this post was submitted on 25 Jul 2023
334 points (100.0% liked)
Privacy
789 readers
6 users here now
A place to discuss privacy and freedom in the digital world.
Privacy has become a very important issue in modern society, with companies and governments constantly abusing their power, more and more people are waking up to the importance of digital privacy.
In this community everyone is welcome to post links and discuss topics related to privacy.
Some Rules
- Posting a link to a website containing tracking isn't great, if contents of the website are behind a paywall maybe copy them into the post
- Don't promote proprietary software
- Try to keep things on topic
- If you have a question, please try searching for previous discussions, maybe it has already been answered
- Reposts are fine, but should have at least a couple of weeks in between so that the post can reach a new audience
- Be nice :)
Related communities
Chat rooms
-
[Matrix/Element]Dead
much thanks to @gary_host_laptop for the logo design :)
founded 5 years ago
MODERATORS
you are viewing a single comment's thread
view the rest of the comments
view the rest of the comments
Unless you have some evidence that half of the Android userbase is using devices that are "basically the property of some overseas crime ring", I am going to assume this is just hysteria on your part. Please read the definition of "likelihood" while you're at it.
I do indeed: the Android Security Bulletins. Bear in mind that most people don't install a custom operating system after the stock OS stops receiving updates.
Even for those who do, however, those vulnerabilities listed under a heading like “Qualcomm closed-source components”—that is, firmware vulnerabilities—are still present on their devices. See, for example, this list of firmware vulnerabilities fixed in an update as of December 2019. If you have a device that stopped receiving updates before then, it still suffers from those vulnerabilities no matter what OS you run on it, and many of them are RCEs that give successful attackers complete control of the device.
As for “likelihood”, infosec does not work that way. Cybercriminals and hostile foreign intelligence agencies don't sleep and don't show mercy. If you have a vulnerability that your adversaries know about and can feasibly exploit, then they are already exploiting it. That's why vulnerability disclosure embargoes are a thing.
Was there something specific in there that actually backed up your claim? A link to a generic landing page is not what I was asking for. As I have said repeatedly, I do not deny that there are exploits which are theoretically feasible and have been carried out on some scale. What I am asking for is evidence that every old Android device has already been compromised (your claim) and/or for data that proves this is a widespread issue.
My previous comment contains two links. The second one points to a list of vulnerabilities in Qualcomm closed-source firmware that were fixed.
For your convenience, here it is again: [link]
Cybercrime groups obviously aren't going to publish reliable statistics on the crimes they've committed. One should generally assume that known vulnerabilities are already actively exploited unless there is evidence to the contrary.
I don't know why you keep linking examples of known vulnerabilities .This is not what I am asking for, and I have never once denied their existence. If you can't provide evidence to support your claim that every old Android device has already been exploited and is "the property of an overseas crime ring" then just say so. Stop shifting the goalposts and pretending otherwise - it's a waste of my time and yours.