News for hackers. Stuff that matters.
Re:Critical Bluetooth vulnerability in Android by rjmunro on Friday February 07, 2020 @06:24AM (#22264970)
In the UK I always wonder if it's possible to bring a claim under Part 1 Chapter 2 of the Consumer Rights Act 2015. The goods must be 'satisfactory'. Remove code execution over bluetooth is not satisfactory, even if it only became apparent 3 years later.

https://www.moneysavingexpert.com/shopping/consumer-rights-r...

Re:Critical Bluetooth vulnerability in Android by lowdose on Friday February 07, 2020 @06:57AM (#22265158)
Didn't you hear of those people returning their VW diesel back to the dealer because of a claim under Part 1 Chapter 2 of the Consumer Right Act 2015?
Re:Critical Bluetooth vulnerability in Android by tremon on Friday February 07, 2020 @07:51AM (#22265452)
I didn't, but it sounds intriguing, what was the outcome of that?
Re:Critical Bluetooth vulnerability in Android by lowdose on Friday February 07, 2020 @09:01AM (#22265970)
Biggest forced manufacturing recall ever recorded in history. VW Group barely hangs on in Chapter 11 because the people for once decided not to accept scapegoating some figureheads in a limited hangout.
Re:Critical Bluetooth vulnerability in Android by ddeck on Friday February 07, 2020 @10:31AM (#22266875)
>VW Group barely hangs on in Chapter 11

Not sure what you're referring to. Chapter 11 is a form of reorganization in bankruptcy in US law.

Volkswagen AG (i.e. the VW Group) is an EUR85 billion German company that - despite the massive fines and recall - has been consistently profitable, with a small loss in 2015 due to the aforementioned issue and earned ~EUR12 billion in net profit last year.

[dead]
Re:Critical Bluetooth vulnerability in Android by Lammy on Friday February 07, 2020 @02:24PM (#22269733)
It will teach others. No need for the sarcasm.
Re:Critical Bluetooth vulnerability in Android by gruez on Friday February 07, 2020 @08:28AM (#22265709)
Was it really because of the Consumer Right Act? Part of VW's settlement with regulators was that they had to buy back a large majority (I don't recall the exact number) of the defective cars.
Re:Critical Bluetooth vulnerability in Android by verbify on Friday February 07, 2020 @07:56AM (#22265487)
I'm in the UK, and bought an original Pixel directly from Google. The bluetooth daemon would just crash for me rather than being exploitable. I just don't think I have a case - phone manufacturers don't promise security updates in perpetuity. I don't think it passes the test of a reasonable person being dissatisfied.
Re:Critical Bluetooth vulnerability in Android by flir on Saturday February 08, 2020 @12:36PM (#22277051)
Does it matter if they promised updates or not? It's not fit for purpose. Their choices under law are refund, replace or fix.
Re:Critical Bluetooth vulnerability in Android by flir on Friday February 07, 2020 @07:27AM (#22265316)
I'd be thinking "fit for purpose" rather than "satisfactory". Minor quibble though.
Re:Critical Bluetooth vulnerability in Android by 867-5309 on Friday February 07, 2020 @06:45AM (#22265090)
a legal battle with a phone manufacturer will cost much more than the phone itself. 99% of retailers will say it's nothing to do with them, take it up with the manufacturer. phones are relatively cheap and transient commodities compared to something like houses, where "consumer rights" might actually mean something
Re:Critical Bluetooth vulnerability in Android by Someone on Friday February 07, 2020 @08:01AM (#22265530)
They will say that and will often get away with it, but in the EU, that doesn’t fly. https://europa.eu/youreurope/citizens/consumers/shopping/gua...:

”Under EU rules, a trader must repair, replace, reduce the price or give you a refund if goods you bought turn out to be faulty or do not look or work as advertised.”

So, the manufacturer, in the EU, never has anything to do with the consumer, legally.

I think a trader could successfully argue they didn’t advertise the device as secure, that the user didn’t suffer from it or, for devices that are out of warranty, that they don’t need to correct this issue anymore. claiming that it wasn’t ‘faulty’ could be harder, but I’m sure they would try. If a vulnerability isn’t known, is it a fault? Depends on whether its cause was generally known, I would think.

Re:Critical Bluetooth vulnerability in Android by dageshi on Friday February 07, 2020 @12:36PM (#22268482)
Unless I'm missing something, it's only for 2 years after purchase?

"The legal guarantee covers any defects presumed to have existed at the time of delivery and which become apparent within a period of two years. However, the crucial period is the 6 months after you bought your product:"

https://europa.eu/youreurope/citizens/consumers/shopping/gua...

So I'm assuming the bulk of older phones would no longer be covered?

Re:Critical Bluetooth vulnerability in Android by tripzilch on Saturday February 08, 2020 @07:11AM (#22275362)
That's the absolute EU mandated minimum. Per country it can be stricter. Also, generally businesses are expected to do somewhat better than "the bare minimum that makes you not want to demand your money back".
Re:Critical Bluetooth vulnerability in Android by gowld on Saturday February 08, 2020 @04:20PM (#22278423)
> businesses are expected to do somewhat better than "the bare minimum that makes you not want to demand your money back".

Since when? Economic theory explains that they are expected to do no more than that, or else they'd leave money on the table.

Re:Critical Bluetooth vulnerability in Android by eitland on Friday February 07, 2020 @02:29PM (#22269797)
Here in Norway I think it is, but be prepared to argue for it.
Re:Critical Bluetooth vulnerability in Android by rjmunro on Friday February 07, 2020 @06:59AM (#22265170)
> a legal battle with a phone manufacturer will cost much more than the phone itself

You'd only need to do it once to set a precedent, and everyone can get their phones fixed or replaced. The problem is that the law applies to the retailer, not to the manufacturer. As I didn't buy my phone direct, I'd have to get the retailer to replace it, and as I went to a high street retailer who is suffering from competition from Amazon etc, and closing branches, it feels bad to give the problem to them.

If I'd bought the phone from the manufacturer direct, from Amazon, or from a phone network, I'd gladly go ahead with the action because those retailers would have enough clout that the manufacturer would care about loosing their business.

Re:Critical Bluetooth vulnerability in Android by michaelhoffman on Friday February 07, 2020 @07:26AM (#22265315)
In the UK it is really easy and inexpensive to file a small claim, and there are limits to how much cases on the small claims track can cost you.

https://www.gov.uk/make-money-claim

I've done it myself and got paid by an intransigent phone retailer relatively promptly after that point. My lawsuit was about a contractual dispute rather than faulty goods though.

Re:Critical Bluetooth vulnerability in Android by jacquesm on Friday February 07, 2020 @06:55AM (#22265147)
If consumer rights don't mean anything for > $500 devices then there might as well be no consumer rights.
Re:Critical Bluetooth vulnerability in Android by fulafel on Friday February 07, 2020 @07:50AM (#22265441)
Would the dispute be with the manufacturer or whoever sold the phone to you?
Re:Critical Bluetooth vulnerability in Android by davidgerard on Friday February 07, 2020 @08:56AM (#22265927)
Whoever sold you the phone. Your contract is with the trader.