Hacker News Reader

Comment by spxneo | Hacker News Reader

It's probably far worse with Android users that Google is not disclosing.

I'm seriously considering changing to Apple after this. Not that its secure but that they are willing to go to this length to communicate it.

View on HN

> I'm seriously considering changing to Apple after this.

Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these exploits, and the various unicode/pdf etc rendering engines are responsible in many exploits. Android's open-source nature likely means that a lot of these things are found by security researchers first. Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day.

Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful.

you changed my mind successfully thank you

but what about dumb phones from late 2000s like my Samsung Alias 2? what kind of sick bastard would make zero days for this

for those you don't need 0days. you can use 360*20days just fine. it's like there was any firmware update for them ever.

I can never pass up an opportunity to mention Justine Haupt’s Rotary Un-Smartphone.

Buy: https://skysedge.com/telecom/RUSP/index.html

Story: https://www.justine-haupt.com/rotarycellphoneinfo/index.html

Edit: wait, was she not able to get it certified? Does it really say it won’t connect to a US network?

Oh,

> This is a regulatory approval issue which will take time to resolve.

weird why wouldn't it work with US networks...but works in other countries?

not sure about the rotary thing that looks cool tho

Happy to be able to help!

If we’re talking about having the microphone tapped etc, I don’t think anyone would still be developing 0-days for such old phones. If you want to be safer (assuming fear of old software having unpatched vulnerabilities) Nokia launched a dumb phone not too long ago.

However… GSM networks and cell tower level tracking is much harder/almost impossible to escape short of throwing away your phone. SMSes can be hijacked, hostile agents can force downgrade the connection to 3G/2g to break encryption (iirc, please correct me if wrong), and your location is generally known to your service provider and Uncle Sam.

Plus… the SIM card is its own mini computer, and lots of the firmware between that and the telephony modules is proprietary and closed source. If you’re familiar with intel ME you have an idea of what I’m talking about.

Honestly, if you’re not a journalist going after big names, or a top CEO/president etc you likely don’t need to worry about any of these. But if you are, or just want to be privacy conscious, your best bet is to never use cell towers and only use Wi-Fi/internet from public or untraceable places; along with Wi-Fi calling for telephony. Btw I’m not sure but I think Google fi and a few carriers/MVNOs offer virtual numbers, which can be a good first step for privacy.

> Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day.

A random Internet search gives iOS 30% market share to Android's 70% [1], which could also explain the higher price.

[1] https://www.statista.com/statistics/272698/global-market-sha...

You raise a good point, however iirc the values of the 2 oses were the same for a long time in the past.

That's worldwide, though. I think a target is more likely to reside in e.g. the US (where iOS usage is >50%) than in Africa.

Apple specifically acknowledges this and has Lockdown Mode to address it. If you care about security you should enable it. Of course you’ll not be able to watch YouTube videos, but you’ll be safer.

whats the point of carrying phone that doesn't even play youtube videos? If security is so important then they should probably carry nokia style 2000's phone where there is no chance of malaware?

I don't have YouTube on my phone and I have Safari disabled. I use my iPhone for:

* Controlling smart home devices

* Messaging and phone calls

* Checking the weather

* Recording data with Apple Health

* Uploading runs to Strava

* Setting wakeup alarms

* Listening to Apple Music

* Using Apple Maps to get around

* Connecting with CarPlay

I don’t think Lockdown Mode actually prevents you from watching YouTube videos. Some googling suggests that there might be issues when using the YouTube website in Safari – which makes sense, since Lockdown Mode disables a bunch of Safari features. But the YouTube app probably still works. (I haven’t tried though.)

I do not believe the android Messages application is open source. I believe AOSP contains something very barebones. It has been a lot of years, am I incorrect?

The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

that is so bizarre that something so essential requires deep integration with the OS, of course that is going to open a can of worms.

I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is

I believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.

No it doesn’t. Blastdoor is a security mitigation that restricts what iMessage can do in a way that is denied to other third party apps.

It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app.

That's why most of the exploits are targeting imessage

No. Most exploits target iMessage because everyone has it installed.

There's plenty of normal apps built-in, iOS isn't very modular. But none of those are not as deeply integrated as imessage.

Ok, but you still haven’t explained how this means it is any less secure. Can you point to exploits that take advantage of the system integration it has?

It's less secure because it's not using the same sandbox used by billions of apps.

> Can you point to exploits that take advantage of the system integration it has?

Sure, the last pegasus attack on the image codec would not have worked on Android.

You mean the WebP vulnerability in code that literally everyone shared? That one?

> The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

I'm replying to someone who said the important factor is android is open sourced. I pointed out the relevant android program is not open sourced.

That's a half truth as well because the APIs that Message is using are open source and documented. You can recreate a third-party Message app and that's what is used in some of the android distributions.

> Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful.

That variability is a double-edged sword. Manufacturer-added Android bundleware is notorious for being shoddily built and could easily represent added points of ingress.

Which is why I wish it were practical to replace OEM Android versions with GrapheneOS/CalyxOS or similar on the latest devices, similar to how a cutting edge PC can run one’s choice of Linux. As long as more secure or at least more standardized Android distributions can only run on devices with some age on them, their popularity will be limited even among the technically inclined.

GrapheneOS and I think CalyxOS runs just fine on the latest Pixel devices. From what I see it is quite up to date most of the times.

I've read (I have no sources) that while the "zerodium still pays more for an android 0-day" thing can be true, the conditions on the "top" payout are pretty strict, due to the same aforementioned variability between vendors. To get that payout you'd have to find something exploitable on nearly all vendors version of android along with working on 2-3 versions. In reality an iMessage exploit is going to pay out a lot more because it would be exploitable on nearly all iPhones running x version of iOS, for example. Finding an exploit in say "Samsung messenger" (I don't know if that even exists) would pay less than an equivalent iMessage one.

Reading between the lines, one thing that I expect Apple has but may not be discussing -- root-cause replayability post-infection, across all Apple devices.

I.e. infection is eventually discovered, Apple isolates the vulnerability's entry point, then Apple has some ability to re-scan all devices to detect which may have also had the attack targeted against them

Hashing some data that can serve as a fingerprint makes sense from a herd standpoint (hell, even something as simple as call stack after iMessage received)

>It's probably far worse with Android users that Google is not disclosing.

[citation needed]

https://dictionary.cambridge.org/dictionary/english/probably

Google has been doing this for a long time. I received one of those emails circa 2010

Far worse with Android users? In general, sure. Google Pixel phones however nowadays comparable to Apple in terms of security. Some argue more secure. And as others have noted Google has notified people about similar before.

Plus, I don't think the onus is on Google to monitor and alert for other OEM phones ala Samsung, Motorola, etc.

Are you a journalist or high profile target? If not, this notification isn't for the average person.

Why is it hard to see that while he may not be a target for any sort of state sponsored attack, it’s a bellwether of apples stance on security.

I really, really don’t think he meant he was switching to Apple because he’s a CIA spy stationed in Moscow.

> CIA spy stationed in Moscow.

Чёрт побери!

Right it’s unthinkable you’d find high profile targets on hacker news.

All you’ll find here are founders of highly funded startups and software developers at boring companies such as Google, Microsoft and Apple.

No point getting into these people’s phones if you’re a state actor for sure /shrug

You don't need to be a journalist. I think many tech workers are oblivious to how juicy and obvious a target we are. Most of us publish a detailed target on our own back via LinkedIn, or our company's website About Us and Clients pages.

Long ago, I co-founded a tiny startup. We had some high profile clients. I was dumb enough to put those clients on our site. I also used to be dumb enough to have a public social media profile, in my name.

I was already somewhat security aware, but one day I almost fell for a spear phishing email. Someone created a gmail account 1 character different from my gf's gmail. They sent me a well worded, but simple email along the lines of "Hey baby, check this out!" and URL shortened link. She happened to be next to me, and I said to her "Hey, what's this?" "What? I didn't send that!" I then opened it in a VM and saw that it resolved to something.ru.

It was a combo of identifying the juicy client of ours, seeing my name as co-founder, finding me on FB, finding my gf in my profile, getting her email, etc.

I then got to learn fun new terms like threat modeling.

Is it possible that someone might think that you have ssh access to a server on an interesting network? You are a target.

Or if you are adjacent to a high profile target, working in the same company as a high profile target, working at a company that is contracted to a high profile target, friend of a friend of a high profile target.... And so on.

Sure, the average person probably doesn't need this (although as another comment pointed out, HN isn't quite representative of the average)... But the net is a hell of a lot wider than just journalists.

Years ago I worked for a non-profit in an office building in San Francisco. My office neighbors were Google, the US Secret Service and, I shit you not, China Daily (a major news outlet run by the Chinese Communist party).

Wait... Apple has the worst security record of any of the FAANG companies and you are switching to them because they admitted a security issue after the fact?

What?

Is this just regular Apple fanboy-ism?

i changed my mind after somebody reminded me Android is more secure and harder to hack due to diversity in hardware

Reply on news.ycombinator.com