Google Pixel phones sold with security vulnerability, report finds | Hacker News Reader

Google Pixel phones sold with security vulnerability, report finds

theverge.com

31 pointsalamortsubite12 comments

This is a beat up generated by Palantir and iVerify, both the Verge and WIRED swallowed the bait.

"By Gaby Del Valle, a policy reporter. Her past work has focused on immigration politics, border surveillance technologies, and the rise of the New Right."

Sorry Gaby, you're out of your depth. Somehow Lily Hay Newman (WIRED), who should know better, was also taken in by this.

Don't install iVerify, it's practically malware.

> “This was very deleterious of trust, to have third-party, unvetted insecure software on it,” Dane Stuckey, Palantir’s chief information security officer,

That is pretty funny

"The app was inactive by default and had to be manually enabled"

So I don't really see it as a big deal - I probably have lots of software that's not running but exists on my PC that would be a security risk if "manually enabled".

Though it's good to remove it if it's not necessary, I hardly see it as an emergency thing or really warrant this sort of breathless media drama.

Related sources already submitted:

Google Pixel Phones Have Unpatched Flaw in Hidden Android App

https://www.wired.com/story/google-android-pixel-showcase-vu...

(https://news.ycombinator.com/item?id=41256122)

Google sold Android phones with hidden insecure feature, companies find

https://www.washingtonpost.com/technology/2024/08/15/google-...

(https://news.ycombinator.com/item?id=41255631)

iVerify Discovers Android Vulnerability Impacting Millions of Devices

https://iverify.io/press-releases/iverify-discovers-severe-a...

(https://news.ycombinator.com/item?id=41255798)

So is this just on phones locked to Verizon or all of them?

Probably all of them. Even the OG non-verizon pixel had verizon garbage baked into it.

Interesting addition to his statement:

"Fernandez said the software was made “for Verizon in-store demo devices and is no longer being used,” adding that Google has “seen no evidence of any active exploitation.”

How would they know?

It doesn't quite make sense to change the policy for all Android phones if an issue is with Verizon-branded Pixels.

Don't verizon and play store pixels use the same os image? Sounds like an issue for all pixels.

how come verizon gets this special access to insert their code into pixel factory images?

one can find crap like "VzwOmaTrigger.apk" built into the OS even on the original pixel

Because Google needs Verizon's consent for their phones to work on Verizon's network.

What makes verizon special compared to e.g. t-mobile? i didn't see any t-mobile code in the factory OS.

Reply on news.ycombinator.com