Why you don't have any Gingerbread

http://www.csc.ncsu.edu/faculty/jiang/nexuss.html

by pdx • 15 years ago

73 19 15 years ago

csc.ncsu.edu

pdx• 15 years ago

I submitted this a few days ago, in off-peak HN hours, so it didn't get any traction, but I wanted people to be aware of it, so I'm trying again.

mdwrigh22• 15 years ago

It's incredibly strange to see this on the front page given I was doing research with him last semester and ended up taking this semester off due to a massive course load. Looks like I left just a bit too early, could've got myself on the HN front page :)

moomba• 15 years ago

Surprised this didn't get ranked higher. This is kind of big news, especially since there are more android handsets than iphones nowadays.

larrik• 15 years ago

"There are more android handsets than iphones nowadays."

Do you have source for that?

kenjackson2• 15 years ago

It's a bit ironic that this isn't being fully disclosed, yet Google devs seem to believe that full disclosure is the only way to go...

mbrubeck• 15 years ago

If you're talking about this story, the Google researcher's version (which seems to be borne out by Microsoft's later responses) is that he disclosed the vulnerability only after giving Microsoft access to his findings and tools, and warning them several months in advance of the disclosure:

http://arstechnica.com/microsoft/news/2011/01/internet-explo...

kenjackson2• 15 years ago

Or this one where the Google employee gave Microsoft a whole five days: http://threatpost.com/en_us/blogs/does-google-have-double-st...

And who does full disclosure on New Year's Day? That's like waiting for a natural disaster and then saying, "BTW, been sittin on this too... full disclosure".

Lewisham• 15 years ago

If I'm reading this right, this means that the fix for the problem in 2.2 was supposed to come in 2.3, but maybe will now come in 2.4.

Except that, going with how Android upgrades have gone so far, most users on 2.2 will never see 2.3. Why is Google not pushing security updates free from carrier/manufacturer control? This is pretty terrible.

bryanlarsen• 15 years ago

My interpretation is that there is a partial but insufficient fix in 2.3.

mdwrigh22• 15 years ago

I believe they're attempting to do this by separating some of the apps from the Android framework so that they can update them independently. Unfortunately, since Android is just so different from device to device, it'd be incredibly difficult to make a single change that can be given to all devices.

And there was a partial fix for this in 2.3 as the other poster has correctly noted, and Google believed they had fixed it, but it turns out that it is still exploitable.

51Cards3• 15 years ago

"For responsible disclosure, I will not publish the details of the vulnerability until an ultimate fix is out."

Is this even responsible? Even when a fix is out it's well known that most handsets won't be able to implement it because they have no upgrade path from their manufacturer. (Samsung Galaxy and Android 2.1, I'm looking at you) You'd still put a huge percentage of the mobile market at risk by putting this out there even a year after it's corrected. Why not just sit on it and be happy you did some good for the security world.

cma• 15 years ago

There are other externalities with making a decision like that. Handset providers may look at it as a point in favor of not getting security updates out there rapidly--after all, most vulnerabilities are responsibly disclosed, and look, they seem to be holding back disclosures indefinitely since we never update, therefore, we never need to update.

gst• 15 years ago

Why should full disclosure procedures be different just because it's a mobile phone?

To quote from Wikipedia: "In the case that a vendor is notified and a fix is not produced within a reasonable time, disclosure is generally made to the public." (http://en.wikipedia.org/wiki/Full_disclosure)

I think quite a majority of the security community agrees that full disclosure is quite a bit better than security through obscurity (where you have a security vulnerability, but you hope that your enemies don't learn about it).

There's no reason why it shouldn't be possible to upgrade/fix the software on handsets within a reasonable amount of time. So why treat this any different than any other piece of software?

If you want software vendors (and handset manufacturers) to fix security holes within a reasonable amount of time then full disclosure is one of the few ways how you can put pressure on them.

51Cards3• 15 years ago

I don't believe the situations are all to be evaluated equally. In the case of this market most users even if they want to upgrade, even if they know of the problem, even if they know how to install updates, will never get them. These are devices that function for years with OS's that are immediately abandoned once released by the manufacturer. Android 1.6, 2.0, even 2.1 will probably never see another OTA update, especially since this doesn't seem to just be a quick patch issue. (considering it's not coming out until the next full release). Pressure or not there needs to be a modicum of realism as well. I don't care if you found a gaping hole in 1.6, no manufacturer is going to put out the resources to fix it, only force the end user to buy newer phones.

Full disclosure policies require some level of common sense implementation too and I don't believe they are always the best solution for a large market of essentially embedded OS's containing personal data. It would be VERY different if Google was ignoring this, then you could use releasing as leverage. But it seems they are jumping on it right away so the net positive effect has already been achieved. Why detriment the users who are HIGHLY unlikely to get an update.

If you understand the mobile community, and you understand that a large segment of them are not going to get a fix for this no matter how idealistic we hope the world could be, are you not then knowingly exposing them to risk?

Why you don't have any Gingerbread

Related Stories