←back to thread

Remotely Compromising Android and iOS via a bug in Broadcom's WI-FI Chipsets

(blog.exodusintel.com)
387 points pedro84 | 1 comments | 26 Jul 17 19:51 UTC | HN request time: 0.205s | source
Show context
shock ◴[26 Jul 17 20:14 UTC] No.14859838[source]▶
This is kind of scary :(. How does one ensure that they aren't vulnerable to this bug?
replies(7): >>14859911 #>>14859922 #>>14859950 #>>14860039 #>>14860460 #>>14860969 #>>14861222 #
ben1040 ◴[26 Jul 17 20:33 UTC] No.14860039[source]▶
If your Android OEM has pushed the July 2017 security update to your device, you're patched.

https://source.android.com/security/bulletin/2017-07-01#broa...

replies(1): >>14860094 #
yodon ◴[26 Jul 17 20:38 UTC] No.14860094[source]▶
Out of curiosity, what fraction of Android OEMs push these security updates promptly (or equivalently what fraction of Android phones receive these kind of updates regularly)?
replies(2): >>14860468 #>>14860479 #
ben1040 ◴[26 Jul 17 21:18 UTC] No.14860468[source]▶
This page has a table of OEMs/devices that, as of the end of May, were fewer than 60 days behind on patches.

https://android-developers.googleblog.com/2017/06/2017-andro...

To me, the takeaway from this is that unless you are using a "flagship" device, or one sold directly by Google, you're probably not getting updates in a timely manner.

replies(3): >>14860737 #>>14861434 #>>14861849 #
JepZ ◴[26 Jul 17 23:49 UTC] No.14861434[source]▶
And yet another time we learn why it is better to use Lineage OS. Five year old Samsung S3:

  Android: Version 7.1.2
  Security Patch Level: 5th July 2017
replies(5): >>14861794 #>>14861921 #>>14862149 #>>14862780 #>>14867992 #
ams6110 ◴[27 Jul 17 04:46 UTC] No.14862780[source]▶
Guess I'll have to look at upgrading my diehard old Moto G. It's still on Android 5.1.1.

Meanwhile I guess disabling WiFi is a mitigation?

replies(1): >>14887714 #
1. kbenson ◴[30 Jul 17 20:44 UTC] No.14887714[source]▶
> Meanwhile I guess disabling WiFi is a mitigation?

That's a good question. If it's disabled in firmware and not actually powered down, it might still be susceptible.