News for hackers. Stuff that matters.
Re:A Message about iOS Security by Spooky23 on Friday September 06, 2019 @03:25PM (#20898982)
They are in a no-win position and keeping silent is worse.

Android security has always been a bit of a contradiction of terms, and while Google has improved the OS, the combination of limited availability of upgrades due to carrier nonsense and the state of apps on the platform. An Android zeroday isn’t news.

The iOS defects are particularly jarring as they have been rare to date.

Re:A Message about iOS Security by scarface74 on Friday September 06, 2019 @04:38PM (#20899664)
Apple uses the same carriers as Google. The poor state of Android updates is no one’s fault but Google’s.

No matter where I buy my Windows PC from, my upgrades come from Microsoft. In fact, I have an ancient Mac Mini that can still receive Windows 7 updates.

Re:A Message about iOS Security by asdfasgasdgasdg on Friday September 06, 2019 @10:29PM (#20901407)
> The poor state of Android updates is no one’s fault but Google’s.

I don't know if I would go that far. That problem comes from the way Android is organized. It's open, and it invites third party involvement. That in turn makes it nearly impossible for Google to control the OS lifecycle. You can argue that they should have kept it closed, like Apple. But if that were the case, they'd be in even worse anti-trust waters than they already are with the device.

More likely, they'd simply have failed. They had the software know how, but in no way had the expertise to build out a new type of device. It seems unlikely anyone else could have bankrolled a realistic challenge to Apple's dominance. So we would probably be in a situation where there was iPhone, and a bunch of shit phones from random manufacturers.

In light of all that, I think Google made the best decision possible. Maybe that's what you mean -- that Google made a good decision and that, despite that good decision, there are tradeoffs. But to me it sounds like you think Google failed in some way by making the choices that have led us to the current state of affairs w.r.t. updates. I don't think that's a fair read on the subject. At least, when I see someone doing the best they can, and there are flawed aspects to the performance, I don't say, "It's nobody's fault but yours that there's a flaw in this work." I would phrase it differently.

Re:A Message about iOS Security by scarface74 on Saturday September 07, 2019 @04:57AM (#20902648)
It seems unlikely anyone else could have bankrolled a realistic challenge to Apple's dominance. So we would probably be in a situation where there was iPhone, and a bunch of shit phones from random manufacturers.

It would have obviously been Microsoft. They already had a mobile operating system and companies would have had no choice but to use it.

But if that were the case, they'd be in even worse anti-trust waters than they already are with the device.

Microsoft never got in trouble for having a closed operating system. And despite all of Rubin’s BS about the “definition of open”, everything that makes Android,Android outside of China is closed source and controlled by Google.

Re:A Message about iOS Security by CobrastanJorji on Friday September 06, 2019 @07:10PM (#20900689)
They weren't referring to the networks themselves. Carriers release (or work with manufacturers to release) versions of phones with a bunch of custom stuff added onto a vanilla Android OS. When Google releases a new OS or an important security fix to Android, carriers need to merge this stuff in with all of their custom stuff, assuming that they still care to do so and support that device. As a result, phones running Android can fall years behind on patches.

The phones sold by Apple don't have this problem. The phones sold by Google also don't have this problem. But the phones sold by carriers but running Google's OS have this problem. Phones sold by carriers but running Apple's OS would also have this problem, but Apple doesn't let anyone else sell phones with their OS.

The difference between your computer's patches and your phone's patches is that you are allowed to update your computer's operating system, but your phone has probably been carefully locked down by your carrier to prevent you being able to do this, which is very upsetting but that's a different matter.

Re:A Message about iOS Security by scarface74 on Friday September 06, 2019 @10:17PM (#20901376)
Carriers release (or work with manufacturers to release) versions of phones with a bunch of custom stuff added onto a vanilla Android OS.

PC makers also put various crapware on phones and use to do shell replacements. That never stopped anyone from upgrading...

When Google releases a new OS or an important security fix to Android, carriers need to merge this stuff in with all of their custom stuff, assuming that they still care to do so and support that device. As a result, phones running Android can fall years behind on patches.

Microsoft also allowed various carrier changes to Windows Phones but they could still offer upgrades across devices.

Phones sold by carriers but running Apple's OS would also have this problem, but Apple doesn't let anyone else sell phones with their OS.

Microsoft has had a vibrant ecosystem of third parties selling PCs running its OS for decades. The entire idea behind WinHec and Plug and Play in the mid 90s was to solve this very problem. The issue that either Google doesn’t know how to properly run a platform or didn’t make it a priority. You see that Google can architect a system where Google Play Services can be updated across manufacturers. They care enough to keep their spying mechanism updated.

The difference between your computer's patches and your phone's patches is that you are allowed to update your computer's operating system, but your phone has probably been carefully locked down by your carrier to prevent you being able to do this, which is very upsetting but that's a different matter.

That’s only because Apple wrested control from the carriers before any iPhone shipped to keep carrier crap off their phone and to keep control over its devices. Google never cared to. Android is just a badly architected system in this regard. Microsoft solved this problem two decades ago.

Re:A Message about iOS Security by robocat on Saturday September 07, 2019 @01:18AM (#20901944)
> Microsoft also allowed various carrier changes to Windows Phones but they could still offer upgrades across devices.

They definitely didn't update phones quickly when exploits were found for IE and Windows would got a security update.

We had some test Windows Phone/Mobile devices at work, and the cheaper models didn't really get upgrades. I would also guess if you had 7.5/7.8 devices, they stopped getting updates? I'm sure some devices kept getting regular updates.

We also had a cheap 32GB Toshiba tablet, which couldn't upgrade Windows 10 because it lacked drive space (even though it had nothing apart from Windows installed on it - it was for testing touch on Windows browsers).

Re:A Message about iOS Security by asdfasgasdgasdg on Friday September 06, 2019 @10:35PM (#20901434)
> Microsoft also allowed various carrier changes to Windows Phones but they could still offer upgrades across devices. ... Microsoft has had a vibrant ecosystem of third parties selling PCs running its OS for decades.

And for all that, they still failed to make a dent in the market. Partly, OEMs and carriers were not as interested in supporting Microsoft's offering precisely because of how they could not put their own stamp on it. In many ways, Microsoft's offering was better on the fundamentals than Android's. So why didn't it succeed? Perhaps because of the very features you are praising.

The only reason Apple was even able to pull it off was because of their first mover advantage, combined with their extreme consumer appeal. Their phones were so much better than anything that was available at the time, but even with all that, they had to enter into an exclusive contract with AT&T for the first couple of years in order to get the control they wanted. Only after they had established a foothold were they able to say "no" to carrier and OEM customization. If they had been second to market, like Android, it's hard to picture them having that level of control and leverage.

Re:A Message about iOS Security by Despegar on Saturday September 07, 2019 @01:41AM (#20902024)
It's honestly surprising that people still continue to insist that anyone but Google is responsible for the current state of affairs. It's completely because of Google's business incentives. Google's pivot, from a Blackberry clone to an iPhone clone, was about quickly obtaining market share. That meant ceding control to OEMs and carriers so they could effectively market devices against the iPhone.

Microsoft didn't lose because of those things (it shows how much better they are at being a platform company that they didn't repeat Google's mistakes), they lost solely because Android was free to OEMs. That's entirely a business model question.

Re:A Message about iOS Security by mandevil on Friday September 06, 2019 @04:25PM (#20899557)
This is not what Zerodium says[1]. They claim, and are backing it up with millions of dollars, that current Android exploits are more valuable than current iOS, because of a large supply of iOS issues.

[1]: https://www.wired.com/story/android-zero-day-more-than-ios-z...

Re:A Message about iOS Security by Spooky23 on Friday September 06, 2019 @06:45PM (#20900546)
In the article they discuss that it’s lkelly a publicity stunt.
Re:A Message about iOS Security by mandevil on Friday September 06, 2019 @07:46PM (#20900854)
0dium's actual prices are likely a publicity stunt, but it says quite clearly, citing several different, independent sources, that attacks against a fully patched Android system are now worth more than the equivalent attack against a fully patched iOS machine. That is in part because Android has hardened up recently, Safari and iMessage in particular are highly vulnerable, and also because there was more money recently in iOS and so there was more attention on it.

To a certain extent, of course, attacks against Android outside of flagship Samsung and Google phones are much cheaper- look at any patchset and attack, and given that 30+% of the Android user base is on Nougat/Oreo and 10% is on Kitkat or earlier as a whole they are far more exposed.

Re:A Message about iOS Security by lern_too_spel on Friday September 06, 2019 @07:23PM (#20900766)
No, it says they might be trying to influence market prices. Another researcher quoted in the article confirms that the market price for an exploit of a high end Android device is 30% more than an equivalent iOS exploit and gives Safari's poor security as the reason. Despite Safari having such a large attack surface, iOS cannot update it without a reboot, which only exacerbates the problem.