News for hackers. Stuff that matters.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by jacquesm on Tuesday April 04, 2017 @02:14PM (#14035668)
That's going to hurt a lot of folks. Especially those whose manufacturers are not doing their bit with respect to updates. It's absolutely incredible to me how sloppy manufacturers are when it comes to keeping phones updated, they seem to see phones that are older than two years as effectively end-of-life.

Even Google is guilty of this, though to a slightly lesser extent.

See: http://www.androidpolice.com/2016/06/21/google-support-site-...

So three years or 18 months past sale.

Personally I think that a phone is only end-of-life when it stops to work and that manufacturers should either offer to buy them back if they don't want to support them any longer or should be forced to provide security updates.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by wvenable on Tuesday April 04, 2017 @02:47PM (#14035977)
Manufacturers are used to developing a product and selling that product as-is. The entire idea of needing to maintain (develop, improve, update) a product beyond the point of sale is a fairly new one.

I'm sure manufactures are slow to embrace this new reality because consumers see little value in paying for it.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by danieldk on Tuesday April 04, 2017 @03:57PM (#14036586)
The entire idea of needing to maintain (develop, improve, update) a product beyond the point of sale is a fairly new one.

But not in computers. Even in the 80ies, we would buy new version of MS-DOS for our existing hardware.

The difference is that on most normal computers (except Apple), software was/is decoupled from hardware, they have different manufacturers. Software developers want to reach an as large as possible audience, so it is typically not in there interest to support only the latest hardware iteration.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by flukus on Tuesday April 04, 2017 @07:32PM (#14038271)
And PC manufacturers still screw it up. If you're lucky you'll get 4 updates to a computer spread 6 months apart and delivered by a custom app that is just as likely to crash as it is to update you're system.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by gmac on Wednesday April 05, 2017 @02:32AM (#14040160)
... or indeed brick your laptop (as happened to me once with an HP).
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by Trundle on Wednesday April 05, 2017 @02:17AM (#14040098)
I don't see how your point contradicts with what they said. Selling a new version of MS DOS is not developing/improving/updating a product beyond the point of sale. It's creating a new product to sell, which non-software has been doing forever as well.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by jacquesm on Tuesday April 04, 2017 @02:56PM (#14036032)
They've already paid for it.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by tbrownaw on Tuesday April 04, 2017 @03:45PM (#14036485)
The sales price was enough to cover not just development and production, but also free long-term maintenance that the manufacturer didn't know to plan for (and possibly couldn't have known to plan for)?
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by jacquesm on Tuesday April 04, 2017 @04:16PM (#14036761)
But that they should have planned for. Really, it's not as if security issues are a new thing, we've been dealing with this crap for several decades now.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by bdhess on Tuesday April 04, 2017 @06:42PM (#14037933)
OP's point is that most consumers are much more sensitive to price than they are to X years of updates as a deciding factor when buying a new phone. If a manufacturer planned for a longer update timeline and hence charged more, they'd lose business to a competitor who didn't.

Consumer understanding and/or regulation needs to change in order to provoke a different response from the manufacturers.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by jacquesm on Tuesday April 04, 2017 @07:01PM (#14038070)
Consumers have no clue how the cell phone ecosystem works in the first place let alone that they would be able to put a value on the security of their devices. They are going on the assumption that the manufacturers/carriers would not sell a product that is defective. Manufacturers make enough profit as it is to update their devices for the expected service life of the devices. They're just not willing to go the distance.

Industries that do not self regulate tend to find that they will then be regulated by the authorities.

The phone companies used to be so anal about this that they would ban 'unlicensed' hardware from their networks to the point that you could only use their overpriced hardware. Now that has changed to the point where they will push whatever junk gives them the biggest margins at the moment of sign-up and never mind the long view.

Yet another example of a place where strict software liability would be a great thing to have.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by tbrownaw on Tuesday April 04, 2017 @07:07PM (#14038136)
Industries that do not self regulate tend to find that they will then be regulated by the authorities.

The phone companies used to be so anal about this that they would ban 'unlicensed' hardware from their networks to the point that you could only use their overpriced hardware.

I thought that was more because it was overpriced than out of any attempt to avoid regulation. And that they were blatant enough about being anti-competitive that they got regulated for it.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by jacquesm on Tuesday April 04, 2017 @07:19PM (#14038198)
Yes, so now we have this split where you can buy equipment from a whole range of manufacturers and suddenly the phone company doesn't care at all what crap gets on their networks.

This to me clearly indicates that the carriers at least have the option to ensure that the equipment connected to their network is up to certain standards. But since they don't car e (they never did) they'll be happy to sell you a phone from some manufacturer that is most likely not going to outlive the contract because of the extra margin they make on that phone.

So either they should take it back for some residual value (which they can then try to recover from the manufacturer) or they should ensure it keeps working properly.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by tbrownaw on Tuesday April 04, 2017 @07:49PM (#14038378)
This to me clearly indicates that the carriers at least have the option to ensure that the equipment connected to their network is up to certain standards.

I thought some of the fallout from that mess was that they can't impose rules beyond "doesn't break our shit".

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by kbenson on Tuesday April 04, 2017 @06:57PM (#14038049)
If I had to guess, I imagine auto manufacturers allocate some amount of the sales price towards future recalls as well. A little googling seems to indicate I'm at least partially correct:

A major recall that affects a large number of cars can create huge expenses in the aggregate. According to Toyota's Q3 conference call, they have set aside 100 billion yen (approximately $1.12 billion) for these "quality-related expenses" which will be allocated between the third and fourth quarters. (Some products were announced with great hype, only to be pulled from shelves. Find out more in A Year In Product Recalls.)[1]

I suspect that legally required recalls are viewed differently than security updated mainly because they are legally required. I wouldn't mind a consumer law requiring companies to provide at least a minimum period of security updates from the time it's officially available from the manufacturer. I also wouldn't mind if that period was longer for "appliance-like" IoT devices...

It probablt can even use the same justification. Unsafe vehicles on the road are a danger to us all, and so are unsafe devices on our networks.

1: http://www.investopedia.com/financial-edge/0210/the-cost-of-...

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by swiley on Tuesday April 04, 2017 @07:00PM (#14038068)
They wouldn't have to maintain the software if they released it so it could be updated by either the kernel developers or the OEM.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by metricodus on Tuesday April 04, 2017 @02:33PM (#14035852)
My 73 year old mom is quite happy with the 2014 Moto G I got her three years ago. I guess she'll need something new now (No idea if it has a BCM wifi chipset, but I'm guessing so - how do you even find this out without having physical access to the device?).

I'm thinking Apple may be the way to go this time, because they maintain security updates for older devices for longer. (Seems like 5+ years.)

Another way of looking at this is that lacking security updates create unnecessary electronic/chemical pollution/waste. I think the EU should tackle this. I'm sure they could come up with some scheme for penalties for lacking security updates. (Does anyone know of any initiative in this area?)

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by nandhp on Tuesday April 04, 2017 @04:38PM (#14036972)
According to GSM Arena, the 2nd generation Moto G uses a Qualcomm MSM8226 Snapdragon 400 chipset, so it shouldn't be affected by this issue.

http://www.gsmarena.com/motorola_moto_g_(2nd_gen)-6647.php

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by mjg59 on Tuesday April 04, 2017 @07:41PM (#14038326)
There are plenty of Qualcomm based devices that use Broadcom wifi.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by metricodus on Tuesday April 04, 2017 @05:26PM (#14037368)
Thanks! :)

(I still reckon my mom needs a new phone though, there are other less severe exploits out there for this non-updated device.)

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by cbhl on Tuesday April 04, 2017 @06:44PM (#14037949)
Moto seems to put out a new Moto G every year, and I've had good success with just replacing the old ones with the new ones.

Yes, an iPhone is better, but if you're on a budget and don't have those security needs, the Moto G seems fine.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by metricodus on Tuesday April 04, 2017 @07:26PM (#14038237)
If you don't need something secure, get a Moto. Check.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by danieldk on Tuesday April 04, 2017 @04:01PM (#14036626)
I'm thinking Apple may be the way to go this time, because they maintain security updates for older devices for longer. (Seems like 5+ years.)

The iPhone SE has a reasonable price and is only a year old. E.g., here in Germany you can still get the 16GB version from before last month's storage bump for 399 Euro. It has the same SoC as the iPhone 6s (A9).

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by flukus on Tuesday April 04, 2017 @07:35PM (#14038286)
My moto e got patched a few weeks ago and now crashes several times a day. It seems Motorola is trying to train users not to update their systems.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by Wicher on Thursday April 06, 2017 @01:29AM (#14048176)
But on the other hand they're very friendly when you want to install alternative firmware (eg cyanogenmod). They let you unlock the bootloader and then you can flash at will.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by rbcgerard on Tuesday April 04, 2017 @02:28PM (#14035796)
Or at least commit to a period of support like a warranty so at least it's another metric to consider upfront when purchasing
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by metricodus on Tuesday April 04, 2017 @03:25PM (#14036289)
The EU loves creating standardized sticker layouts. In this case I would welcome it.

"Security updates guaranteed for: nn months"

or

"Security updates guaranteed until: YYYY/MM"

There should be a also scheme where companies who claim these things would have to deposit some calculated amount in some offical place.

(Btw, since so there's so much cheap crap being imported from china, I guess the most consumer-protecting approach would be to make both the reseller and producer responsible for the penalties resulting from a lack of security updates.)

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by Zenst on Tuesday April 04, 2017 @03:44PM (#14036475)
Not sure about the EU, but the UK has this covered under the Sales of Goods Act: https://en.wikipedia.org/wiki/Sale_of_Goods_Act_1979
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by metricodus on Tuesday April 04, 2017 @03:54PM (#14036565)
Has that 1979 law been proven in court to be valid about the kind of things we are talking about now, and can you link the specific cases, please? :=)
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by Zenst on Tuesday April 04, 2017 @04:07PM (#14036676)
Do you have a resource in which can look up past cases, including small claims court that is not paywalled in some form?

Asking as I'm aware of a couple of cases with friends in the past few years. Personally had one case in which was about to go to SCC regarding software update removing some functionality and the company settled out of court and left me most happy with the settlement.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by kuschku on Tuesday April 04, 2017 @06:54PM (#14038026)
Use dejure.org for German cases and law.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by Zenst on Tuesday April 04, 2017 @07:36PM (#14038293)
Bookmarked, alas for the UK the only public offerings are pay per search: https://www.trustonline.org.uk/ which does not seem to have Small Claims Court judgments.

Also http://law.stackexchange.com/questions/940/is-there-a-prefer... kinda back's this up alas.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by metricodus on Tuesday April 04, 2017 @04:34PM (#14036924)
I think the onus is on you.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by Zenst on Tuesday April 04, 2017 @05:07PM (#14037214)
That is why I asked as I'm not aware of any non-paywall sites that allow such lookups and neither it seems are you.

Maybe somebody else knows one, but as I stated, I have personally used this law in comparable circumstances and aware others have. But without the ability to lookup such cases on a non-paywall site then alas we have hit an enpass.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by jacquesm on Tuesday April 04, 2017 @06:01PM (#14037635)
What he means is that if you are going around claiming all kinds of things then you should be the one to provide the evidence to go with the claims.
Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by Zenst on Tuesday April 04, 2017 @06:32PM (#14037869)
I'm fully aware of what he asked for and as I have made clear, unless somebody can link a site that allows such lookup of past cases (including SCC) then there is nothing further I can do beyond express my personal experience, and link to the law in question (which I did).

So unless you are able to link such a site then your not helping at all.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by metricodus on Tuesday April 04, 2017 @08:12PM (#14038524)
> So unless you are able to link such a site then your not helping at all.

You are right, we are not helping at all with proving your unsubstantiated claim.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by kbenson on Tuesday April 04, 2017 @07:22PM (#14038212)
Well, part of the claim is a personal experience, so evidence isn't strictly required, since the source is making the statement. At that point, you have to determine how well you trust the source.

More evidence would be preferred, and would definitely raise my trust that there wasn't some mistake of memory, but it seems a bit extreme to dogpile on someone who is stating what they believe as fact from personal experience, and when asked for verification seems willing to try to find that but without the knowledge or ability to do so and asking for pointers on how to do that.

Re:Over the Air: Exploiting Broadcom’s Wi-Fi Stack by metricodus on Tuesday April 04, 2017 @06:32PM (#14037868)
..yes. Thanks for clarifying :).