News for hackers. Stuff that matters.
Re:How to unc0ver a 0-day in 4 hours or less by megablast on Thursday July 09, 2020 @08:17PM (#23786800)
And worry about something else, like it exploding, or not getting security updates after the first year, or boot loop, etc.
Re:How to unc0ver a 0-day in 4 hours or less by strombofulous on Thursday July 09, 2020 @08:21PM (#23786822)
> Like it exploding

That was an issue with one phone, once, and it was a problem with the battery, not Android

> Not getting security updates after the first year

That's actually solved by rooting since you can update from any source instead of just signed packages

> Boot loop

I guess that could be a problem but I've never had that issue and I've rooted all but one phone that I've had

Re:How to unc0ver a 0-day in 4 hours or less by muppetman on Thursday July 09, 2020 @10:17PM (#23787480)
That's NOT solved by rooting - I wish people would stop saying this.

There's two parts to Android patching - the kernel/Android OS itself - yes, this gets patched with a rooted/custom ROM.

Part two is the hardware drivers themselves, the modem driver etc etc. None of that is patched with a custom ROM. You still have to use the same binary blob/drivers that came with the latest official phone firmware.

When security updates stop for you phone, all the updates for the underlying hardware drivers stop too. So yea, you can slap some bandaids on it, but you're not really up to date even though you might be on a later/more recent version of Android.

Re:How to unc0ver a 0-day in 4 hours or less by cookiengineer on Friday July 10, 2020 @12:08AM (#23788048)
Your definition of “solved” is pretty identical to OpenBSD user recommending to “just patch your BIOS”. Demographically this is not a solution, as 99.9999% of the potential audience will never be able to even understand the requirements of that skillset.
Re:How to unc0ver a 0-day in 4 hours or less by ueouieodue on Thursday July 09, 2020 @09:52PM (#23787347)
> That was an issue with one phone, once, and it was a problem with the battery, not Android

If my house burns down, I personally won't care if it's android in general, the model, or the battery in the android phone which destroyed everything I own.

> That's actually solved by rooting since you can update from any source instead of just signed packages

Installing software downloaded from xda-developers is, what I like to call, malware as a service (tm).

Re:How to unc0ver a 0-day in 4 hours or less by httpsterio on Thursday July 09, 2020 @10:20PM (#23787499)
That's like saying that all Apple products suck because they bend, antenna doesn't work, keys stop working and screens start to stain.

Like the person said, it was literally one Samsung model that had issues and it could've just as well have been an iOS device. Looking at how many recalls and repair programs they have for design flaws, I don't think anyone should paint Apple as the better side here.

Re:How to unc0ver a 0-day in 4 hours or less by muppetman on Thursday July 09, 2020 @10:19PM (#23787495)
Can you link me to a custom ROM on XDA that was shown to have Malware?
Re:How to unc0ver a 0-day in 4 hours or less by IncRnd on Friday July 10, 2020 @09:57AM (#23791495)
That's a poor argument. That's like saying you didn't read this page's article, because the malware being discussed wasn't already known to you. Absence of evidence is not evidence of absence. Formally, this is called an argument from ignorance.
Re:How to unc0ver a 0-day in 4 hours or less by Bnshsysjab on Friday July 10, 2020 @08:32AM (#23790823)
This seems like a pretty weak argument, are you sure you want to trust a bunch of hobbiest devs with the security of your (probably) most valuable computer?

Just because something doesn’t have any know issues, doesn’t mean it’s not wise to avoid it because it flat out smells.

Re:How to unc0ver a 0-day in 4 hours or less by devenblake on Friday July 10, 2020 @02:05PM (#23794418)
I trust hobbiests more than I trust Google or Apple to handle my security.
Re:How to unc0ver a 0-day in 4 hours or less by Bnshsysjab on Friday July 10, 2020 @06:14PM (#23797188)
That really depends on your threat model, are Apple and google going to use marketing data against you? Probably.

Are they going to plant malware which steals your banking details? Probably less likely than a random binary package you found on some forum.

Re:How to unc0ver a 0-day in 4 hours or less by p1necone on Thursday July 09, 2020 @08:22PM (#23786833)
You need to do a bit more research because of the sheer number of options, but there's absolutely manufacturers that have none of those issues (battery exploding was one samsung model, I haven't heard of boot loop issues. Poor security update lifetime is absolutely a common issue though, although fixable by rooting as pointed out in another comment). See: Android One^.

^https://en.wikipedia.org/wiki/Android_One

Re:How to unc0ver a 0-day in 4 hours or less by httpsterio on Thursday July 09, 2020 @10:23PM (#23787516)
Also iPhone lifetime is a bit of a joke. I mean, Apple got caught literally slowing their older models down on purpose in order to have people switch into newer models.

I haven't gotten as much mileage on my Android phones as compared to my 4S, but the 4S cost about 3 times as much as the android phones I usually buy and 3 lower end-ish Android phones serves me easily for 10 years with no issues.

Re:How to unc0ver a 0-day in 4 hours or less by jodrellblank on Thursday July 09, 2020 @11:10PM (#23787779)
> "Apple got caught literally slowing their older models down on purpose in order to have people switch into newer models."

"Apple denied wrongdoing and settled the nationwide case to avoid the burdens and costs of litigation, court papers show." - https://www.reuters.com/article/us-apple-iphones-settlement-...

They haven't been "caught" doing that; they have been accused of that. Why is it the stupid conspiracy theory which wins the popularity contest, instead of the much more annoying true story - Apple cheaped out on batteries which couldn't provide enough current to run the phone as they aged? Or, just as factual, Apple slowed down the phone to keep it working longer on the same hardware thus making people avoid having to buy new phones.

Re:How to unc0ver a 0-day in 4 hours or less by JetSpiegel on Friday July 10, 2020 @08:53PM (#23798393)
> They haven't been "caught" doing that

They settled out of court. Must have though the case against them was pretty strong. If that's not an admission of guilt...

Re:How to unc0ver a 0-day in 4 hours or less by macintux on Thursday July 09, 2020 @10:36PM (#23787593)
> 3 lower end-ish Android phones serves me easily for 10 years with no issues

Are there any lower-end phones that get security updates for 3 years?