Slashdot Mirror
Millions of Android Devices Are Vulnerable Right Out of the Box (wired.com)
Security meltdowns on your smartphone are often self-inflicted: You clicked the wrong link, or installed the wrong app. But for millions of Android devices, the vulnerabilities have been baked in ahead of time, deep in the firmware, just waiting to be exploited. Who put them there? Some combination of the manufacturer that made it, and the carrier that sold it to you. From a report: That's the key finding of new analysis from mobile security firm Kryptowire, which details troubling bugs preloaded into 10 devices sold across the major US carriers. Kryptowire CEO Angelos Stavrou and director of research Ryan Johnson will present their research, funded by the Department of Homeland Security, at the Black Hat security conference Friday. The potential outcomes of the vulnerabilities range in severity, from being able to lock someone out of their device to gaining surreptitious access to its microphone and other functions. They all share one common trait, though: They didn't have to be there. [...] "The problem is not going to go away, because a lot of the people in the supply chain want to be able to add their own applications, customize, add their own code. That increases the attack surface, and increases the probability of software error," Stavrou says. "They're exposing the end user to exploits that the end user is not able to respond to." Security researchers found 38 different vulnerabilities that can allow for spying and factory resets loaded onto 25 Android phones. That includes devices from Asus, ZTE, LG and the Essential Phone, which are distributed by carriers like Verizon or AT&T.
samsung and others can post roms so you do not need to wait for the carrier rom to be updated.
When a phone comes brand new out-of-the-box with 55% of its space already used it isn't surprising that some of that crapware is causing vulnerabilities!
Yes, let's just keep piling on these alarmist, security-as-a-religion articles. It will only hasten the coming of the post-security world.
Strange things are afoot at the Circle-K.
For trying to bastardize Unix. You go to hell for that, too. :-)
Well, no, just shoddy software and stupid excuses.
Like always.
How smart is your so-called 'smartphone' now, and how smart are (You), losers? You enjoying being part of that botnet? You enjoying having criminals and hackers and Vladimir Putins' cock up your digital ass? Do yourselves a favor: toss that e-waste of a 'phone' into the e-waste bin and get a nice safe dumbphone, or better yet, get a landline, and stop being cucked by your own technology.
In the modern world there is effectively no chance that any device shipped will not ship with a vulnerability. This isn't a statement on software or hardware development merely that given the time it takes to ship goods and that we perpetually find issues across the entire stack of software and hardware having a device land in your hands without a day-0 patch (or perhaps the device will never be patched despite this) is never happen.
It wouldn't surprise me if carrier crapware is particularly poorly written and maintained however.
There fixed the headline for you.
In other news, water is wet and the sun is hot.
Film at 11.
If NSA "customizes" routers meant for foreign customers, why wouldn't Chinese government seek to do something similar? Unlike NSA, they can flat-out order their own companies to do that, while doing something more subtle with the Korean and Taiwanese manufacturers...
And in the world of spying, if someone can, you can bet that they do...
In Soviet Washington the swamp drains you.
Gosh, the carrier-branded phones are the bane of today's computing. They come pre-loaded with dozens of non-deletable apps on top of what's installed by OEM. Their update cycle is ridiculously slow because the ROM updates must go through the carrier's customizing and testing. Normally, they're bootloader locked. As result, most of those are behind the unlocked OEM phones in security patch levels. Just say no.
What a bizarre world we live in where Apple is the only good option.
is the main problem that I see here. This seems a US specific problem, heavy carrier branding and consumers unwilling to buy carrier free devices. In the EU, where most devices don't have any branding, these problems are much less abundent. And on the 2nd hand carrier branded Sony Android device I bought to replace a defective one I could easily flash a neutral firmware.
Of course, after that I rooted it to remove some of the Sony crapware.
Microsoft says "Get on our level!" -- Windows has been vulnerable 'out-of-the-box' since its first release.
See! Manufacturers and carriers can totally be trusted to bake in their own app stores and browsers!
Apparently I've clicked on four articles in one month, so I must renounce my freeloading, ad-veiwing ways and pay for yet another subscription to view the source material for this /. post. Alternative source or it never happened.
What makes matters worse is that phone vendors do not put any effort into updating Android to newer, more secure versions. I think Google needs to take a lead there and just update Android on all devices rather than dump that on the vendors.
What do you suggest as a proper phone?
I devices are instantly unlockable by law enforcement at this point. They come out with security vulns every few months.
Windows phone?