Hacker News Reader

Comment by ams6110 | Hacker News Reader

FTA: The Broadcom chipset contains an MPU, but the researcher found that it's implemented in a way that effectively makes all memory readable, writeable, and executable. "This saves us some hassle," he wrote. "We can conveniently execute our code directly from the heap."

How in this decade, with all we know and have learned about security and exploits, can this kind of thing still happen?

View on HN

How much money will this cost Broadcom? Exactly zero.

So, why should Broadcom care?

Well, I wouldn't say that's true. They could be open to litigation, cost of loss-of-good-faith and therefore losses against competitors.

Not all costs are direct.

That's next quarter. It doesn't affect my bonus. Next problem.

if broadcom is dropped as a supplier, your ass is forfeit though

In fact, they may make money off it, if the only mitigation is to buy a new phone.

This has already been patched via software update.

And the patch has been distributed to 0.5% of people affected.

For android- that is a very good upgrade coverage.

> How in this decade, with all we know and have learned about security and exploits, can this kind of thing still happen?

The software industry has learned a lot about a security and exploits, certainly.

The hardware industry, including embedded developers, well, not so much...

Especially when hardware makers make money off it. I'll need to replace my phone soon, and I'll make an effort to buy something that doesn't use broadcom.

Well good luck with that. As far as I've understood it, there's surprisingly few core HW companies powering the Android mobile ecosystem.

Generic Chinese phones seem to sport either intel or allwinner. Both aren't broadcom.

You could argue that this will be fixed in the next generation broadcom chips. However, do you know what bugs exist in other manufacturers chips?

On the other hand, broadcom is more interesting to attack because there are so much more of them...

Targeted attacks are hard enough to fend off on systems that are fully up-to-date. What chance does an out-of-date locked-down phone have?

If you're not allowed to control and secure your phone yourself, the next best thing is to go with uncommon tech.

Security-by-obscurity seems to be back in fashion :(

I'm also avoiding broadcom as a "vote with my wallet"-type of punishment for being reckless with people's property. If enough people react similarly, broadcom will learn from its mistake. If not, at least I've done my part.

Reply on news.ycombinator.com