Re:Google urges Android phone users to switch off Wi-Fi calling
by saagarjha on Tuesday March 21, 2023 @02:46AM
(#35243185)
Google Play Protect has limited capabilities to protect against in-the-wild exploits of the kind Maddie described. It knows about certain packaged implementations, which means that it can offer some defense from off-the-shelf uses of an exploit, but it definitely does not reduce the risk to anywhere near zero. The only correct way to mitigate against exploits like this is a patch, end of story.
[ Parent
| on HN ]
Re:Google urges Android phone users to switch off Wi-Fi calling
by arsome on Tuesday March 21, 2023 @08:53AM
(#35245456)
Absolutely, but like I mentioned in the prior post, these are local privescs. You basically need to go out and install malicious apps.
If you can use Windows without it getting full of malware, you can handle unpatched Android LPEs too.
Keep in mind, Webview, browsers, email clients, etc are patched via app update mechanisms.
Re:Google urges Android phone users to switch off Wi-Fi calling
by saagarjha on Wednesday March 22, 2023 @02:28AM
(#35257519)
GPU bugs are particularly concerning because they have significant power (the GPU can often map all of physical memory if convinced to do so) and widely exposed (lots of things need graphics). Turning one of these into a full chain can often require zero bugs if the buggy API is callable from JavaScript, or one to escape the VM and poke the driver.