News for hackers. Stuff that matters.
Re:Google shifting to “upstream first” Linux kernel approach... by wizzwizz4 on Thursday September 23, 2021 @10:22AM (#28629561)
Okay, so the app's running.

Except the app is remote-controlled by a malicious “display driver” that waits for the user to do all this authentication set-up, transfers the money away, “are you sure”s it, then prevents the user from seeing any of the on-phone scam warnings until it's too late to reverse the transaction.

Re:Google shifting to “upstream first” Linux kernel approach... by the8472 on Thursday September 23, 2021 @10:29AM (#28629656)
Display driver is part of the kernel, which is part of the trust chain.
Re:Google shifting to “upstream first” Linux kernel approach... by wizzwizz4 on Thursday September 23, 2021 @04:28PM (#28634854)
Substitute “display driver” for a draw over other apps, “tap this dot” game, then.
Re:Google shifting to “upstream first” Linux kernel approach... by the8472 on Thursday September 23, 2021 @07:17PM (#28636818)
That's a standard feature and not related to unlocking the bootloader. Handling that properly wrt. sensitive apps has to be done anyway.