Hacked By Malicious Wi-Fi Networks (arstechnica.com)

An anonymous reader quotes a report from Ars Technica: A broad array of Android phones is vulnerable to attacks that use booby-trapped Wi-Fi signals to achieve full device takeover, a researcher has demonstrated. The vulnerability resides in a widely used Wi-Fi chipset manufactured by Broadcom and used in both iOS and Android devices. Apple patched the vulnerability with Monday's release of iOS 10.3.1. "An attacker within range may be able to execute arbitrary code on the Wi-Fi chip," Apple's accompanying advisory warned. In a highly detailed blog post published Tuesday, the Google Project Zero researcher who discovered the flaw said it allowed the execution of malicious code on a fully updated 6P "by Wi-Fi proximity alone, requiring no user interaction." Google is in the process of releasing an update in its April security bulletin. The fix is available only to a select number of device models, and even then it can take two weeks or more to be available as an over-the-air update to those who are eligible. Company representatives didn't respond to an e-mail seeking comment for this post. The proof-of-concept exploit developed by Project Zero researcher Gal Beniamini uses Wi-Fi frames that contain irregular values. The values, in turn, cause the firmware running on Broadcom's wireless system-on-chip to overflow its stack. By using the frames to target timers responsible for carrying out regularly occurring events such as performing scans for adjacent networks, Beniamini managed to overwrite specific regions of device memory with arbitrary shellcode. Beniamini's code does nothing more than write a benign value to a specific memory address. Attackers could obviously exploit the same series of flaws to surreptitiously execute malicious code on vulnerable devices within range of a rogue access point.

Comments

Wonderful

[JustAnotherOldGuy]

Now all you have to do is connect to wifi and these pricks can screw you. Thanks, Broadcom!

Re:Wonderful

[Anonymous Coward]

Now all you have to do is connect to wifi and these pricks can screw you. Thanks, Broadcom!

It's actually worse than that -- as long as you're in range of the malicious Wi-Fi network, you can be hacked. So, only way to avoid this? Turn off Wi-Fi completely unless you know you're patched.

Re:Wonderful

[Anonymous Coward]

You're still connected to a cell network.

It's vulnerability, but let's be honest here, as much as Apple fans love to tout that it's safer for viruses, that's certainly not the case. Really all that you're doing is increasing the difficulty of hacking a device.

Anything like plugging your device into a USB charging port at the airport is more than enough for a hacker, there's more than enough people walking around connecting to open wifi and using shitty passwords or clicking on links in their email from untrusted sources to cover in a large sweep. But if you're specifically targeted? C'mon man. Some stack overflow is pretty much the least of your problems.

You remember that Android devices have a synced Google account? Oh and Apple isn't terribly better. In fact, with all their custom chip security solutions it's probably worse since you can't patch circuits without replacing them. Much easier to get access to your account and use that to access your device than the other way around. But really, who cares? I can knock a network offline for a brief second, spoof it so you'll reconnect to me, and then bam, now I'm connected MitM.

Re:Wonderful

[Anonymous Coward]

And this is why companies such as Broadcom, Cisco, Qualcomm, Intel, Marvel, (name your favorite chip vendors here) ... who wish to make gazillions on supplying what is increasingly *critical infrastructure*, not just 'fun stuff', need to be compelled via legislation and trade treaties to make their firmware stacks available for audits on a continuing basis by security professionals and subject to binding actions based upon those audits to fix issues as they are found. Fine, they don't have to open-source it all; but they must at least be subject to a independent, impartial council of experts who can have free reign to probe, test and comment on their implementations before deployment. Regulation isn't always a bad thing.

There can be no security which relies on obscurity.

Re:Wonderful

[Anonymous Brave Guy]

This sort of argument gets made every time there is a breach in any proprietary system, but where exactly are you going to find these "security professionals" to carry out detailed audits on entire firmware systems every time someone released a new product? Who's going to pay their bill? What good is a fix from a SoC manufacturer if the suppliers of devices incorporating those SoCs or the networks reselling them don't then supply an OTA update in a timely and secure fashion?

The idea that enough eyes make all bugs shallow might be one of the most dangerous fallacies in computing today, but even if it were true, it would still only be the first step to fixing a problem like this.

Re:Wonderful

[piojo]

So, only way to avoid this? Turn off Wi-Fi completely unless you know you're patched.

Don't forget to turn off wifi+location services integration. Recent versions of Android push you to scan for wifi networks for location services, even when wifi is disabled. So you'll lose location accuracy, in addition to losing wifi.

Re:Wonderful

[Anonymous Coward]

> unless you know you're patched

Which in most cases is going to be... never!

Re:Wonderful

[locofungus]

but where exactly are you going to find these "security professionals" to carry out detailed audits on entire firmware systems every time someone released a new product?

I'm not the OP you're responding to but I would assume the idea was that the chipset manufacturers have to pay for it.

It would make sense for a law to say something like - unless your customers can[1] do the work themselves (i.e. have access to the source code, chipset documentation and build tools) then the company is responsible for doing the work.

[1] where can includes paying someone else to do the work for them.

That way, new releases the company could keep in-house, paying for the auditors, but once it had reached EoL and the company didn't want that liability any more then they could release the information and say "it's up to the customer now"

Re: Wonderful

[Anonymous Coward]

i gues thats why apple is getting into all factions of the develoment with thier products.

Re:Wonderful

[ls671]

to make their firmware stacks available for audits on a continuing basis by security professionals and subject to binding actions based upon those audits to fix issues as they are found.

Well, if this works as well as OpenSSL, at least we could say it is a starting point I guess...

Re: Wonderful

[Anonymous Coward]

you forget linux has funds and lawyers for that matter. that said android uses linux for its kernel and do not forget redhat not to mention all the laas out there and many proprietary tech companies do fund and contribute to linux and others in that indestry and ideology. that does not just go into your weekend warriors and ideologues.

Re:Wonderful

[gsslay]

So you're asking for the security of devices to be validated by people who are "just curious" and as a "hobby"?

I think I'd prefer a full-time professional who has their livelihood at stake in doing a good job, and the time and resources to do it.

BTW, nice air quotes. They have a nice bias shine to them.

They're quotes. As in; quoting the exact words of the post you are replying to.

Re:Wonderful

[Anonymous Coward]

I'm not the OP you're responding to but I would assume the idea was that the chipset manufacturers have to pay for it.

Ah yes, the old argument that manufacturers should pay more from their magical money trees.

The only person that pays for anything is the end consumer, and they've long since proven that they are not willing to pay for any level of security. The only thing that will get them to pay more than the cheapest price is shininess and peer pressure (which is related to the in-vogue definition of shininess).

Re:Wonderful

[monkeyzoo]

It's not actually as bad as all that luckily. From the blog post, the attack can only be performed by another peer on the same wifi network. So at least if you are on a secure, private network, you are safe.

Lastly, as we’ll see later on, triggering these two vulnerabilities can be done by any peer on the Wi-Fi network, without requiring any action on the part of the device being attacked (and with no indication that such an attack is taking place).

Re:Wonderful

[Anonymous Coward]

It can be both. We're not saying it has to be a guy who is paid by corporation X. That's the point. If the product were more open, more things would be fixed more quickly. This isn't a zero-sum game. If we have hobbyists and tech-geeks looking at something, that doesn't mean we exclude highly (sometimes overpriced) security professionals too.

I bet you're the same kind of person who thinks when someone gets rich, another person gets poor.

Re:Wonderful

[Bob the Super Hamste]

I think I'd prefer a full-time professional who has their livelihood at stake in doing a good job, and the time and resources to do it.

While I would like that it sure seems that isn't being done now in any meaningful way. the problem is that costs money that companies could better spend on executive compensation packages, more advertising, and implementation of consumer data gathering technology. Even then the company would need to spend money on fixing any issues the find internally for it to be effective and again there are other priorities. So in absence of that I would settle for the hobby and just curious to do it. Even then my phone that is just over 2 years old won't be getting this patch and even if it did it wouldn't be for like 6 months because that would require Samsung do something about it and then T-Mobile also do something.

Re:Wonderful

[Ol Olsoc]

Now all you have to do is connect to wifi and these pricks can screw you. Thanks, Broadcom!

Slashdotters don't care as long as their hacked phone has a headphone jack.

Re:Wonderful

[Ol Olsoc]

You're still connected to a cell network.

It's vulnerability, but let's be honest here, as much as Apple fans love to tout that it's safer for viruses, that's certainly not the case.

So If I'm getting you straight, this is an Apple problem, not an Android problem.

Apple patched, it, Most Android devices won't/can't. It takes a special level of denial to try to do what you tried to do.Do go on though.

Re:Wonderful

[fustakrakich]

The only person that pays for anything is the end consumer

In that case let's relieve them of their copyrights and patents on the device so that somebody can fix it without being sued.

Re:Wonderful

[mean pun]

The only thing that will get them to pay more than the cheapest price is shininess and peer pressure (which is related to the in-vogue definition of shininess).

I don't know about your country, but in civilised countries we make sure you don't die from eating unhygienic sausages, for example, by making it illegal to sell them, so even consumers that just go for the lowest price are at least somewhat protected. Does this raise prices? Perhaps a bit, but considering the alternative I think this is irrelevant.

Requiring some regulations for the `hygiene' of network hardware makes sense to me, at least as something that is worth considering.

Re:Wonderful

[Anonymous Coward]

And this is why companies such as Broadcom, Cisco, Qualcomm, Intel, Marvel, (name your favorite chip vendors here) ... who wish to make gazillions on supplying what is increasingly *critical infrastructure*, not just 'fun stuff', need to be compelled via legislation and trade treaties to make their firmware stacks available for audits on a continuing basis by security professionals and subject to binding actions based upon those audits to fix issues as they are found. Fine, they don't have to open-source it all; but they must at least be subject to a independent, impartial council of experts who can have free reign to probe, test and comment on their implementations before deployment. Regulation isn't always a bad thing.

There can be no security which relies on obscurity.

It's hilarious listening to people who have never worked in industry state their 5-second "solutions" to the world's problems. I spent several months going through portions of my company's code looking for and fixing security flaws (damn strcpy). We also run the code through multiple analyzers, and hired outside consultants to come in and go over the code with their proprietary tools. Most US companies working on critical infrastructure do something similar. The problems tend to be in standard library code (openssl source is 730K lines). What are your impartial experts going to do?

Re:Wonderful

[gweihir]

Ah, Broadcom. The fuckups of the chip-world. The same morons that deliver the truly bad chip on the Raspberry Pi, with bad USB, no sound, no Ethernet and nobody knows whether the I/O is 5V tolerant or not.

Re:Wonderful

[Anonymous Brave Guy]

The trouble is, we don't know how to make bug-free, perfectly secure software and hardware yet. Requiring the SoC manufacturers to meet a practically impossible standard isn't going to put prices up "a bit", it's going to increase them dramatically, and it's still not going to solve the problem, it's just going to make the luckier insurance companies underwriting those manufacturers a bit richer.

If the idea of better regulation is going to go anywhere useful, it has to push manufacturers and those along the supply chain towards an achievable better position, and it has to do so with a cost that is commercially viable. I'm not sure that's what some of the people posting in this discussion are asking for.

Re:Wonderful

[drinkypoo]

The idea that OSS will get reviewed in a way that "all" bugs are caught is a ridiculous one, and if you see people espouse it, you are correct to mock them. But the idea that code reviews will happen simply because code is owned by a proprietary commercial vendor who has the money to do them would also be ridiculous.

The idea as I understand it is that OSS means that there is the potential for people to catch these bugs while reviewing the code for one reason or another. And if a hole (or bug) is discovered, then it is possible to fix the problem, whether on one's own or by applying money to the problem. When the source is closed, you cannot perform a review, so you cannot find the problems except by attacking the software and you cannot reasonably fix a problem once found. It doesn't make the problem go away, or solve it for you. It simply makes it possible to solve the problem.

Re:Wonderful

[drinkypoo]

I don't know about your country, but in civilised countries we make sure you don't die from eating unhygienic sausages, for example, by making it illegal to sell them, so even consumers that just go for the lowest price are at least somewhat protected.

If the idea of better regulation is going to go anywhere useful, it has to push manufacturers and those along the supply chain towards an achievable better position, and it has to do so with a cost that is commercially viable. I'm not sure that's what some of the people posting in this discussion are asking for.

The standard for food is not that you never ship tainted product. The GP overstated the case when they said they "make sure you don't die from eating unhygienic sausages". The standard for food is that you comply with all applicable safety regulations, and comply with any mandatory recall of any of your products which turn out to be tainted. Ideally you develop a sense about when a recall will be mandatory, and issue one voluntarily before that actually happens. But nobody expects that food will never be tainted. There's no inspection system in the world which would make that possible.

On the other hand, there are no standards being applied before someone can produce software which will communicate on the internet. Perhaps it is time to institute some? Requiring some basic best practices for security (psuedorandomly selected credible search result) would be a start.

Re:Wonderful

[Anonymous Brave Guy]

Yes, I agree with pretty much everything you're saying. I also think it's important to distinguish a theoretical benefit, where it's possible to conduct such a review and possibly to fix problems yourself, from a practical benefit, where someone actually has the time and skills to do that or the time and money to get someone else to do it.

Re:Wonderful

[Anonymous Brave Guy]

Again, it seems we basically agree on this one in principle, but again, I'm perhaps a little wary in practice. When we start talking about regulating software development, and so recognising accepted good practice in some way, that implies that there is someone qualified to judge what good practices actually are and some reasonable basis for determining what the regulations should be. My personal view is that I'm optimistic about the future but we're not there yet.

In particular, suppose we tried to move in that direction tomorrow, or maybe we even went as far as making software development a proper engineering discipline and a licensed profession. I think the kind of people who would find their way into the influential regulatory positions probably would not be the people who were actually best qualified to advise on such issues, not least because they're busy building useful software. Instead, I think you'd get the dreaded consultants -- not the legitimate ones who really do have wide experience and now make a living sharing it to help others, but the ones who are more politician than engineer, engaging speakers and writers, always quick to tell others how they should write software, yet typically having built relatively little of their own and having little actual data to support their recommendations. (I have this vision in my head now of some Extreme Agile Craftsmanship Consultant telling guys who have been writing security-sensitive networking stacks for 30 years how in future they should TDD their way to the basic functionality and then add "security" on later, and as long as the tests are still passing they can just ship right away.)

This isn't to say that the underlying problem is not serious. The idea that everything should be connected and the idea that security and privacy concerns are being adequately addressed by today's market is a terrifying and potentially extremely dangerous combination. As a geek, I'm able to protect myself and my family to some extent by avoiding a lot of the junk, but obviously most people don't have that advantage and general public awareness of the real implications of these modern trends is still disturbingly low.

I wonder whether a useful way forward in the near future would be some sort of voluntary endorsement system to help raise that public awareness. You don't have to absolutely require following lots of specific regulations, but maybe those who can demonstrate that they at least meet some basic, uncontroversial standards get to label their products with some sort of reserved mark, and then maybe customers start asking why some other product doesn't come with, say, a money-back guarantee and extra compensation in the event of certain bad things happening.

Uh

[Anonymous Coward]

If they can connect to it, they can hack it. Period.

Re:Uh

[ls671]

It depends how well know your connection method is. Security by obscurity sometimes work. This is why I use tin can and piano string connectivity to get enhanced security and make my devices harder to connect to:

https://arstechnica.com/civis/...

Re:Uh

[crashumbc]

no encryption?

*gets hook and string*

hacks ls671 :P

Windows mobile

[Anonymous Coward]

Is it time we ask ourselves if the industry would be in a better place if Windows had won in mobile?

Re: Windows mobile

[Anonymous Coward]

The flaw is in the Wi-Fi controller, not the OS. That's why this hit both iOS and Android.

Re:Windows mobile

[ArmoredDragon]

Considering this is a broadcom problem, I don't see what difference it makes in this regard.

However in overall security, I somewhat doubt it:

http://www.computerworld.com/a...

Keep in mind, Windows had a super tiny mobile market share even at the time, and still manages to be responsible for 80% of malware on mobile networks. And yes, windows phone isn't immune, nor are Microsoft's lofty promises about how awesomely secure Edge is:

http://www.tomshardware.com/ne...

Re:Windows mobile

[blackpaw]

Considering this is a broadcom problem, I don't see what difference it makes in this regard.

However in overall security, I somewhat doubt it:

http://www.computerworld.com/a...

Keep in mind, Windows had a super tiny mobile market share even at the time, and still manages to be responsible for 80% of malware on mobile networks.

Bogus clickbait article that is plain wrong. Its counting *Windows PC's* that are connected via mobile data as mobile phones, given the dominance of them in the desktop market and that most virus are targeted at desktop of course they dominate stats.

Given the tiny % of Windows Mobile phones it is obviously quite ridiculous to claim they account for 80% of malware. I'm not aware of any real windows mobile malware.

The vast majority of mobile malware is Android, because of its market dominance, pathetic security model and total lack of security updates.

Re: Windows mobile

[Anonymous Coward]

The flaw is in the Wi-Fi controller, not the OS. That's why this hit both iOS and Android.

That's one flaw. The second necessary flaw is the absence of patches. That mostly hits Android.

Re: Windows mobile

[Anonymous Coward]

In a well-designed system, a flaw in the Wi-Fi controller should not have such critical consequences. Therefore, Tanenbaum was right and Torvalds was wrong. Hopefully, when HURD makes a release, everything will get sorted out.

Re: Windows mobile

[RotateLeftByte]

HURD? A formal release?
I guess that will be around 2050 then....?

Re: Windows mobile

[Anonymous Coward]

More like in {ACTUAL_YEAR+10}.

Re: Windows mobile

[Anonymous Coward]

HURD or Linux shouldn't matter in this case. The exploit uses PCI DMA to corrupt the memory. This is above OS control, unless you use an IO-MMU (I never seen a phone style embedded chip that has it). If they were attacking a device driver on the host then it would matter a lot.

The exploit might also work on SDIO versions of the chip (they run the same firmware), but there is no way to do bus mastering DMA using SDIO so the impact is much smaller (still, a non-persistent worm might be possible).

Re: Windows mobile

[fustakrakich]

No, the OS is at fault. It should be able to protect itself.

Re:Windows mobile

[gweihir]

Well, there are levels in Hell. Android with Broadcom hardware is somewhere in the middle, is my guess, i.e. "truly bad". For Windows Mobile, they would probably have to add a sub-basement to Hell though.

Re:Windows mobile

[ArmoredDragon]

Bogus clickbait article that is plain wrong. Its counting *Windows PC's* that are connected via mobile data as mobile phones, given the dominance of them in the desktop market and that most virus are targeted at desktop of course they dominate stats.

No shit, dumbass. Read what I wrote: "80% of malware on mobile networks"

Given the tiny % of Windows Mobile phones it is obviously quite ridiculous to claim they account for 80% of malware. I'm not aware of any real windows mobile malware.

The vast majority of mobile malware is Android, because of its market dominance, pathetic security model and total lack of security updates.

Honestly, you're buying propaganda from the antivirus industry, which is panicking right now because the desktop market is shrinking along with its consume revenue, and nobody is buying their crap where all of the consumer money is going: Android. So what do they do? Sell you a non-existent problem.

The fact is, 80% of malware on mobile networks is from Windows, of any variety. Let that sink in: Few Windows devices are on Mobile networks, and they still manage to make up the vast majority of malware. Android's security model is pretty damn good considering just anybody can sideload just any app to it, (like Windows USED to be) and if they do so it can have the same permissions as any other app on the Play Store. The Android malware rate in Western markets is less than 0.02% of active devices. In Asian markets, it's upwards of 2%. Why? Two reasons:

1) Asia tends to have a different definition of what is malware and what isn't, so they're more accepting of trojanized applications and don't mind installing them.
2) In many Asian countries, legitimate app stores like Google Play and Amazon are all banned, so everybody relies on pirate app stores.

Even in spite of this, the overall rate of malware infections on Android is under 1%. Even so, you still don't need antivirus software on Android: If you happen to download a trojanized application from the Play store, Google will nix it from your device once it's discovered (you give them permission to do so in the EULA.)

Meanwhile, guess what? In spite of Microsoft using a whitelist security model for Windows Store apps, it STILL has malware, pirated apps, fake apps, etc, in a MUCH higher (relative) number than Google Play does.

proximity alone

[Anonymous Coward]

neither of you read this, did you?

"... by Wi-Fi proximity alone, requiring no user interaction."

Blog post

[93 Escort Wagon]

That was one well-written blog post! Informative, detailed, yet easy to read... and bloody long.

I got a kick out of the fact that this incredibly long blog post is titled "Part 1".

Re:Blog post

[bill_mcgonigle]

I see from the author's blurb that he has significant professional experience. s/blogger/reporter/

It's too bad Broadcomm doesn't seem to. On a 90-day disclosure it looks like they acknowledged the bug with two weeks left to go, asked for an extension, and now it'll be four months before typical users get patches for an exploit that is going to be stealing banking passwords in train stations next Monday (or more interesting data on the BART or DC Metro).

Apple is making a strong case for using its products - not on features, but just by meeting bare-minimum basic competency metrics.

Yes, it's not remotely exploitable like Stagefright, but it's also completely untraceable. Lots of users are seriously screwed.

Re:Blog post

[tommy_traceroute]

Love the post/sig irony!

it's a really good thing

[Anonymous Coward]

that the carriers (who sell the majority of the affected phones) are totally on top of the latest security fixes and always push them out to their customers right away.

Android fucking sucks. It's the new Windows.

[Anonymous Coward]

That is all.

Re:Android fucking sucks. It's the new Windows.

[Anonymous Coward]

how could android be 'the new windows'... they're like the exact opposite of each other.

the new windows updates itself -- constantly. android users mostly never get a single update from their wireless company.

by this metric, ios is 'the new windows', with forced updates right from the source.

Deliberately unfair?

[Anonymous Coward]

The title of this article seems to suggest this is a particularly Android/Google issue. It is an attack on the broadcom firmware.

You know, the broadcom chip family used in pretty much everything? Let me rewrite that headline:

Many devices Using Broadcom Chips Can Be Hacked By Malicious Wi-Fi Networks

(I also cut the sensational "fatally")

Re:Deliberately unfair?

[Anonymous Coward]

The title of this article seems to suggest this is a particularly Android/Google issue.

The Android/Google issue is the patching situation of many Android users.

It is an attack on the broadcom firmware

Which in theory could be patched. Nearly 4 out of 5 iOS users have a patch available right now. How many Android users will ever have a patch available? The patching situation is the real problem, not the firmware flaw.

Re:Deliberately unfair?

[Megane]

How many Android users have ever had a patch available for their device? I have two Android devices (a random cheap tablet I got at Fry's that I don't use, and a cheap smartphone), and they have never had OS updates available. The tablet is stuck on 4.1 (or is it 4.11?), which had some serious vulnerabilities on its own. (heartbleed?) The phone, which I bought less than a year and a half ago, is on 4.4.2.

Re:Deliberately unfair?

[Anonymous Coward]

Then buy from reputable vendors. My Dell tablet got updates until it was discontinued. My Verizon S6 is on Android 6.0.1 and was last updated in January.

Re:Deliberately unfair?

[Anonymous Coward]

And here I am, frustrated that my $150 moto g4 play is still on 6.0.1 and only just got its first security patch, going from Sep '16 to Feb '17 patch level.

Re:Deliberately unfair?

[Megane]

Yeah, that phone on 4.4.2 that I mentioned? It was manufactured by LG, and was sold as a Tracfone starter phone. It may have been one of the last of its generation still on the shelves at the time (not gonna pass up a $10 Android phone with triple minutes for life when I was already looking for a Tracfone), but that still doesn't excuse still being on 4.x for a phone from one of the main smartphone manufacturers. (Not that I expected anything more, I have long been aware of how bad the Android update situation is, and I don't much like using phones in general anyhow. But it works well enough when I do need to check something on the internets.)

LG G5

[Anonymous Coward]

Just checked. My South African LG G5 (H850) has an update available this morning. It is currently running Nougat Hemoroid 7.0.
 
Since am prudent, I will backup everything to my SD card (f u Apple!), factory reset the phone, update to and then restore settings. Best way to avoid bricking or bootloop.

Re:LG G5

[Anonymous Coward]

I wonder how many here would get it...

Re:LG G5

[Anonymous Coward]

Here are the deets:

Version: V20e-MAR-17-2017
Size: 539.62MB

Update summary:
1. Phone usability and functionality has been further improved.
2. Usability improvement through Google patch.

Re:LG G5

[piojo]

factory reset the phone, update to and then restore settings. Best way to avoid bricking or bootloop.

I thought LG phones normally bricked/bootlooped because of poorly manufactured hardware, not settings. At least, that's why mine self-destructed.

Re:LG G5

[Anonymous Coward]

What you are saying is true. I watched the disassembly of LG G6 by Youtuber JerryRigsEverything. In it you can see a copper heatsink which makes a lot of sense for all LGG4 and LGV10 owners. The phone's battery can reach 39.5*C and when pushed hard in gaming or even an intensive virus scan, my laser temperature reader indicated about 50*C to 55*C in top right corner of my LG G5. Clearly if this goes on, unsoldering of (usually) RAM chip (SK Hynix) will occur, and therefore bootloop or worse.

I asked these Bootloop inventors (patent pending) at LG if they could include a Settings option which will let me disable QuickCharge because I don't see myself inserting a copper heat sink in my G5. They said "thank you for the feedback." Just days later I read that there was a US class action lawsuit against these cretins because of G4 and V10 bootloop.

Re: LG G5

[Anonymous Coward]

google is getting better in this area or manu's or discusiing it. non the less you see it a lot more even in mids.

Re:LG G5

[fisted]

You won't desolder shit before it's around 200-300 degC.

Re:LG G5

[Anonymous Coward]

What if it's poorly soldered because chinkies have a mentality of cost cutting rather than pursuing quality?

Re:LG G5

[Anonymous Coward]

Then it would probably fail due to thermal expansion/contraction and cycling. As you appear to be a raging dumbass (blatant racism) I'll explain that in more detail. When things get hot, they expand. When they cool off, they shrink. This causes stress because different parts made of different materials expand differently, and even things made of the same material may heat or cool at different rates or gradients. Repeating this several times can cause small failures in the connections. And then you drop it off your bike.

Re:LG G5

[fisted]

Repeating this several times can cause small failures in the connections

...that have poor solder joints, as AC pointed out. Decent solder joints are strong enough to withstand those thermal cycles.

Please try contributing anything worthwhile to the conversation. Or, even better, just shut the hell up.

Re:LG G5

[Anonymous Coward]

You don't understand "de-solder." What you are saying is that the chip will come loose i.e. de-solder - pins will no longer be soldered to its board.

Amazing how average /. user has dumbed down. Are you an SJW my AC friend?

And long term Linux users go...

[Anonymous Coward]

... Broadcom screws us again... no shit.

Binary blobbism

[Anonymous Coward]

Thanks, Broadcomm, and other binary-blob firmware peddlers, for royally fucking up and not giving a damn.

Re:Binary blobbism

[Anonymous Coward]

Broadcomm doesn't give a shit, Android smartphone manufacturers doesn't give a shit, your operator doesn't give a shit and most users doesn't give a shit either (otherwise they wouldn't buy their smartphones to their operators and anything but Nexus/Google ones)! It's the perfect shitstorm!

This is why BLOBs are a bad idea

[Bruce Perens]

Many driver manufacturers insist on providing BLOBs (binary loadable object files) for drivers to load into their devices, or they have the firmware stored in their devices. What we can't see probably has security errors that we can't fix, but as this shows, the bad guys can find them.

Your system already has backdoors like this. In drivers that load BLOBs and devices that run proprietary firmware, and in the Intel Management Engine.

Re:This is why BLOBs are a bad idea

[piojo]

If they don't use BLOBs, wouldn't that just mean the vulnerabilities are baked into silicon? I thought BLOBs were just a way of abstracting logic from hardware to software. Is the problem that a BLOB is actually being overwritten in a way that isn't possible for logic baked into hardware?

Re:This is why BLOBs are a bad idea

[Anonymous Coward]

The opposite of blobs are auditable source code.

Re:This is why BLOBs are a bad idea

[Anonymous Coward]

That scenario is covered by "or they have the firmware stored in their devices". The real alternative is shipping source code (and build tools) to build those BLOBs.

Re:This is why BLOBs are a bad idea

[Anonymous Coward]

The opposite of blobs are auditable source code.

what does this even mean on dedicated hardware? you are an idiot

Re:This is why BLOBs are a bad idea

[Bruce Perens]

Before you call other folks rude names, read up on gate arrays and the other devices that you are likely to find in dedicated hardware these days. Although these devices are not exactly CPUs, they are programmed, and have source code in a language like verilog.

Re:This is why BLOBs are a bad idea

[Bruce Perens]

If they don't use BLOBs, wouldn't that just mean the vulnerabilities are baked into silicon?

Your device generally includes some sort of CPU, which is usually programmed in C. It might also include a gate-array program, which is written in verilog or VHDL. Backdoors and bugs live in both of these things.

Re: This is why BLOBs are a bad idea

[Anonymous Coward]

Fuck you, Bruce is right.

What have you done lately? Fuck you.

Re: This is why BLOBs are a bad idea

[Anonymous Coward]

Note to self: Shut up.

Re:This is why BLOBs are a bad idea

[Anonymous Coward]

Well, there is your brilliant solution: don't use anything but open sourced hardware. Problem solved guys!

I know, I know. Most hardware is "closed source" but you've already used to an mediocre OS, right? I bet you'll be used to mediocre hardware too in no time!

Re: This is why BLOBs are a bad idea

[Anonymous Coward]

Does anybody else like to read these arguments between ACs as if it's one guy arguing with himself. Gets even more fun imagining that this is a third point of view being interjected from the same individual.

Re:This is why BLOBs are a bad idea

[mrchaotica]

While it's great that you pointed out the problem, I wish that you would also mention the projects that are working on solutions, such as Replicant and Libreboot. The world needs more people working on stuff like that, and you could lend those sorts of projects some of your fame and credibility.

The reaction from the Android manufacturers and ca

[cyber-vandal]

We've got your money now fuck off.

Actually iOS is safer, more likely to get patch

[Anonymous Coward]

... but let's be honest here, as much as Apple fans love to tout that it's safer for viruses, that's certainly not the case ...

Except 79% of iOS users have a patch available right now, 10.3.1. For extreme vulnerabilities such as this, in the past Apple also has updated "obsolete" versions of iOS. So if they provide a hypothetical 9.3.6 they could get coverage to 90%.

In comparison the current version of Android has 2.8% overage, add the previous version and we have 34.1%, go back two "obsolete" versions and we have 66.6%, three "obsolete" versions back (KitKat 4.4) and we get to 87.4% coverage. In theory, in reality most of those old Android phones won't be offered a patch even if Google produced one.

It seems to me that one is safer with iOS, you are more likely to get a patch.

https://developer.apple.com/support/app-store/

https://developer.android.com/about/dashboards/index.html

Re:Actually iOS is safer, more likely to get patch

[Anonymous Coward]

That's what you get when you buy the cheapest piece of shit you can and you only care about specs and numbers. Support isn't free, you know, and if you don't pay for it you won't get it.

Re:Actually iOS is safer, more likely to get patch

[Anonymous Coward]

It seems to me that one is safer with iOS, you are more likely to get a patch.

Alternative explanation, people who buy Apple simply do not hold on to their phones for as long as people who buy Android. I'd be curious to know the spread of hardware iterations (iPhone 7, 6, 5, etc) that encompass your numbers. Does that 79% consist of nothing but the latest version? Does that 90% also consist of nothing but the latest version (because some people didn't want to update)? I don't know. But if you want to convince the people who are already dead-set on Android that you are correct, that is something that you need to provide.

Re:Actually iOS is safer, more likely to get patch

[DontBeAMoran]

Except 79% of iOS users have a patch available right now, 10.3.1.

Is there really 79% of iOS users that have a device that can run iOS 10?

Re:Actually iOS is safer, more likely to get patch

[skids]

No, Apple iOS is just plain safer, I hate to say. Google's turned a blind eye to a lot of android security issues. For example, they are especially bad at enterprise where they can't prevent MITM hacks that expose SSO passwords, Which is why some companies have seaparate WiFi SSIDs where they only alow Windows, Linux (actual distros), OSX and iOS, but keep Android off on its own segment. There was a bug filed for that a decade ago, closed by some numnut, and only slowly has any progress been made towards fixing it. Really Android needs something like a .mobileconfig, and probably, should just make a way to just use Apple mobileconfigs rather than invent their own at this point.

And Android isn't really as open source as a lot of people think, especially now with cyanogenmod closing shop, and given carrier jails.

Re:Actually iOS is safer, more likely to get patch

[demonlapin]

Yep. I've debated switching to an iPhone for a while now. I don't really want to, because iOS frustrates the hell out of me on my iPad (you do it Steve's way, or you don't do it), and because Android has lots of nice little features that iOS doesn't. Simple example: you can make an Android phone act like a USB storage device. Handy, that. Android lets you rename Bluetooth devices, too. My hospital bought a bunch of Bluetooth systems to play music in the operating rooms. They bought the same system for every room. So iOS users, who can't rename paired devices, have a dizzying list of devices with the same name, and good luck figuring out which one is the right device for this room (often will be two or three within range, so you can't just use discovery). I just went in after hours, paired to each one individually, and renamed them "OR 1", "OR 2", etc.

iOS also has the fuck-you features, like the fact that you can't send a group text to more than ten people unless all are iOS users. Why? Because lock-in.

Oh well. I guess I'll last another year or so on my Nexus 6P, and then I'll just bite the bullet. Maybe Apple will fix some of the more annoying things about iOS by then. It only took, what, five or six years for them to put notifications in iOS? And they're still asking carrier permission to activate tethering, which the 6P has never questioned me about at all.

Re:Actually iOS is safer, more likely to get patch

[Anonymous Coward]

Hopefully in Google's next phone platform (may be a few years for it) where ChromeOS and Android are merging, with the OS being more ChromeOS, then patching issues should be much better. My chromebook is awesome with updates, whereas android is rarely updated after the first year release for most of the cheap andriod phones I've used.

Re:Actually iOS is safer, more likely to get patch

[perpenso]

Except 79% of iOS users have a patch available right now, 10.3.1.

Is there really 79% of iOS users that have a device that can run iOS 10?

An iPhone 5 and an iPad (4th gen) released in 2012 are iOS 10 compatible.

A common ARM platform (akin to the x86 platform)

[Artem S. Tashkinov]

We must have it or we're fucked. I've been telling this to Google for years, but they don't seem to be interested. As a result we have literally hundreds of millions of Android devices with dozens of remote vulnerabilities, the devices which aren't supported and cannot be upgraded to anything else. And it's getting worse day by day.

Wireless Worm

[mentil]

I recall years ago, reading about a study which found that unpatched Win XP systems would get pwned in an average of ~5 seconds, once connected to the internet. This was due to old, long-since-patched worms like Blaster and Sasser, that still lived on in unpatchable systems. I imagine in the near future there will be a worm where every pwned device activates its wifi (even if the official wifi setting is set to 'off') and attacks every nearby device. EOL phones will be permanently vulnerable (how many iphones use this Broadcom chip yet are ineligible for iOS 10.3.1?), just like those permanently unpatched WinXP systems. It's an even worse situation on Android devices that are supported for a few months on average.

Ironically people will have to enable wifi in order to download the firmware update to patch this bug, if their OS only allows OS updates via wifi.

Re: Wireless Worm

[Anonymous Coward]

WRT "how many Apple devices can't be patched ? It's probably tens of millions, but all stuff that is 5+ years old. It's possibly they'll release an N-1 or N-2 update with a Broadcom fix in it as well - but they'd not have gone out the gate with that - by patching 10.3 , they have already covered 80+ percent of devices in use (which were alread 10.2.x or 10.3) . A 9 patch would take it over 90 %, and I am pretty sure everything than ran 8 runs 9, so there may be no point in an 8 patch.

The other part of it is making the jump from Wifi processor to Application Processor , it's probably not equal levels of difficulty.

The Broadcom issue may impact laptops & dedktops as well.

Re:Wireless Worm

[AmiMoJo]

As usual though, the risk is blown way out of proportion. For example, the XP issue was trivial to mitigate - just turn on the built in firewall. A lot of people seem to think that the firewall was introduced with Service Pack 2, but actually all that changes what that it was enabled by default.

This vulnerability affects the processor inside the wifi chip. The proof of concept writes data into its memory. This is a separate subsystem to the main phone CPU, with its own RAM and address space. So to use it to do more than temporarily disable wifi until the user disables/re-enables it, further vulnerabilities are required. You would need to exploit the wifi driver in the Android OS, and then from there use a zero-day to escape the driver's process. Android uses defence in depth to make this exceptionally difficult.

I confidently predict that we won't see vast Android botnets being created by passive wifi attack.

Re:Wireless Worm

[Anonymous Coward]

As far as I can recall, even if you installed XP with the network cable unplugged, started the OS, turned on the firewall and then plugged in the cable, you'd still get owned because there was an exception for the SMB port by default in the firewall.

This happened to a friend. He was very careful, did all what I just wrote, and while he was downloading updates from Windows Update, banners began to fill his screen. :-)

Re: Wireless Worm

[Anonymous Coward]

20% is the number. Apple is deliberately, maliciously breaking iOS on 20% of devices to force upgrades. Why claim a conspiracy? Because that 20% is a remarkably constant number. It's a marketing decision, not a pace of technology.

Re:Wireless Worm

[Anonymous Coward]

turned on the firewall and then plugged in the cable, you'd still get owned because there was an exception for the SMB port by default in the firewall.

First, Sasser worm is already gone,because it is blocked by default on almost all routers which runs Linux. Which means your XP is defended by Linux at the router level. Sasser was effective during the dial-up days where your machine is open to the whole internet without a router protecting your LAN.

Second, if there's an SMB port problem in Windows OS, and your XP was attacked from that, then you have a bigger problem because that means some devices on your LAN was infected or pwn'd which in turn attacked your XP machine thru SMB.

Stop the FUD, I won't buy Win8 nor Win10. I am sure Windows OS don't have a big market share, the net counters out there were tricked by browser spoofers and plugins which claims to be Windows machines but in fact are Linux machines under the hood. Techies knows how to mislead the servers just to protect their machines.

Re: Wireless Worm

[Anonymous Coward]

What are you smoking? In your world, a new OS release not being compatible with mobile hardware six years old is 'malicious'?

Re:Wireless Worm

[drinkypoo]

I recall years ago, reading about a study which found that unpatched Win XP systems would get pwned in an average of ~5 seconds, once connected to the internet.

Yeah, don't do that. A firewall solves that problem, unless you've got owned devices on your network. Even then, give it its own VLAN etc.

Re:Wireless Worm

[mentil]

A wifi driver exploit wouldn't be necessary. The wifi chip hack could send/modify packets of data to the device which leads to a malware infection via a different vector. Say, a HTML redirect to a website that contains a jailbreak malware hack. Or whatever other iOS exploit. It can go right through the wifi driver, if packets are expected to be received (and who wants to bet a daemon is always listening). May not work for SSL connections, but it can just wait patiently for an unencrypted connection.

Re: Actually iOS is safer, more likely to get patc

[Albanach]

Google does offer a patch. Android is open source.

Users need to vote with their wallets, refusing to buy from manufacturers who customize Android, usually to the customer's detriment, then fail to commit to monthly security updates.

Re: Actually iOS is safer, more likely to get patc

[Anonymous Coward]

Haha. Good luck with that!

Re: Actually iOS is safer, more likely to get patc

[RotateLeftByte]

Some of Android is Open Source. Please get your facts right.
There are many bits such as the cough-cough Broadcom drivers that are closed source.

Advantage Apple?

[shanen]

Hmm... Small world syndrome? Just now reading Dogfight about the smartphone competition between Apple and the google. Don't tell me how it ends, but I'm already feeling like the author is going to come out against Apple...

However, I think that Apple has the big advantage in fixing security problems precisely because the consumers have so little freedom. I currently have three Android devices and have no idea which of them, if any are vulnerable. It would be worse if my two older phones hadn't died already. On the plus side, I normally leave the WiFi switched off.

Time to look for some funny comments, but I'm not sure I see the potential humor in the topic. Corporate cancerism is no joke, and in this case it means we have no legal defenses. The makers sure ain't liable.

Can attack from any WiFi device, not just APs

[Anonymous Coward]

The attack doesn't require a rogue access point, as it uses a Peer-to-Peer (Ad-Hoc) WiFi protocol. Vulnerable WiFi chipsets can be attacked by any other WiFi device in range.

Re:Can attack from any WiFi device, not just APs

[monkeyzoo]

Not exactly. From the blog post, you can see that the attack can only be performed by another peer on the same wifi network. So at least if you are on a secure, private network, you are safe.

Lastly, as we’ll see later on, triggering these two vulnerabilities can be done by any peer on the Wi-Fi network, without requiring any action on the part of the device being attacked (and with no indication that such an attack is taking place).

Re:Can attack from any WiFi device, not just APs

[Anonymous Coward]

Any device? That explains the extreme-steppage reported on my idle Fit Bit step meter :D
Darn kids & their haxorz!

Can attack from any WiFi device, not just APs

[Xanni]

The attack doesn't require a rogue access point, as it uses a Peer-to-Peer (Ad-Hoc) WiFi protocol. Vulnerable WiFi chipsets can be attacked by any other WiFi device in range.

I might get a update someday

[Anonymous Coward]

Oh yeah, well I might get a update someday on my Android tablet. Well, probably not but I can hope can't I. I have owned it for over a year and think I got one system update about 6 months ago. Consider myself lucky I guess to get that.

Re:The reaction from the Android manufacturers and

[Anonymous Coward]

Yes, it's like that isn't it? Android seems like a OK operating system until you realize the complete lack of support and fragmented update system in place. Then you realize this is the worst designed OS for maintaining a optimum OS that has ever been deployed in devices. People using not so old devices that will never see another update again.

Re:The reaction from the Android manufacturers and

[Anonymous Coward]

Well, for the European market, they have to patch the phones up to two years after the last *sale*. As the problem is a manufacturing defect, customers can return the devices and demand it to be fixed or replaced. Now legally that's a problem for the company that directly sold the product to consumers, not the manufacturer , but you can bet that Vodafone has some leverage over even Samsung.

And since Samsung therefore needs to provide patches anyway, the US market might get them as well. Of course, this applies only to those phones which are sold in the EU. US-only models probably won't get a patch..

Re:The reaction from the Android manufacturers and

[Anonymous Coward]

"People using not so old devices that will never see another update again."

Are idiots.. I bought an Android device and get monthly security patches.

Raspberry Pi / closed source Broadcom

[Anonymous Coward]

I wonder if all these fancy new Raspberry Pi's with closed source Broadcom chips are affected?

Re: Actually iOS is safer, more likely to get patc

[Anonymous Coward]

... Because apple support is ...? Let's be honest. You don't get support from Apple. You get to buy a new phone. The iOS upgrades aren't for you. They're to protect the walled garden. You are the product. Make no mistake.

So let me get this straight...

[Anonymous Coward]

The bug affects both Android and iOS however the headline just somehow happens to be "ANDROID DEVICES Can Be Fatally Hacked By Malicious Wi-Fi Networks" instead of, say, "Smartphones with Broadcom wifi chips can be fatally hacked by malicious wi-fi"

Re: So let me get this straight...

[Anonymous Coward]

Because all Apple hardware that's less than six years old is already in the process of being patched.

Re: Actually iOS is safer, more likely to get patc

[DuckDodgers]

One of the biggest reasons Android conquered mobile was the cheap price. If you wanted to get a $150 smart phone off-contract, you can't get an iPhone, period. Most of us in the tech industry or in comparatively wealthy neighborhoods are walking around with a $600 smart phone. But Android consumed the market because a McDonald's employee could walk into a Best Buy and get a $100 LG Android phone.

So most people can't vote with their wallets. I don't know if this is reliable, but look at the one put together by Android Central for devices receiving security updates last month: http://www.androidcentral.com/... It's horrifying. There are devices on that list that are cheap now, like the Nexus 5. But I don't think anything on that list was below $400 when it launched.

Re: Actually iOS is safer, more likely to get pat

[Anonymous Coward]

No⦠anyone who looks at their numbers knows that Apple customers and data aren't the product. The phone is. They make all their money off hardware sales.

Google sells its customer data and Apple doesn't. Saying that their business model is the same when it plainly isn't is crazy talk.

Apple is open to criticism on many things, but not via "you are the product."

Re: Actually iOS is safer, more likely to get patc

[Ol Olsoc]

Google does offer a patch. Android is open source.

Users need to vote with their wallets, refusing to buy from manufacturers who customize Android, usually to the customer's detriment, then fail to commit to monthly security updates.

Because the Android fan base is more worried about cheap than security. Most don't believe that the phone has any security issues anyhow, so are happy to tout their KungPao 7 Android phone as something superior to the phones those asshole Apple hipsters use.

Hooray for Lineage OS

[drinkypoo]

CM died and begat Lineage OS. And now I'm getting ~weekly updates for my Moto G 2nd, which has of course been left behind by Motorola.

OSS FTW

Re:Hooray for Lineage OS

[viperidaenz]

Does Lineage OS still give you the Moto X gesture features?
Like shake for flashlight, twist for camera, turn on screen when hand approaches?

It was my understanding these are controlled by a secondary processor and the Moto app.

Re:Hooray for Lineage OS

[drinkypoo]

Does Lineage OS still give you the Moto X gesture features?

I don't have a Moto X, so elefino.

Re:Wanted: Perp-walk for Obama, Rice, Clinton

[Anonymous Coward]

Shh, hush little trumpster, don't say a word. Trumpys going to buy you nothing but regret.

.. and this is why

[nightfire-unique]

Things like SElinux, SafetyNet, and (factory-only) locked bootloaders are pointless complexity.

These devices are complicated and security is a process - constant vigilence. It's not a firewall, or a set of complicated access controls. It's education, updates, and constant testing.

Simple rules are easy to understand, and 40 years of experience has shown that it's the best way to make secure code.

Shutup, asshole

[Anonymous Coward]

Every iPhone since the iPhone 5 has this update available. Sorry but the "buy a new smartphone to update your OS" is an Android thing. And be careful, lots of "new" Android smartphones have old Android versions and no updates.

Re: Actually iOS is safer, more likely to get patc

[Anonymous Coward]

Good luck getting a significant portion of people to EVER do that with any product.

Re: Actually iOS is safer, more likely to get patc

[Anonymous Coward]

"iOS also has the fuck-you features, like the fact that you can't send a group text to more than ten people unless all are iOS users. Why? Because lock-in. "

I think that this was implemented originally because of spam and those stupid hoax emails. They didn't want it to spread to texting like it did with email. Apple can lock it down if it's coming thru their network. Where as SMS isn't. iMessage is.

Google Nexus 5 Android 6 -- no patch.

[Anonymous Coward]

It seems to me that one is safer with iOS, you are more likely to get a patch.

Alternative explanation, people who buy Apple simply do not hold on to their phones for as long as people who buy Android. I'd be curious to know the spread of hardware iterations (iPhone 7, 6, 5, etc) that encompass your numbers. Does that 79% consist of nothing but the latest version?

The patch, 10.3.1, is available for all iPhone 5, 6 and 7. All 10.x users, 79%, can get the patch.

Does that 90% also consist of nothing but the latest version (because some people didn't want to update)?

To be clear, that 95% (90% was a typo) includes all 9.x and 10.x users and there is no patch for 9.x yet. Note I referred to a hypothetical 9.3.6 patch, as I referred to hypothetical Android 6, 5 and 4.4 patches. The point was showing how far back, three "obsolete" version for Google versus one for Apple that there needed to be to get "comparable" coverage for users. Now consider the patching situation for the Android 6, 5 and 4.4 users between Google not providing a patch and/or hardware vendors not publishing a patch.

Apple has provided patches for "obsolete" versions in the past for extreme vulnerabilities. Then again, I don't know if iPhone 4 has a vulnerable broadcom chip, maybe 4's are not vulnerable?

I don't know. But if you want to convince the people who are already dead-set on Android that you are correct, that is something that you need to provide.

I purchased Google Nexus devices to mitigate the patch nightmare that is Android. Right now my 2013 Nexus 5 is not offering a patch. A 2012 iPhone 5 has a patch.

Re:Google Nexus 5 Android 6 -- no patch.

[Anonymous Coward]

Same exact boat as you...I have a Nexus 5 (not 5x) purchased just over 3 years ago...no patch. I figured with a Google branded phone, I'd at least avoid some of the lousy long term support issues of manufacturer-branded Android devices...apparently not. My solution: I ordered an iphone, and will be returning to the iOS app environment for the forseeable future. A big ol' slice of the money I spend on apps (~$100/yr?) will no go to Google, Score 1 for Apple. Might try putting lineageOS on the old Nexus and give it to one of my kids.

Re: Actually iOS is safer, more likely to get patc

[thegarbz]

Broadcom drivers...

It's almost like drivers and OSes are two different things.

Re: Actually iOS is safer, more likely to get patc

[Anonymous Coward]

Google does offer a patch.

Right now my 2013 Google Nexus 5 is not offering a patch. A 2012 iPhone 5 has a patch.

stoopid once again.

[Anonymous Coward]

Wei 2 go Beau..

so the title should have been
all devices with this chipset are in trouble..

Apple employs those chips in some of their products, thus your title is LAME, OFF BASE, AND UNINFORMED..

Perhaps it's time to put the Pipe down, and broaden your horizons..
Looking at the world as we know it through such a small lens can be dangerous, esp when driving. You do drive, Right??

Re:stoopid once again.

[viperidaenz]

The summary says Apple use these chips. It also says they've been patched with iOS 10.3.1

Re: Actually iOS is safer, more likely to get patc

[aurispector]

The upside is that most cheap phones are only in service for a year or two at best. Unpatched flaws get thrown away with the phone.

This kind of thing is uninteresting at this point. Flaws are found, patches are issued and the sun rises every morning. I'd like to see good statistics (which are likely impossible to collect) about the amount of real world harm caused by most of them.

Far more damaging is people's own idiotic behavior. We have know about HIV floating around for decades yet people still have unprotected sex with relative strangers all the time. You reap what you sow.

How about Wi-Fi routers?

[Anonymous Coward]

Those Broadcom chips are everywhere. Wi-Fi routers running Broadcom chips are possibly vulnerable too. When was the last time you did a firmware update to the Wi-Fi chipset in your home router? Yeah, me neither.

Which makes me wonder if Qualcomm chips are just as bad.

Re: Actually iOS is safer, more likely to get patc

[Anonymous Coward]

Wrong, ALL of Android is open source.

Drivers and apps are not a part of the OS, dumbass.

Re: Actually iOS is safer, more likely to get patc

[Wulf2k]

It's worse than that.

I actively avoid updates because my carrier uses them to install new, uninstallable crap that I don't want.

And yes, I understand exactly what I'm doing when I don't accept them. I don't bank on my phone, so the worst an attacker could do is get into my social media accounts.

My carrier is a bigger threat to me than this attack.

Hey Lenovo

[viperidaenz]

Are you going to release this security patch? My 2nd gen Moto X is still on the August patch level.

Re: Actually iOS is safer, more likely to get patc

[DuckDodgers]

My suspicion is that it will do more harm as time goes on, even as Google tries to tighten the security. People order things from Amazon, shop on Ebay, and even do banking from their phone. Hacks are going to become more and more profitable.

Re: Actually iOS is safer, more likely to get patc

[Ol Olsoc]

It's worse than that.

I actively avoid updates because my carrier uses them to install new, uninstallable crap that I don't want.

And yes, I understand exactly what I'm doing when I don't accept them. I don't bank on my phone, so the worst an attacker could do is get into my social media accounts.

My carrier is a bigger threat to me than this attack.

Good points, and good move re the banking info.

Re: Actually iOS is safer, more likely to get patc

[sound vision]

What manufacturer would you recommend? I've currently got a $25 no-name Android phone and it does what I need 95% of the time - the only things I feel I can't do on it are highly sensitive things like accessing my e-mail or bank account. I can usually wait to do that until I get back to the house/office, but occasionally it would be convenient to access them from my phone. Probably about once a month. I don't feel comfortable doing it unless I know my phone has been patched.

I'm not willing to pay the Apple tax or anything close to it for this marginal increase in functionality. It needs to be under $100 for sure; my target is more like $60. That's several times the cost of my current phone. I think that should be enough to pay for security updates - unless the market is totally fucked.

Other requirements (and non-requirements):
*Screen: Doesn't need to be huge - 4" is fine. No less.
*Battery life: 24 hours in moderate usage, at least 48 hours idling (connected to network, but not being used). So the spec sheet will probably say "5 days"
*Build quality - Doesn't need to be iPhone-level. At my price point the phone will be replaceable.
*Headphone jack, however, is a must. DAP is one of the primary uses for my phone.
*At least 8 GB of internal storage, OR an SD slot.

Re: Actually iOS is safer, more likely to get patc

[sound vision]

It's almost like you need both of them for a usable phone.

Re: Actually iOS is safer, more likely to get patc

[thegarbz]

Which is entirely irrelevant since the thread is specific to the OS and targeting Google.

Choose your targets. The scattergun approach makes no sense.

What other devices...

[Jakdaw6489]

What other devices are going to be vulnerable to this - there's a hell of a lot of things using Broadcom wifi chipsets.. pretty much everything from Ambarella (so that's GoPros and most of the GoPro alternatives), plus Wifi routers, IoT devices, baby monitors....

Re: Actually iOS is safer, more likely to get patc

[drinkypoo]

There are many bits such as the cough-cough Broadcom drivers that are closed source.

If a driver for shipped hardware is made available to anyone, it should have to be made available to everyone. That doesn't force manufacturers to support hardware past its useful date, or necessarily even to that point, but it would encourage more driver releases that would permit more third parties to roll more custom roms which would subsequently solve more of these problems.