A Year in Review of 0-days Exploited In-the-Wild in 2022 | Hacker News Reader

A Year in Review of 0-days Exploited In-the-Wild in 2022

security.googleblog.com

130 pointsarkadiyt46 comments

> These gaps between upstream vendors and downstream manufacturers allow n-days - vulnerabilities that are publicly known - to function as 0-days because no patch is readily available to the user and their only defense is to stop using the device. While these gaps exist in most upstream/downstream relationships, they are more prevalent and longer in Android.

Ouch. Maybe acknowledging it means that they can act on improving that ecosystem with their downstreams?

The delay in updates is what originally pushed me to move from Android to iOS a while back, and years later it’s still an issue. You would think at least Nexus/Pixel would get updates quickly, but that still isn’t always the case. It seems like even within Google there are some issues that need to be addressed before they can lead other manufacturers by example.

Google have been quite irresponsible on some of their own devices too. For example the Chromecast With Google TV is actively being sold (and new product revisions released), yet it is still running Android TV 12 despite 13 coming out in December 2022.

Apparently even they are struggling to update the device because of its lacklustre storage (8GB, only 4.4GB usable) which means there simply isn’t enough space for large OTA updates.

The situation on Android is utterly insane. I bought a Pixel via my carrier a few years back only to find out that my _carrier_ was responsible for software updates, and they held them back so they could add their own bullshit to the OS. I was months waiting for a major Android OS version on a flagship Google device.

While I agree that Google and manufactures needs to do better, the article shows that the amount of detected in the wild zero days are higher for iOS than Android in the newest stat (2022) while it used to be higher for Android.

That's basically because Android nowadays has the absolute bare minimum on the kernel, the rest is updated dynamically

For some reason I read it as if you think that is a bad thing? In my opinion that is how it should be and it is a strength.

I think it's half bad, half good. It would be nicer if we could have a proper upgrade path for the system but this downside pushed some very clever solutions which are making Android the most secure platform which exists right now in my opinion.

The downstream vendors just don’t give a hoot. It’s been more than 10 years now and their behavior hasn’t changed. Google has moved mountains to throw as much as they can into userspace which can be patched by Google directly, but that effort has hit its limits. The rest will just never get better, because phone manufacturers love forced obsolescence, and when any exploit causes a serious issue they can just disingenuously point their finger at Google and say “well they made the software”.

Now hold on.. Google made not just the software but the structure that makes it practical for Google and hardware makers like Qualcomm to get their cake and the vendors to somehow be responsible for the gap it causes when every vendor has to integrate drivers separately into orphans of the Linux kernel.

Many vendors happily joined Android One which Google seems to have silently killed, so I don't think they are that happy losing reputation to sell Android phones they can't properly support.

Not so unhappy that they will stop doing it. They earn their reputations by continuing to bring these poorly supported products to market despite the situation being very well established.

It's not even just downstream vendors. Google itself only supports its devices for three years. I bought a Pixel 4a on release in 2020 and next month will be my last security update.

https://support.google.com/nexus/answer/4457705

Can you imagine if Apple or Microsoft stopped making OS updates for CPUs more than three years old?

They've bumped it up to 5 years for Pixel 6 and later https://support.google.com/pixelphone/answer/4457705#zippy=%...

I was annoyed when the announced 1st gen Ryzen isn't supported in Windows 11.

You can’t expect part time open source contributors to work for free for you. Instead volunteer to take over maintenance by reviewing PRs and traiging user bug reports.

But you still get security fixes for Windows 10 for years to come

I've been using third party ROMs on Pixel 3. They receive monthly security updates to some extent, but obviously the hardware specific "vendor binaries" are still outdated. Frankly, I cared more about the open nature of the ROM than about security/privacy. These days, I assume all my data is available for sale everywhere anyways.

Microsoft Exchange being listed alongside entire operating systems with comparable numbers of ITW vulnerabilities is somewhat something I relate to after running such systems.

Page doesn't seem to load at all on Firefox.

Goog must not. E acknowledging other browsers anymore.

It seems fine on my machine -- albeit a hair slow. Do you have JS enabled? I think it's required.

Same issue, doesn't load on vanilla Firefox.

It loads on Firefox on my Samsung phone.

Loads for me just fine on Firefox 116, on Linux.

Doesn't load for me (FF on Linux).

Are you using an ad blocker? Maybe try disabling your add-ons and reloading.

The site loads fine for me in Firefox 117 (Nightly) on macOS.

Doesn't load for me (115, macOS), but I do have uBlock Origin, which blocks two domains and some "3rd party" scripts. Google will always be Google, and I'm not going to unblock those.

Same for me, it appears that this URL is being blocked by FF. Is that was is causing the issue?

https://2542116.fls.doubleclick.net/activityi;src=2542116;ty...?

uBlock on Edge blocks that same URL and the page works fine without it.

I see that URL being blocked but the site still loads.

I just tested this on v114, v115, and nightly (117.0a1 (2023-07-31) (64-bit)) and couldn't reproduce.

On nightly, I tried setting Enhanced Tracking Protection to strict and installing uBlock Origin, and still couldn't get it to show a blank screen.

(MacOS 13.4.1)

I see the issue on 115.03 on Windows and MacOS.

https://i.imgur.com/XLfgy3K.png

Do you see any failing network requests in devtools, other than the doubleclick one?

No, I do not, FF on Win10: https://i.imgur.com/KfSAp57.png

I should add that on Safari, the content part of the page does take a long time to load or render.

I believe that I see you in the web-bugs issue, so to add more info, here is a safari screenshot with the crazy slow load time. I am getting 52Mbps from fast.com at the moment, rest of the web is snappy. In chrome it takes ~9.25s to finish rendering which is still slow compared to other sites imo.

Safari (MacOS 11.4 on late 2012 Mac Mini): https://i.imgur.com/iNo50sU.png

Also, regarding the comment in the report about it being geo related, I am in central EU, but I tried VPNing to the USA and same result.

I posted on the github thread - it looks like there is a visibilty: hidden; that never gets removed so the page looks blank even though all the elements are there.

Took a while to load in mobile Safari as well, but it did eventually when I waited a while. Interestingly it works almost immediately in desktop Safari?

Loaded fine first time for me

https://github.com/webcompat/web-bugs/issues/125193

FWIW, I filed a bug a few days ago for the issue I was seeing. A profile showed that Firefox was spending all of its time evaluating a regex. Which is weird because Chrome uses the same regex engine. https://bugzilla.mozilla.org/show_bug.cgi?id=1845775

Here's a mirror: https://archive.is/U8YTo

It loads a page with a large heading and no content in my Firefox. I'll just assume an empty page is Google's take on security in general.

It works fine for me on Android

> The Android security team then decided that they considered the issue a “Won’t Fix” because it was “device-specific”. However, Android Security referred the issue to ARM. [...] While ARM had released the fixed driver version in October 2022, the vulnerability was not fixed by Android until April 2023

What's going on there? If bug is in Android's source repo, where it has to be fixed and released by the Android team, it seems like a valid bug in Android. Marking it "Won't Fix" seems inappropriate since they did eventually fix it.

This url gave me https certificate error.

its interesting to see all the "Subject Alt Names" signed in that cert. https://tfhub.dev/google/bird-vocalization-classifier/3 is neat

Reply on news.ycombinator.com