TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

Google Deletes App on Pixel Phones–'Dangerous' New Spyware Warning

15 点作者 erickhill9 个月前

4 条评论

onychomys9 个月前
&gt; In terms of the origins of the app, Google told me “this is not an Android platform nor Pixel vulnerability, this is an apk developed by Smith Micro for Verizon in-store demo devices and is no longer being used. Exploitation of this app on a user phone requires both physical access to the device and the user&#x27;s password.”<p>If an attacker has your phone and your password, it&#x27;s game over anyway, who cares if some random app could allow MITM connections over HTTP.
评论 #41264151 未加载
flanbiscuit9 个月前
&gt; Google assured me it is taking action, telling me that “out of an abundance of precaution, we will be removing this from all supported in-market Pixel devices with an upcoming Pixel software update. The app is not present on Pixel 9 series devices.” And while iVerify’s report focused on Pixel, Google also said it is “notifying other Android OEMs.”<p>Just as I saw this HN thread and started reading the article, I also noticed on my Pixel 8 phone had an Android 14 update (the &quot;August 5th, 2024&quot; update) which included this security patch: <a href="https:&#x2F;&#x2F;source.android.com&#x2F;docs&#x2F;security&#x2F;bulletin&#x2F;pixel&#x2F;2024-08-01" rel="nofollow">https:&#x2F;&#x2F;source.android.com&#x2F;docs&#x2F;security&#x2F;bulletin&#x2F;pixel&#x2F;2024...</a><p>It includes 1 CVE patch for Pixel: CVE-2024-32927, which has a &quot;high&quot; severity and is an &quot;Elevation of privilege&quot; type. Android Bug ID: 312268456*.<p>When you look up the CVE is has no details, and the asterisk next to the Android Bug ID means that it&#x27;s not publicly available[1]. This article just posted today but I wonder when the research and interviews for the article happened. Maybe the August patch includes the fix, or maybe it&#x27;ll be the next one.<p>1. <a href="https:&#x2F;&#x2F;issuetracker.google.com&#x2F;issues&#x2F;312268456" rel="nofollow">https:&#x2F;&#x2F;issuetracker.google.com&#x2F;issues&#x2F;312268456</a> - this is the android bug link, you can see in the network you get a 403 from one of the api calls, but for other bugs you don&#x27;t
bastawhiz9 个月前
This appears to be a huge nothingburger.<p>1. The app is installed by Verizon<p>2. The app is disabled by default (&quot;The app is not enabled by default, but there might be multiple methods to enable it. The iVerify research team investigated one method requiring physical access&quot;)<p>The actual report:<p><a href="https:&#x2F;&#x2F;iverify.io&#x2F;blog&#x2F;iverify-discovers-android-vulnerability-impacting-millions-of-pixel-devices-around-the-world" rel="nofollow">https:&#x2F;&#x2F;iverify.io&#x2F;blog&#x2F;iverify-discovers-android-vulnerabil...</a><p>Their quote:<p>&gt; Google is essentially giving CISOs the impossible choice of accepting insecure bloatware or banning Android entirely.<p>That doesn&#x27;t sound like the case at all!
评论 #41264161 未加载
olliej9 个月前
TLDR: Verizon store demo app with a variety of system privileges was downloading payloads over http and was not performing any authentication on what it received.<p>Not Google’s fault (beyond trusting carriers to not be incompetent :D)
评论 #41258099 未加载