Slashdot Mirror
Many Enterprise Mobile Devices Will Never Be Patched Against Meltdown, Spectre (betanews.com)
Mark Wilson shares a report from BetaNews: The Meltdown and Spectre bugs have been in the headlines for a couple of weeks now, but it seems the patches are not being installed on handsets. Analysis of more than 100,000 enterprise mobile devices shows that just a tiny percentage of them have been protected against the vulnerabilities -- and some simply may never be protected. Security firm Bridgeway found that just 4 percent of corporate phones and tablets in the UK have been patched against Spectre and Meltdown. Perhaps more worryingly, however, its research also found that nearly a quarter of enterprise mobile devices will never receive a patch because of their age. Organizations are advised to check for the availability of patches for their devices, and to install them as soon as possible. Older devices that will never be patched -- older than Marshmallow, for example -- should be replaced to ensure security, says Bridgeway.
Uhm, my cell phone doesn't have Wifi or a TCP/IP stack of any kind and has some rinky dink Sharp processor running Symbian. You'll need to go stand at the cell tower if you want try hacking it. Good luck. Oh for computing? I use a fucking computer with a real keyboard that I can type 118 WPM on. Face it phones are for chumps. You ain't writing code on that little turd, you're consuming media.
I beleive that AMD devices are vulnerable too.
Since installing patched software, I'm suddenly having to charge my phone (pixel) twice a day instead of just at night and the fan on my laptop (quad-core Intel processor / ubuntu 17.10) has been steadily running whereas before I could rarely hear it. It's very annoying.
These "bugs" are going to end up being the biggest windfall processor manufacturers have seen in years. Unless these patches are radically improved, all of these devices are going to need to be replaced much sooner than planned.
The OEM won't even acknowledge that they made the phone after two months so why do you expect they would get things like updates!
I beleive that AMD devices are vulnerable too.
AMD chips are only vulnerable to Specter which isn't nearly as valuable. Meltdown is the crown jewel of hardware flaws.
Anons need not reply. Questions end with a question mark.
Given the mess of patch availability, I wonder how they can sort the cases where patch is not installed, patch is not yet available, and patch will never be available
Some ARM CPUs are also vulnerable.
until the new CPU's are ready.
Use existing junk devices to not talk about your projects, secrets.
Domestic spying is now "Benign Information Gathering"
Meltdown? On my smartphone? It's more likely than you think.
Yeah, but the beta news article does nothing to lead me to believe that there's any check if vulnerability for the 100,000 devices analyzed.
I'm curious what percentage of the too old ones are actually vulnerable?
What percentage of the rest?
They didn't link to a source, and they never said the analysis was of vulnerable devices.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
The only ARM chip that is vulnerable to Meltdown is the not yet released A75 (co-designed by intel). Meltdown is an Intel bug.
These vulnerabilities only are problems if other software comes to be run on the system that is compromised, and able to target other apps running on the same device...
For most enterprise devices, they aren't going to be having other apps installed. They probably aren't going to be running anything but company apps, the web browser if at all using company web pages. So it hardly matters if this security issue is present.
On top of that, very probably for most mobile devices and especially older ones with little memory, most applications will be pushed out of memory quickly anyway so there's nothing to scan (and again it would have to be running as well because the vulnerabilities only let you see the contents of processor memory to begin).
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Use your head. The only password truly vulnerable is the one to the Xbox account. You don't need to bork the console to just make it harder for a login sequence be vulnerable to a cache read.
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon
Percentage? it's 100% of x86 with speculative execution which is everything after 586. If it's x86 and made in the last two decades then it's vulnerable to Spectre. If it's x86 by Intel and made after 1995 then it's vulnerable to Meltdown. There are no percentages here.
Anons need not reply. Questions end with a question mark.
Actually you can. But you're going to lose all those proprietary blobs of binary used to run the camera or manage your phone call packets to audio.
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon
Not true. The oldest iOS device that's affected by this is the iPhone 5 (iPhones prior to that didn't do speculative execution), Apple released a patch for the 5 (and all later devices).
As much as the parent poster tried to make this seem like a reason not to buy Apple, it really is a good reason to buy Apple. Every iOS device affected by these bugs has been patched, including 5 year old ones. There's likely Android devices STILL BEING SOLD that will never be patched.
Try older than Oreo. My Moto X is at Nougat, and I'm not holding my breath for Lenovo ever putting out a support patch for a phone that is over 2 years old. I'll just have to bork my phone to the latest LineageOS, or get a new one.
There is no America. There is no democracy. There is only IBM and AT&T and DuPont, Dow, General Electric, and Exxon
Incorrect - the iPhone 5 is the oldest iOS device with a CPU that does speculative execution, and it has been patched.
How are you going to load exploit code onto a closed system?
Yeah, I misread, or posted on the wrong comment.
The article still makes me wonder how many enterprise mobile devices are actually vulnerable, almost certainly very few of the too old to be patched set.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
they could be using intel chipped phones.
though I really doubt it. never sold well.
also, ANY older than marshmallow phone has probably a dozen ways to gain root on it, so it doesn't even matter.
world was created 5 seconds before this post as it is.
Are those AMD CPUs, or just AMD graphics? Also, what data do you have on your X-Bone that someone would be interested in compromising? Is it typical to have credit card information saved to it? I haven't bought a game console since the PS2.
C O N S U M E !
Unplanned obsolescence!
The early Intel Atoms aren't vulnerable as they didn't do speculative execution and are closer to 10 years old.
https://en.wikipedia.org/wiki/...
https://en.wikipedia.org/wiki/Inverted_totalitarianism
So is production halted, or are the new devices and processors already adapted? They know there us an issue, so are they still selling and producing these faulty items?
Talking about the chip manufacturers, not hardware ones.
Don't fight for your country, if your country does not fight for you.
Never mind that, my 1-year-old moto^H^H^H^HLenovo handset still hasn't been patched for the 3-months-old Krack vulnerability, which is way more readily exploitable. And the irony is that I bought that particular brand specifically because it used to have a good track record with patching (before it was taken over...)
Is it even possible to a buy mobile phone with a close-to-vanilla android install that has a realistic prospect of lasting more than a couple of years and get timely patches? I guess this whole industry is waiting for its "early 2000s" moment before changing its attitude...
It looks like they released the patch to phones that weren't affected.
http://allaboutwindowsphone.co...
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
To compromise something like, for example, account credentials, you still have to execute *code* on the computer that takes advantage of the vulnerabilities.
Many (most?) older "enterprise" non-phone devices (think WinCE, Windows Embedded Handheld 8, and yes, Android whatever version) are locked down to a single application anyway, with the users not allowed to install other applications (thus preventing the devices from running the malicious code).
Serious enterprises do MDM and lock down phones. Even without MDM, if you use something like Google for your IdP, you can disallow devices from accessing company accounts if they've been rooted or bootloader-unlocked from the Google Admin console.
I hate BYOD, by the way.