Hacker News Reader

Comment by user_7832 | Hacker News Reader

> I'm seriously considering changing to Apple after this.

Ironically that may be worse for you. iMessage is probably a critical step in 60% (or more) of these exploits, and the various unicode/pdf etc rendering engines are responsible in many exploits. Android's open-source nature likely means that a lot of these things are found by security researchers first. Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day.

Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful.

View on HN

> Don't forget that zerodium still pays more for an android 0-day than an iOS 0-day.

A random Internet search gives iOS 30% market share to Android's 70% [1], which could also explain the higher price.

[1] https://www.statista.com/statistics/272698/global-market-sha...

You raise a good point, however iirc the values of the 2 oses were the same for a long time in the past.

That's worldwide, though. I think a target is more likely to reside in e.g. the US (where iOS usage is >50%) than in Africa.

Apple specifically acknowledges this and has Lockdown Mode to address it. If you care about security you should enable it. Of course you’ll not be able to watch YouTube videos, but you’ll be safer.

whats the point of carrying phone that doesn't even play youtube videos? If security is so important then they should probably carry nokia style 2000's phone where there is no chance of malaware?

I don't have YouTube on my phone and I have Safari disabled. I use my iPhone for:

* Controlling smart home devices

* Messaging and phone calls

* Checking the weather

* Recording data with Apple Health

* Uploading runs to Strava

* Setting wakeup alarms

* Listening to Apple Music

* Using Apple Maps to get around

* Connecting with CarPlay

I don’t think Lockdown Mode actually prevents you from watching YouTube videos. Some googling suggests that there might be issues when using the YouTube website in Safari – which makes sense, since Lockdown Mode disables a bunch of Safari features. But the YouTube app probably still works. (I haven’t tried though.)

> Plus, the huge variability between Samsung/Google/Moto/Huawei etc makes it triply hard for a single exploit to be successful.

That variability is a double-edged sword. Manufacturer-added Android bundleware is notorious for being shoddily built and could easily represent added points of ingress.

Which is why I wish it were practical to replace OEM Android versions with GrapheneOS/CalyxOS or similar on the latest devices, similar to how a cutting edge PC can run one’s choice of Linux. As long as more secure or at least more standardized Android distributions can only run on devices with some age on them, their popularity will be limited even among the technically inclined.

GrapheneOS and I think CalyxOS runs just fine on the latest Pixel devices. From what I see it is quite up to date most of the times.

I do not believe the android Messages application is open source. I believe AOSP contains something very barebones. It has been a lot of years, am I incorrect?

The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

that is so bizarre that something so essential requires deep integration with the OS, of course that is going to open a can of worms.

I don’t understand why people keep bringing this up when it has no functional relevance to how secure it is

I believe it is relevant, at least till recently Apple developed a “blastdoor” to keep iMessage safer against such attacks. While other apps have been used in attacks (eg WhatsApp/Jeff Bezos iirc) iMessage seems to have more permissions than an average user app.

No it doesn’t. Blastdoor is a security mitigation that restricts what iMessage can do in a way that is denied to other third party apps.

It's highly relevant, if you breach the Message app on Android... well it's the same as breaching any other app.

That's why most of the exploits are targeting imessage

No. Most exploits target iMessage because everyone has it installed.

There's plenty of normal apps built-in, iOS isn't very modular. But none of those are not as deeply integrated as imessage.

Ok, but you still haven’t explained how this means it is any less secure. Can you point to exploits that take advantage of the system integration it has?

It's less secure because it's not using the same sandbox used by billions of apps.

> Can you point to exploits that take advantage of the system integration it has?

Sure, the last pegasus attack on the image codec would not have worked on Android.

You mean the WebP vulnerability in code that literally everyone shared? That one?

> The big difference here is the Message app on Android is just a normal app whereas imessage is bundled deep in the OS with tons of private apis

I'm replying to someone who said the important factor is android is open sourced. I pointed out the relevant android program is not open sourced.

That's a half truth as well because the APIs that Message is using are open source and documented. You can recreate a third-party Message app and that's what is used in some of the android distributions.

I've read (I have no sources) that while the "zerodium still pays more for an android 0-day" thing can be true, the conditions on the "top" payout are pretty strict, due to the same aforementioned variability between vendors. To get that payout you'd have to find something exploitable on nearly all vendors version of android along with working on 2-3 versions. In reality an iMessage exploit is going to pay out a lot more because it would be exploitable on nearly all iPhones running x version of iOS, for example. Finding an exploit in say "Samsung messenger" (I don't know if that even exists) would pay less than an equivalent iMessage one.

you changed my mind successfully thank you

but what about dumb phones from late 2000s like my Samsung Alias 2? what kind of sick bastard would make zero days for this

for those you don't need 0days. you can use 360*20days just fine. it's like there was any firmware update for them ever.

I can never pass up an opportunity to mention Justine Haupt’s Rotary Un-Smartphone.

Buy: https://skysedge.com/telecom/RUSP/index.html

Story: https://www.justine-haupt.com/rotarycellphoneinfo/index.html

Edit: wait, was she not able to get it certified? Does it really say it won’t connect to a US network?

Oh,

> This is a regulatory approval issue which will take time to resolve.

weird why wouldn't it work with US networks...but works in other countries?

not sure about the rotary thing that looks cool tho

Happy to be able to help!

If we’re talking about having the microphone tapped etc, I don’t think anyone would still be developing 0-days for such old phones. If you want to be safer (assuming fear of old software having unpatched vulnerabilities) Nokia launched a dumb phone not too long ago.

However… GSM networks and cell tower level tracking is much harder/almost impossible to escape short of throwing away your phone. SMSes can be hijacked, hostile agents can force downgrade the connection to 3G/2g to break encryption (iirc, please correct me if wrong), and your location is generally known to your service provider and Uncle Sam.

Plus… the SIM card is its own mini computer, and lots of the firmware between that and the telephony modules is proprietary and closed source. If you’re familiar with intel ME you have an idea of what I’m talking about.

Honestly, if you’re not a journalist going after big names, or a top CEO/president etc you likely don’t need to worry about any of these. But if you are, or just want to be privacy conscious, your best bet is to never use cell towers and only use Wi-Fi/internet from public or untraceable places; along with Wi-Fi calling for telephony. Btw I’m not sure but I think Google fi and a few carriers/MVNOs offer virtual numbers, which can be a good first step for privacy.

Reply on news.ycombinator.com