Hacker News Reader

Comment by fulafel | Hacker News Reader

If you follow the monthly Android Security Bulletin, there has been a long stream fixes for remote-code-execution vulnerablities in codec implementations. It got big in 2015 when the Stagefright branded vulnerability got some publicity, and they continued testing & have continued to fix an endless stream of codec vulns ever since.

There was also a Bluetooth RCE in this month's bulletin. And in November there was yet another round of WiFi pwnage, this time in Qualcomm WiFi (CVE-2018-11905). It's all quite bad.

View on HN

And this is exactly the reason why you need vendor support to apply fixes. Half of those fixes are in binary blobs, so if you don't update those (e.g you rely only on AOSP/Lineage updates), you're screwed.

Apart from the fact that the only answer right now for security-conscious android buyers is "get a Pixel" (I'm exagerating, flagship from a few vendors are good to go for 1-2 years), this is once again a reminder of the damages of binary blobs, here directly for consumers (they have non-updatable security holes).

Actually Android One devices are also guaranteed (inasmuch as the tiny text at the bottom of the Android One website [1] says) three years of security updates

> Monthly security updates to be supported for at least 3 years after initial phone release.

(scroll down to the bottom of the page and look for the double asterisks footnote. I don't know why they want to hide what is IMO the best reason to get an Android One device)

[1]: https://www.android.com/one/

Good point. They previously removed this language from the website, glad they put it back. So yeah, buy an Android One at launch is good advice for the 3 years of security support.

It's still a short window IMHO, and it's bad for the planet to throw working devices after 3 years.

The long-term solution is to move away from binary blobs. The PostmarketOS project is trying to achieve this for at least a few hardware models, including most notably the LG Nexus 5.

I've managed to find the list [1] of bulletins, but do you happen to know how one can subscribe to receive updates through email?

[1] https://source.android.com/security/bulletin

edit: in hindsight, i could have just looked at the article link rather than googling - but I still can't work out how to subscribe for updates.

Here you go: https://groups.google.com/forum/#!forum/android-security-upd...

This is great!

Unfortunately, there don't seem to be any bulletins later than March 2018 (irrespective of whether one joins the group or not).

Do any of these have public PoCs?

Reply on news.ycombinator.com