Google Pixel phones pwned in zero-click attacks

22 days ago by solrize to c/android

CISA gives federal agencies just 3 days to patch

Interestingly this seems to be an attack against the modem. I had thought modems were well separated from the rest of the phone by now.

bhamlin 31 points 22 days ago

Hmmm. Install the update that will enforce the sideloading restrictions, or risk pwning... 🤔

path: 0 25931879, hotness: undefined, score: 31, children: 22
VeganCheesecake 26 points 22 days ago

You have a Pixel. Put Graphene on it. No more sideloading restrictions, and you get the update.

https://grapheneos.org/install/web (needs Browser that supports WebUSB, meaning Chromium based. CLI Installer is also available.)

path: 0 25931879 25933791, hotness: undefined, score: 26, children: 6
Squizzy 15 points 21 days ago

Sideloading restrictions will still affect the people who make the apps though.

It is an insane power grab

path: 0 25931879 25933791 25937290, hotness: undefined, score: 15, children: 0
bhamlin 2 points 21 days ago

Yes, I do, and I have. But I also manage my wife's phone and my mother's phone and Graphene is a bridge too far for them. And it would be less painful for me to get them on iPhones.

They rely on apps that currently must be installed manually or from f-droid. I've been considering apple nonsense for them because the ability to (relatively) painlessly use software of our own choosing is the only distinguishing feature left for their use case. And there are actually apps on the store there that address their needs.

path: 0 25931879 25933791 25938208, hotness: undefined, score: 2, children: 4
db_null 3 points 21 days ago

Graphene, for the lay person, seems to me indistinguishable from Android, if you get them a decent launcher. You can still install anything they need from F-Droid and put Aurora Store for anything commercial they would like.

The difference under the hood is what makes it interesting.

path: 0 25931879 25933791 25938208 25938964, hotness: undefined, score: 3, children: 2
dropdrip 4 points 20 days ago

Yes. GrapheneOS isn't a bridge too far for anybody. It's a modified Google Android. It's in the background and out of mind; it's an operating-system for mobile-computers; it is Android. It's like saying, "A Samsung is a bridge too far". It doesn't even make sense. Family members are used to Android mobile-computers? Guess what? GrapheneOS is Android.

It's blatantly absurd to ditch Google's Android out of a concern about monopolistic abuse and buy an Apple product... I'm sure they can twist themselves into knots attempting to explain it, but it probably comes down to, "I want an iPhone."

I want to state clearly: all of this bullshit is collective. Have a fucking spine. Use free-software on your computers. Stop letting Microsoft/Google/Apple fucking rape everyone. That's capital being slurped up only to further cement their monopolies and fuck everyone else over. Your decisions matter. If your point is that your family-members are drop-kicks and don't know how to use a computer how can you explain your decision? Let Google or Apple look after them? Hello? We're kind of in this situation from that trajectory... Knuckle down and let's continue then. Nothing changes.

path: 0 25931879 25933791 25938208 25938964 25953310, hotness: undefined, score: 4, children: 0
Railcar8095 1 point 20 days ago

Graphene teams recommends to use google play over third party or even Aurora.

And restrictions due to securenet will be noticeable when it impacts banks and some weirdly picky apps. Some apps even refuse to run if installed from Aurora instead of google play.

path: 0 25931879 25933791 25938208 25938964 25953365, hotness: undefined, score: 1, children: 0
VeganCheesecake 2 points 20 days ago

I get it. I have my brother and mother on it, and sandboxed play is enough to make it mostly transparent to them, but I guess if they rely on the Google components of the Pixel ROM a lot, switching might be difficult for them.

path: 0 25931879 25933791 25938208 25952635, hotness: undefined, score: 2, children: 0
MoreZombies 5 points 22 days ago

No such thing as side loading - it is just installing

path: 0 25931879 25932551, hotness: undefined, score: 5, children: 13
bhamlin 3 points 21 days ago

Sadly, it's never just been "installing". If it isn't on "the store", there's always been a hurdle to getting it on your device. They just keep putting bigger and scarier hurdles in place.

path: 0 25931879 25932551 25938101, hotness: undefined, score: 3, children: 1
dropdrip 4 points 20 days ago

Yes and using their terms like "side-loading" is another introduced hurdle. Using that term reinforces that new, imaginary hurdle. It's new-speak. It's your personal-property; it's your computer; you have every legal-right to install what you want on your computers. Google is attempting to do something new: dictate absolutely your private-property. That's absurd. Don't even try and defend it.

path: 0 25931879 25932551 25938101 25953412, hotness: undefined, score: 4, children: 0
artyom 0 points 21 days ago

Weird, it seems "just installing" requires so many more steps...

path: 0 25931879 25932551 25939051, hotness: undefined, score: 0, children: 10
lka1988 2 points 20 days ago

Steps that are nothing more than an artificial barrier enforcing Google's control over the OS.

path: 0 25931879 25932551 25939051 25956832, hotness: undefined, score: 2, children: 0
MoreZombies 0 points 20 days ago

Well half the problem people have is all the hurdles Google puts in the way.

If I install a game on my PC through Steam or by downloading the files directly instead of the Windows Store then it's still just installing no matter if Microsoft put a thousand "are you sure?"s in the way.

path: 0 25931879 25932551 25939051 25952270, hotness: undefined, score: 0, children: 8
kuneho 1 point 20 days ago

Those are installing, yes. But I think there's no such thing as sideloading vs installing, since, sideloading is a way of installing stuff.

for instance, if I wanted to install an app on my BlackBerry Z30, I needed a special tool running in your browser to do so. So a 2nd device, with a protocol. That second device surely then "just" installed my software. But I would call that sideloading, since I needed a 2nd device that has the way to install stuff on my phone.

if I can just click the apk on my phone to get it installed... then that's installing. But if I need my PC and a special tool (e.g. adb) to do the installation for me (again, 2nd device, custom software etc... and there's no other way) then it's sideloading again.

Installing from Steam or Windows Store is not sideloading, since you don't need anything special. And using a tool that's already on your target device is nothing special IMO.

If Steam would need to run on a seperate device to install games on your PC, that surely can be sideloading. Also, if I buy a Switch game from Nintendo Store webpage and tell it to install it on my Switch, it's sideloading again.

This is how I like to thing of the word sideloading, at least.

But overall, sideloading is installing - so in the end, there's no such thing as sideloading anyway.

path: 0 25931879 25932551 25939051 25952270 25953337, hotness: undefined, score: 1, children: 7
diaphragmwp 2 points 20 days ago

Play Services are updated separately from the rest. I am pretty sure the install restrictions will be Android 8+.

path: 0 25931879 25953277, hotness: undefined, score: 2, children: 0
hendrik 18 points 22 days ago

They probably are. But everyone can talk to the modem via the cellular network or the internet.

path: 0 25928518, hotness: undefined, score: 18, children: 0
rowinxavier 17 points 22 days ago

Which devices though? All Pixel devices? Just a specific subset? Which specific modems have this vulnerability? No specificity at all, just Pixel devices, and also this is happening while they are slow rolling their updates being accessible to GrapheneOS and co.

path: 0 25931899, hotness: undefined, score: 17, children: 1
webhead 3 points 20 days ago

Modern tech journalism at its finest! This is how every fucking article is now. Vague slop put together for clickbait with no actual specifics on what you're talking about. Maybe a person wrote this idk but zero time was spent on it or they would have managed basic information like which phones rather than vaguely naming an entire line of them.

path: 0 25931899 25957582, hotness: undefined, score: 3, children: 0
eleitl 3 points 21 days ago

It is interesting, since GrapheneOS claims good modem separation. Perhaps it's a good idea to disable baseband altogether, or not buy devices with baseband.

path: 0 25937166, hotness: undefined, score: 3, children: 2
majster 1 point 20 days ago

Yeah but no amount of HW hardening can guarantee SW without bugs.

path: 0 25937166 25953094, hotness: undefined, score: 1, children: 1
eleitl 1 point 20 days ago

True. So WiFi only airplane mode on GOS is reducing the attack surface. MiFi routers with AP can provide connectivity when traveling.

path: 0 25937166 25953094 25953843, hotness: undefined, score: 1, children: 0
android
android

@lemmy.world

login for more options
34845
2227
1879

DROID DOES

Welcome to the Android community on Lemmy. Here you can participate in amazing discussions and events relating to all things Android.

The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:

Rules


1. All posts must be relevant to Android devices/operating system.


2. Posts cannot be illegal or NSFW material.


3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.


4. Non-whitelisted bots will be banned.


5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.


6. Memes are not allowed to be posts, but are allowed in the comments.


7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.


8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.


Community Resources:


go to feed...