Hacker News Reader

Comment by MrKurtz | Hacker News Reader

The folks at Android Police posted about it weeks ago: http://www.androidpolice.com/2013/07/11/second-all-access-ap...

It also was already patched. Good write up though.

saurik explains in his introduction why his article is different (and potentially worth reading even if you've read other articles):

> Later articles were written about this bug, each examining the same exploit technique, coming to the conclusion that this vulnerability offered less abilities than the Master Key exploit, due to very narrow and unlikely requirements that the original signed application package must satisfy.

> In this article, I document different exploit techniques for this bug that do not have these limits; in fact, the second exploit described here provides much more capability than the Master Key exploit, allowing arbitrarily complex packages to take on the signatures from arbitrary signed packages. Finally, I look at the history of this bug in Android, showing when it was introduced.

Correct. In fact, in my section "Serious Limitations", I directly reference the article from Android Police and quote from its at-the-time understanding of the vulnerability.

A commit to a repository does not equal a patch to the half billion vulnerable devices in the field.

Yes, captain obvious? What do you suggest?

Instead of minimizing or dismissing serious problems as 'already patched', hackers could help by warning consumers about the proliferation of Android malware. If sales were jeopardized, vendors would start caring about updates.

So your suggestion is to pass the buck onto "vendors"? Who are they and what can they do about it? Think outside the box!

You don't seem to have any understanding of how Android works. The buck does stop at vendors since they are the ones who ship OS updates to consumers.

Vendors don't prioritize updates because their customers don't understand enough to make this part of their purchasing decision, so there is little incentive for them to spend resources on it.

Minimizing this major problem doesn't help.

And - instead of saying 'think outside the box' - why not actually contribute some out of the box thinking?

Reply on news.ycombinator.com