Slashdot Mirror
Many Enterprise Mobile Devices Will Never Be Patched Against Meltdown, Spectre (betanews.com)
Mark Wilson shares a report from BetaNews: The Meltdown and Spectre bugs have been in the headlines for a couple of weeks now, but it seems the patches are not being installed on handsets. Analysis of more than 100,000 enterprise mobile devices shows that just a tiny percentage of them have been protected against the vulnerabilities -- and some simply may never be protected. Security firm Bridgeway found that just 4 percent of corporate phones and tablets in the UK have been patched against Spectre and Meltdown. Perhaps more worryingly, however, its research also found that nearly a quarter of enterprise mobile devices will never receive a patch because of their age. Organizations are advised to check for the availability of patches for their devices, and to install them as soon as possible. Older devices that will never be patched -- older than Marshmallow, for example -- should be replaced to ensure security, says Bridgeway.
XBox One and PlayStation 4 both use AMD processors, but I haven't heard anyone out-and-out claim a hack is impossible.
I'm waiting for the headline that 0% of enterprise devices are patched against meltdown.
Oh the horror, all those ARM devices that still aren't patched against this Intel bug...
Uhm, my cell phone doesn't have Wifi or a TCP/IP stack of any kind and has some rinky dink Sharp processor running Symbian. You'll need to go stand at the cell tower if you want try hacking it. Good luck. Oh for computing? I use a fucking computer with a real keyboard that I can type 118 WPM on. Face it phones are for chumps. You ain't writing code on that little turd, you're consuming media.
Hey, It's open source so you can always patch it yourself, except YOU CAN'T! lollll
I thought Intel gave up on mobile processors.
But that costs MONEY!!!!!!!!! The stockholders won't like it!
Since installing patched software, I'm suddenly having to charge my phone (pixel) twice a day instead of just at night and the fan on my laptop (quad-core Intel processor / ubuntu 17.10) has been steadily running whereas before I could rarely hear it. It's very annoying.
These "bugs" are going to end up being the biggest windfall processor manufacturers have seen in years. Unless these patches are radically improved, all of these devices are going to need to be replaced much sooner than planned.
The OEM won't even acknowledge that they made the phone after two months so why do you expect they would get things like updates!
Given the mess of patch availability, I wonder how they can sort the cases where patch is not installed, patch is not yet available, and patch will never be available
until the new CPU's are ready.
Use existing junk devices to not talk about your projects, secrets.
Domestic spying is now "Benign Information Gathering"
...more kernel modules for crap we don't need in hopes we forget about this to fix these issues in a timely manner. "Let Windows and Mac fix it while we add VirtualBox module by default in 4.16 release."
Since they refuse to tell us, I assume that the vulnerable processors can only be hacked by someone physically accessing the device and planting malware with a USB stick or cd/dvd.
These vulnerabilities only are problems if other software comes to be run on the system that is compromised, and able to target other apps running on the same device...
For most enterprise devices, they aren't going to be having other apps installed. They probably aren't going to be running anything but company apps, the web browser if at all using company web pages. So it hardly matters if this security issue is present.
On top of that, very probably for most mobile devices and especially older ones with little memory, most applications will be pushed out of memory quickly anyway so there's nothing to scan (and again it would have to be running as well because the vulnerabilities only let you see the contents of processor memory to begin).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
I'm not sure a CPU engineer could formulate a better way to guarantee several billion devices will become obsolete, thereby ensuring huge volumes of future sales.
Meltdown and Spectre are a huge win for numerous manufacturers.... =(
Make a product with a vulnerability that will require buying the a new model in 5-10 years or earlier.
Not true. The oldest iOS device that's affected by this is the iPhone 5 (iPhones prior to that didn't do speculative execution), Apple released a patch for the 5 (and all later devices).
As much as the parent poster tried to make this seem like a reason not to buy Apple, it really is a good reason to buy Apple. Every iOS device affected by these bugs has been patched, including 5 year old ones. There's likely Android devices STILL BEING SOLD that will never be patched.
Try older than Oreo. My Moto X is at Nougat, and I'm not holding my breath for Lenovo ever putting out a support patch for a phone that is over 2 years old. I'll just have to bork my phone to the latest LineageOS, or get a new one.
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon
Incorrect - the iPhone 5 is the oldest iOS device with a CPU that does speculative execution, and it has been patched.
If this is all so dire, where are the attacks?
if every single everything is vulnerable, you're telling me that not one person has a working malware with this yet?
Trust me, if sophos or someone else discovered one, it would be front page news. So i question how big of a deal this really is.
Check out this phone by Cog and HTC: https://cog.systems/htc-secured-by-d4/ which uses virtualization and minimizes a lot of these issues by design because the vpn and its keys (etc) are totally isolated from Android. Plus I think the current one is Cortex-A53 so not impacted by side channel attacks for now. Really cool - I've just ordered one.
C O N S U M E !
Without patching fast, app makers on the play store can take advantage of these holes and install any number of malware. Google doesn't review manually. This will eventually get past their automated checks, and likely hundreds of millions of people will be impacted.
The original press release in full can be found here:
https://www.bridgeway.co.uk/news/articles/only-4-percent-of-enterprise-mobile-devices-are-patched-against-meltdown-spectre-vulnerabilities-shows-latest-research
Looks like it covered both Spectre and Meltdown patches, hence the confusion caused by this article.
HTH
So is production halted, or are the new devices and processors already adapted? They know there us an issue, so are they still selling and producing these faulty items?
Talking about the chip manufacturers, not hardware ones.
Don't fight for your country, if your country does not fight for you.
This must be the largest ever hostage taking and extortionist plan any industry has ever dared on it's clients.
Never mind that, my 1-year-old moto^H^H^H^HLenovo handset still hasn't been patched for the 3-months-old Krack vulnerability, which is way more readily exploitable. And the irony is that I bought that particular brand specifically because it used to have a good track record with patching (before it was taken over...)
Is it even possible to a buy mobile phone with a close-to-vanilla android install that has a realistic prospect of lasting more than a couple of years and get timely patches? I guess this whole industry is waiting for its "early 2000s" moment before changing its attitude...
I prefer using an OS that gives me a sense of ownership. Just strip out GAPPS and sideload the shit you need. When iOS actually allows the phones to operate like the pocket computers they are, I refuse to look at iPhones as nothing more than overpriced toys. Why brag about the fastest processor when there's shit-all you can do with it?
To compromise something like, for example, account credentials, you still have to execute *code* on the computer that takes advantage of the vulnerabilities.
Many (most?) older "enterprise" non-phone devices (think WinCE, Windows Embedded Handheld 8, and yes, Android whatever version) are locked down to a single application anyway, with the users not allowed to install other applications (thus preventing the devices from running the malicious code).
Serious enterprises do MDM and lock down phones. Even without MDM, if you use something like Google for your IdP, you can disallow devices from accessing company accounts if they've been rooted or bootloader-unlocked from the Google Admin console.
I hate BYOD, by the way.
> Older devices that will never be patched -- older than Marshmallow, for example -- should be replaced to ensure security, says Bridgeway.
A Google search reveals it was shown in May, 2015 and stable 6.01 was released in October. So, they're saying anything older than that is compromised.
Nice.
For desktops, it will be AMD from now on -- if Intel did this on purpose, it will cost them dearly; for mobile, I'll have to check, but Asus seem to use Intel, so... no Asus, for starters.
2015 my arse.
I have 4 tablets here at home, running Android 2.1, 4.3, 4.4 and 6.0.
None of these have ever seen a single OS update throughout their entire lifetimes. "Too old"? When I buy a brand new tablet, I'd expect to leave the store, get home, look for updates, and find *something*. But no, these have all been abandonware the moment I've left the store.
I'm done with Android. And I refuse to give Apple a penny. What does that leave me with?
Consider that yet, my Windows Phone, a "dead" platform that has never seen any market share, was already patched a few weeks ago. WTF?