PinePhone Malware Surprises Users, Raises Questions | Hacker News Reader

PinePhone Malware Surprises Users, Raises Questions

hackaday.com

41 pointsCRImier27 comments

This is a particularly weird space because people have generally not been concerned about security in segments unlikely to be profitable to attack: Modder communities have generally been full of hacked or modified apps and operating systems, published by random unknown people all over the world, and generally haven't been that scary, because there's no financial incentive to attack. Attackers are generally looking for a large number of victims or particularly valuable targeted data.

Attacking the PinePhone is... ridiculous... there's almost no reason to do so, with few users, almost none of which who would pay a ransom or who has sensitive state actor data available. And the fact that it's such a useless attack vector is also why nobody had their guard up on executing code there.

"Some men just want to watch the world burn."

> Attacking the PinePhone is... ridiculous...

It serves as a warning: security matters everywhere.

This is it, right here. No one gets a pass, even something that is largely a hobby.

When you execute a random file you got off the internet (even worse, with sudo) you don’t get to complain about the consequences. The rest of the story is pure fluff.

Wanna know how I know you don't support 1000s of normie users?

So glad I don't see this as a presumed badge of honor anymore.

Rather be working on simplifying security/privacy tools for these users, or educating them.

We need a curated list of random files from the internet. awesome-randomfiles anyone?

https://virustotal.com

Android enforces robust sandboxing on all programs, so this would not have happened.

This is the security tradeoff that comes with the standard desktop model of computing, and people should be upfront about it when promoting phones running desktop operating systems

What a horrible sensationalist headline. It reads as if the malware was baked into the PinePhone.

When you read "Linux malware", do you interpret it as "malware baked into Linux"?

In this case, I definitely interpreted it as "baked into PinePhone" like the commenter.

Admittedly the same headline that says "iPhone Malware Surprises Users" would probably read the other way. It depends a bit on the subject. If it said "Lenovo Malware Surprises Users" I'd it expect it baked in too rather than just malware that just effects Lenovos.

"Malware for PinePhone" would make it clearer.

Thank you, I see this viewpoint better now. Not certain I'd make the headline different knowing this, but this is good to keep in mind.

> In this case, I definitely interpreted it as "baked into PinePhone" like the commenter.

Pinephone doesn’t make software, it just makes hardware. It’s philosophy is they make hardware that’s easy to hack. All the software is community maintained and not official.

I also read it as "baked into PinePhone". As to why, well the headline didn't include the fact that the PinePhone ships with no software. So that's not information I had at the time.

Most SBC don’t come with software.

I was wrong the new ones do have software but nothing official, so its not really baked as much as random distros from random people.

Pinephone ships with software, and aside maybe from some early dev units, it always did.

What does it ship with? I don’t thing mine did, and Pine64’s philosophy was we make the hardware, you make the software, aside from PineBook’s KDE edition off the top of my head.

UT, Manjaro, Mobian, pmOS. Even the back covers had logos of what each batch shipped with. Now it's just Manjaro on all the Beta phones.

That they don't write the software doesn't mean they don't ship with it.

Thanks! I don’t remember mine having it but it had been a while, the unlocked bootloader is a security threat that xiaomi had where malware was flashed, so it’s probably a good idea they don’t ship with software for security reasons, it’s such an easy target.

To be fair if I were to read it paired with, 'surprises users' like this headline - I might be prone to assuming an out-of-the-box discovery

Bad news for something I like procedure chart:

"Works on my machine"

Headline sounds sensationalist

*You are here*

Claim author has an agenda

Cite opposing Tweet/blog entry

Cite opposing study from vixra

Cite irrelevant article whose headline seems contradictory

Blame the media

Blame Trump/Biden (or in tech, FAANG)

The pinephone sounds like a fun hobby project, but if you expect kid gloves treatment about it, no one will take it seriously.

FAANG is dead. The New Acronym is MANGA

I like MAMANG, my man.

>apart from obfuscation, the most complex thing about it is that it’s Bash, a language with unreadability baked in.

Hehe take that posix nerds!

Reply on news.ycombinator.com