New Android Security Flaw Discovered

Flaws abound in all phones, otherwise there would not be such a healthy jailbreak community (iphone) and rooting (Android)… probably similar for KaiOS and others. As soon as flaws are found and exploited, the relevant companies shut them off and release a new security patch but the various hacking communities are pretty dedicated. I guess one of the reasons I stay with Apple is getting security updates for a very long time for the phones I have…and once they stop being supported, I stop using them. I have 3 android phones here, and none have recent firmware so I guess I should probably bin them in the appropriate place. They still work, but they are so insecure… dont want to.

The assurance needed is that a hard factory reset will rewrite all the flash (Non volatile) storage to erase absolutely your prior content.

I happily said goodbye to my old dumb phones after a full reset as they held minimal data, and chose to keep contacts etc on the SIM.

P.S.
Unlike finding a flaw in a diamond ring, a flaw in a mobile device does not make it worthless.

Fortunately my personal rating on Spies Finder International is a large negative number. It would seem unlikely that anyone will be seeking my services or phone secrets anytime soon. I don’t keep passwords, or pins or any similar details on my mobiles. Just contact details, most of which is readily accessible to government agencies. Those of use to me and those to whom I am of no benefit.

Personally I’m more concerned about getting paralysis ticks on me when working outside or accidentally disturbing one of the low bellied sliders often at my feet. The latter are more polite choosing to shyly and quietly exit, a bit like a caught out naughty child. The former are unwanted free loaders, happy to sneak on board, and take advantage without first asking permission or announcing their arrival. A better use of Australian Border Force and Homeland Security resources if the Minister asks for my opinion.

The ARM architectures are part of both the Android and Apple hardware chipsets. At that level they are similar (not exactly the same), it is the OS and firmware and attached extra hardware above that that is so different.

From the Wiki article on ARM (Wiki links left intact):

“Arm cores are used in a number of products, particularly PDAs and smartphones. Some computing examples are Microsoft’s first generation Surface and Surface 2, Apple’s iPads and Asus’s Eee Pad Transformer tablet computers, and several Chromebook laptops. Others include Apple’s iPhone smartphone and iPod portable media player, Canon PowerShot digital cameras, Nintendo Switch hybrid and 3DS handheld game consoles, and TomTom turn-by-turn navigation systems.”

Of possible interest is that the owners Softbank (A Japan based Corporation) is currently considering selling it’s ARM business off. Nvidia and Apple may be interested in the purchase if it becomes reality.

1 Like

I’ll likely make do with a hammer.

2 Likes

Your choice will work better. Unless a device’s internal storage has been encrypted (standard setting on new Android models), a hard reset does not adequately wipe your data. It is still recoverable.

4 Likes

I remember many years ago little programs which rewrote over empty and disk sectors where files were ‘deleted’ so that data (or parts thereof) couldn’t be recovered. I haven’t heard much about these lately and whether encryption has in effect, replaced this function.

We used the programs to scrub reformatted portable media (esp. used floppies which were repurposed) the company may have given to others to ensure there was no data which could be recovered,

3 Likes

Yes, they are still around. DBAN (Darik’s Boot And Nuke) is the best-known, and rewrites data several times (user-specified), with an option of wiping methods.

I suspect that even using a ‘hard reset’ on a device will leave your data alone. It is probably the same process as formatting PC storage - you wipe the index but leave the data.

3 Likes

Apple’s support is commendable - and much better than your typical Android phone where the game of Chinese whispers between Google and the manufacturer and the plethora of models supplied by the manufacturer can often mean that software updates die far too quickly.

The problem here is the contrast between the secretive Apple and the not quite so secretive hardware in Android phones.

So, yes, both chips may have flaws, even the same flaws in this case, and the security researchers (white hat hackers) have found the flaw in the case of the chip in typical Android phones but they may never find the flaw in Apple phones.

So who does find the flaw in Apple phones?

Noone. You win.
Black hat hackers / nation states. You lose.

Not Apple. So it may never get fixed.

The DSP CPUs in the Snapdragon SoC are not ARM architecture (and this is the relevant CPU for the above security research). So, yes, all the main CPU cores are ARM (in just about all the smartphones on the planet) but I would hazard a guess that none of the ancillary CPU cores is ARM. Not the DSP. Not the GPU. Not the Image Processor. Not the Motion Processor. Not the AI engine. …

There’s a decade’s work white hatting all that. :wink:

… and the Raspberry Pi. (The main Wikipedia article on ARM applications does list the Pi.)

1 Like

or the momma?

2 Likes