News for hackers. Stuff that matters.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by scarface_74 on Thursday September 07, 2023 @04:47PM (#37425346)
Ob: this security update patches phones back to 2017 - almost six years. I assume it only affects iOS 16. Apple released a security update for devices back to the iPhone 5s (released 2013) earlier this year.

If the EU is so concerned about ewaste. They need to be more concerned about Android phones that are thrown away because they don’t get updates than a cord.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by FirmwareBurner on Thursday September 07, 2023 @04:52PM (#37425409)
1) What does this topic have to do with Android?

2) EU politicians don't know about Android updates because they don't understand how SW works and most probably have iOS anyway. The only time they hear about tech is when some Joe Schmoe insults them on Facebook so they send the courts after Facebook to doxx that person and get Facebook to moderate and ban "hate speech" on their platform. All in a day's work.

Granted, US politicians don't understand how tech works either, judging by the senate hearing of TikTok CEO ("Mr. CEO, can TikTok access my WiFi?"), but they have a powerful local tech industry to tell politicians what they should lobby for, while the EU doesn't.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by threeseed on Thursday September 07, 2023 @05:01PM (#37425535)
> What does this topic have to do with Android

It's to do with whether Android as a platform is patching older devices.

If they aren't then it may be better for everyone that they are destroyed rather than allowing them to be compromised and exposing security risks to the user.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by zelphirkalt on Thursday September 07, 2023 @04:58PM (#37425487)
That tech industry often lobbies for the wrong causes though.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by rafram on Thursday September 07, 2023 @05:58PM (#37426162)
> Mr. CEO, can TikTok access my WiFi?

That wasn’t a bad or mock-worthy question at all. TikTok’s app requests access to devices on the user’s local network. Why does it do that? Officially in order to connect to TVs/speakers, but what else could it decide to do with the access it’s granted?

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by scarface_74 on Thursday September 07, 2023 @06:06PM (#37426255)
There is a separate permission at least on iOS where an app that is connected over wifi has access to the local network.

Of course an app that streams video over the internet can “access wifi”

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by konschubert on Thursday September 07, 2023 @05:04PM (#37425573)
I don't think the EU is that much concerned about E-waste. If they were, they wound't waste their time with chargers and instead focus on appliances and cars.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by f_devd on Thursday September 07, 2023 @05:33PM (#37425908)
These things are not mutually exclusive, iirc they are doing appliances & cars, it's just that phones are often highlighted & batteries are usually the first thing that fails and can be easily replaced in all cases die to how build electronics. Charger standardization was in the pipeline for about a decade so not exactly a priority it being only passed now.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by scarface_74 on Thursday September 07, 2023 @05:50PM (#37426088)
Yes and 10 years ago the EU wanted to standardize on Micro USB. That’s not exactly a rousing endorsement on EU regulation.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by f_devd on Thursday September 07, 2023 @06:25PM (#37426458)
They didn't specify micro-b just that the phonemakers should settle on a port (which is partially why they didn't mandate it, the hope was that the industry would figure itself out but it didn't). Micro-b at the time was the most popular port for any handheld appliance. USB-C was only published in 2014.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by kaba0 on Thursday September 07, 2023 @05:34PM (#37425920)
It’s like different people can work on different legislations in parallel, you know?
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by konschubert on Thursday September 07, 2023 @06:21PM (#37426412)
If you pee on a house fire you don’t get to say that you are serious about fighting the fire.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by tareqak on Thursday September 07, 2023 @05:00PM (#37425516)
I just checked for updates for my Apple Watch as well, and I see an update for it ("This update provides important security fixes and is recommended for all users" - watchOS 9.6.2). I remember attempting to update earlier in the week (Tuesday?), and I don't remember seeing anything that day. I don't know if the update is related or not, but I decided to share anyway.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by ccchapman on Thursday September 07, 2023 @07:04PM (#37426877)
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by curiousgal on Thursday September 07, 2023 @04:51PM (#37425388)
I've never met a person who threw away a phone because of the lack of updates.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by anonymoushn on Thursday September 07, 2023 @04:59PM (#37425495)
I got a new phone last year because my old phone could not call emergency services. Even if it was still receiving updates it's not clear that this would be fixed though. Google seems to think that local regulations prevent them from fixing this users of certain of their phones on certain carriers.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by zelphirkalt on Thursday September 07, 2023 @04:59PM (#37425502)
Maybe not throw away but give away. Just look at how many people buy a new phone every 2 years or even shorter period. Something must happen to their old phones.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by flutas on Thursday September 07, 2023 @05:17PM (#37425732)
People do that exact same thing with iPhones, so clearly Apple must suck too. /s

A lot of phone purchases anymore fall into the fashion side of consumerism. They don't actually care about X, Y or Z new features. They just want to show off that they have the new thing.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by threeseed on Thursday September 07, 2023 @05:03PM (#37425560)
It is extremely common.

Most older devices are unable to run newer apps as the newer SDKs are not present.

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by rcxdude on Thursday September 07, 2023 @07:30PM (#37427122)
I've decided to upgrade instead of fix a 3-year-old phone that was because even if I could fix the hardware I still would not be able to safely enable bluetooth due to an arbitrary code execution bug in android that was not patched. It was otherwise perfectly good for my needs. I could not install a custom ROM because my model was not well supported and any I could not rely on such ROMs passing safetynet/play secure checks which the extremely vulnerable OEM ROM would reliably pass.
Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by bparsons on Thursday September 07, 2023 @04:57PM (#37425467)
>>> If the EU is so concerned about ewaste. They need to be more concerned about Android phones that are thrown away because they don’t get updates than a cord.

Huh?

Re:NSO Group iPhone Zero-Click, Zero-Day Exploit Captured in... by astrange on Thursday September 07, 2023 @06:52PM (#37426756)
There is upcoming EU regulation requiring security updates.

The problem there isn't commercial Android phones, it's open source projects that can't guarantee anything.