Well, good. The moment they stop, it's declared E-waste and Apple suggests you give it to them for free.
Fucked-up world we live in where a disposable vape can be reused for more purposes than an iPhone with expired software support.
replies(4):
Fucked-up world we live in where a disposable vape can be reused for more purposes than an iPhone with expired software support.
My pile of old android phones ... they sadly do not live long overall as far as a % of survivors goes. A few have lived long lives for sure, but overall not as many as my old iPhones.
Even if there was no mention of this or the implication that it’s linked to the notifications Apple sends for targeted attacks, is it fair to say this kind of backdated security patch implies a lot about the severity of the vulnerability? What’s Apple’s default time frame for security support?
Edit: I should've read, "Impact: Processing a malicious image file may result in memory corruption."
So simply receiving an image via SMS or loading it in some other way likely accomplishes the initial exploit, so yeah, zero click exploit. Always bad.
That is my assumption, that the result is a pretty severe impact and/or the victim has little to no way to prevent it (zero click situation).
Granted I can't speak for Apple, but I was thinking along the same lines you were.
This isn't thaaaaat far out of support. Their last security update for iOS 15 was just earlier this year, and they only dropped iPhone 6s from new major versions with iOS 16 a few years ago. As someone who has kept my last few iPhones for 5+ years each, I definitely appreciate that they keep a much longer support window than most folks on the Android side of things.
Granted, there's PLENTY of other good reasons to make that choice even with that condition. So I don't disagree generally.
I worked at a restaurant chain and I remember it being a whole thing to even consider reworking the POS tables + software due to rising costs.
I assume they know just how long their customers keep their phones and maintain them accordingly.
My Android phones still do everything they say on the tin. Regardless, you've worded your entire argument to be orthogonal to my original point so it's clear you're not arguing in good faith. Nothing you ever said was related to the principles I mentioned, just what you consider to be personally valuable. Which is fine, but akin to responding to a health food nut by saying how great burgers taste.
The 6S was discontinued in 2018, which would give it support until at least 2023, so we aren’t too far beyond that.
I fully expect to be using my current Android phone into the 2030s.
I'm migrating from my 5 year old flagship (lol) only because vendor decided to stop supporting it. Battery still good for a day, great screen, good enough camera, fantastic sound, ssd card slot...
My next has at least 7 years of mainline support (with all AOSP releases) plus at least couple of years damage control updates.
It's a matter of the choose I think.
It seems to me that this exploit was used in a chain with a WhatsApp issue that would trigger the malicious DNG data to be loaded as a zero click, presumably just into WhatsApp. It’s unclear to me if there was a sandbox escape or kernel vulnerability used along with this; it might have been used to exfiltrate WhatsApp messages only.
This would explain why there’s only a single patch for a simple memory corruption issue; usually an attacker would need a lot of chained vulnerabilities to bypass mitigations on iOS, but if the vulnerability is in the exact target application to begin with, it sure does make things easier.
Pixels 6-7 got 5 years. I'd say that's on the low end of okay.
For "lol" you have to go back to 2021 or earlier. Or look at some of Motorola's offerings.
The latest release of Xcode, Xcode 26, still allows you to build apps for iOS 15. At some point you will have the secondary problem of needing an older Xcode which only runs on an older macOS, though Apple has been doing the minimum to make it possible to acquire both of these.
With a free Apple Developer account, you can sign and side load your apps, but they expire every 7 days, and you wouldn't be able to add any restricted entitlements. But the TrollStore exploit (https://github.com/opa334/TrollStore), which I cannot vouch for, seems to work around these limits.
So: It seems like if you are the kind of person who keeps disposable vapes to reprogram the microcontrollers, the iPhone 6S should actually be an attractive device worth keeping:
- Runs an operating system released in September 2021 and received regular bug fixes and security updates through July 2024. Still receives occasional security updates as of September 2025. Not completely end-of-life.
- Supported by the latest developer tools, probably through June 2026, with older downloads available (https://xcodereleases.com/).
- Known jailbreaks and exploits to maximize utility.
It's not surprising that the trade-in value for a 10-year-old device is nil, but on the secondary market they fetch about $60 (https://swappa.com/prices/apple-iphone-6s) which is not bad if you consider the device capabilities compared to most hobbyist devkits.
The full exploit chain seems to target WhatsApp directly using a second bug in WhatsApp; although this vulnerability is definitely present anywhere this kind of image is processed using Apple’s native image support, it would usually be aggressively sandboxed (in iMessage by BlastDoor and in Safari by the web content sandbox), so you’d need a lot more vulnerabilities than those that are currently disclosed to make it useful in those places. A bug in WhatsApp itself is particularly bad in terms of spyware actors, since it leaves one of their most popular targets, WhatsApp, vulnerable without a significantly more complex kernel escalation and sandbox bypass.
Also my company, as well as at least 1 other I know of that uses iPads, don’t sell the iPads to the stores, they replace or buy their iPads directly from Apple. Smaller places handle it all themselves, larger might use MDM but they are buying them at-cost.
I’m not saying everyone does that, just that I’m not aware of it.
My friend at the time had an iPhone 5, I noticed her phone worked without issue while my Nexus 5 was constantly draining its battery.
I finally bought an Apple device and 11 years later never looked back. Finally said goodbye to Windows & Linux as well. I presume this is how many Apple conversions happen.
Back when Pixel came out I used to argue with a friend because it supposedly had a better camera: I'd always point out that the Pixel phone has its own Wikipedia article describing all its issues: https://en.wikipedia.org/wiki/Pixel_(1st_generation)#Issues
Its been like 12 years since the G1? They are still playing games till this day. Give it a rest already.
looks like Pixel 8 was released October 2023, so not even 2 years ago. not sure I'd put much stock in what Google says about support after <30% of the stated time.
> Pixels 6-7 got 5 years.
looks like Pixel 6 was released October 2021, so not even 4 years ago.
Of course it's still up to phone manufacturer to integrate these changes, but it puts an effective security support timeline on even 3rd party ROM's like lineageos. They can cherrypick, but it's not as secure once that support ends.
Apple has almost everything in-house (except until recently, modems). So they have a ton of flexibility in continuing to provide updates.
I'll believe Google's promises after they keep them, not before.
I had 3 pixels over the years. all 3 died after 1-2 years tops. And repairability is zero. absolutely would not recommend if you're a digital nomad. meanwhile my iphone 14 is still going strong. Battery life has gone down but still acceptable.
It’s not clear to me if this can result in a RCE. If it does, then does this mean that enough iPhone 6s are still out in the wild where a bad actor could easily take over a big enough portion to do more nefarious things?
From a ROI, for corporate phones, Apple iPhones had a longer lifespan, which is why we bought hundreds of iPhones, and not Androids.
On a personal note, I had the Nexus S, the Nexus 5, and they all died a horrible death either from lack of updates, or just having the physical button break, and the microphone stop working.
And let us not speak of Sony Xperia Z5, which all of sudden removed their fingerprint sensor due to a North American patent problem. They also broke their bluetooth audio so that song names STOPPED being displayed. That was all in a span of less than 3 years.
Never again Sony Android phones.
At that point, I got fed up of custom ROMS and joined the "iPhone, it just works" group and moved on.
I’d be more afraid of a zero day image parsing bug in messages, where I could be exploited with a drive-by spam text or hyperlinked image, than some theoretical baseband attack by someone in a privileged cell network system.
Actually, similar reason that I ended up abandoning Windows for Linux on my home desktop (I had been using Linux on work computers for years at that point). Windows 10 kept changing my settings back to default after every major update and it was infuriating. I would have gone for a mac if there were better support for games.
> Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
7 to 10 years is a 50% increase. Diminishing marginal returns dents that. But it still represents huge quantities of metal and resources.
The Apple patch in the OP is in regards to a zero-interaction exploit that compromised the device to install spyware etc.
> Impact: Processing a malicious image file may result in memory corruption. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals.
It’s honestly kind of sad. Google could still print money without the endless spying but they just can’t help themselves
https://www.androidauthority.com/google-pixel-10-911-calling...
> iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Air 2, iPad mini (4th generation), and iPod touch (7th generation)
That's a lot of devices, more so than "10-year old iPhone 6s" implies.
I won't be upgrading my iPhone 7 and 4th gen iPad mini, because I don't want to take the chance that the update needs an update to Dopamine to be jailbroken. Fortunately they're secondary devices for me.
They literally couldn’t.
Isnt this exactly the point? Most people who aren't the target of state intelligence agencies have little to worry about from using an older phone.
And yes, you get a full blown Linux with it. So you can, like me, repurpose your smartphones into pretty much everything. I have removed their batteries and have them solar powered as Freifunk routers and even offline-ready kiwix media servers among other things.
For me it was also the Nexus 5.
It just lost many of my photos, of our firstborn child.
Unrecoverable. Gone. And so was I from the Android-platform.
I still see few custom roms spoofing as early pixel models to enable unlimited google photos.
Apple literally has the scale to go to Qualcomm and buy slightly customized variants (the X71, for instance). And those modems are integrated with their custom Apple designed chips. I don't see any other vendor able to do that.
(I'm actually somewhat interested in the answer... I have a use-case, and the seeming inability to test is a bit worrying)
https://www.911.gov/calling-911/frequently-asked-questions/#...
[0] https://www.911.gov/calling-911/frequently-asked-questions/ [1] https://www.nasna911.org/home
Same for politicians; they make a claim, they have to sign a bond against all their assets that they’ll do it after the election.
It’s the equivalent of saying in response to a political issue that affects all of society - doesn’t really affect me because I flew to my private island. We’re happy for you, but how does that advance the conversation?
https://www.reddit.com/r/googlephotos/comments/xsn9ij/people...
Why in the world would you think that? Who do you think governments target, Bond villains?
This is the same for absolutely every manufactured goods. The same durable car model will be kept for over a decade by some people while some other opt for a leasing plan that guarantee a new car every two years. But the intrinsic quality of the car remain unaffected.
To ponder this you must consider what become of the phone they replace : did they trash it or did they have a second life with a less edgy owner?
It just sounds like you’re bragging about your technical chops, like a person with a private island would be flexing their wealth.
This means that any fix needs to be backported to that special tree, irrespective of whether the Broadcom code is impacted, which may prove challenging when you end up having not just one but many trees, each at slightly different levels of outdatedness.
The approach clearly does not scale.
The solution would be for Broadcom to be diligent and forward port their tree to current mainline or current LTS at a minimum but they won't do that.
See how the RPi kernel is generally stuck at a special old version (e.g 6.6 for pi4, which is quite reasonably a LTS but then there's 6.12 as LTS already)
Maybe that's because of the boogeyman being feared and so people update enough to make such attacks not common enough to be worth it, so once we stop fearing it... but idk. So far it hasn't mattered to have devices with Bluetooth vulnerabilities at hacker conferences of all places
However, without a tested migration path, it may break your phone and make you factory reset + reflash the ROM if it doesn't work out, and there's nobody you can turn to or blame when that goes wrong. There's no official support, but that doesn't mean it'll never work.
Testing migration paths is a massive pain, especially when you're upgrading a whole bunch of parts all at once, and volunteers have more fun and frankly more important things to work on.
You seem to have hit all the bad luck and concluded (fairly) that anything but Apple must be bad. I seem to have hit all the bad luck on the Apple side. The device I got from work ran out of updates after fewer years than I privately use my Android, and not before the touchscreen partially broke, various apps had software issues that didn't manifest on other (identical) phones, the battery went bad, and certain OS features like hotspot didn't work half the time you tried to turn them on. I've simply never had these issues on Android, and if e.g. an app doesn't work, I can just wipe its data. On iOS there's no such button; it's not something you should need because in 95+% of cases "it just works" and so they don't let you. It's not your device
Currently I'm trying to help an Apple user whose email client broke, both on iOS and macOS, with unexplainable "could not connect" behavior that no other user is seeing (Windows, Android, and Linux all represented). It differs whether they use mobile data or WiFi, but in different ways on different OSes and email clients. Sometimes IMAP works partially (connecting, fetching mail, but not loading folders). I'll probably have to travel 90 minutes each way to see what I can debug on their device. They're tech savvy and we're both perplexed by the different behaviors but there isn't much you can see on iOS so we had given up on mobile email. Now that it's happening on macOS as well suddenly, maybe we can figure something out
It's just not a vendor I'd want to work with myself because there keep being major issues with very limited ways of fixing them. I'm sure most of the functions "just work", just like most Android phones "just work" and you hit a bad apple with that Sony device. At least on Sony you can install a different OS if the issues are major enough that people put in the effort of making one
- The apps you run get exploited and your outdated OS can't protect you - An app you install exploits your OS - Someone attacks a system component and exploits your OS
The first risk can be mitigated mostly by just updating your browser/email client/webview engine/etc, which Google supports long past an OS version's lifetime. Android apps typically get updated for five or six versions behind the latest one.
The second attack vector is always a risk (0days do exist), but probably won't harm you if you have a set of trusted apps. There's always the risk of a supply chain attack, but I haven't heard of that in practice outside of cracked apps or that shitty spamware you find on Google Play.
The third vector probably won't affect you either because most system components aren't directly exposed. iOS has a history of getting exploited through simple MMS messages but on Android those processes are harder to exploit (and can often be updated years later through Google Play if you use the Google ones).
There was a huge flaw in Google's Bluetooth stack which pretty much allowed RCE on any phone with Bluetooth enabled. If your phone hasn't been patched against that, you have to be careful about leaving Bluetooth oh. Same goes for WiFi, but those bugs are harder to exploit.
There's a risk, but in practice millions to billions of people use outdated Android versions and malware strains abusing that fact aren't very common, especially not if you don't install weird third party apps from shady sources.
Part of the challenge of exploiting Android devices in practice is that there are endless combinations of firmware versions+device models+system app versions+kernels. iOS, on the other hand, generally has a handful of models, often running predictable software stacks because of Apple's decent track record when it comes to software updates.
Android exploitations does exist: various spyware companies use remote attack vectors, including WhatsApp or MMS like on iOS, to deploy targeted exploit chains to their victims. In practice, that's a risk to journalists, human rights activists, and other people The Government Doesn't Like Very Much (any government, really). Outdated phones are also easily dumped by law enforcement, so if you do anything that could be considered illegal, better not take your phone across international borders.
They started with the WebViews that vendors refused to update leading to all kinds of exploitation. These days, system components like the bytecode runtime and the Bluetooth stack can be updated by Google, unless the manufacturer actively prevents Google from doing that.
Firmware remains an issue, and IOMMU protections aren't all that great on every single device, but more and more Android internals get maintained by Google these days.
As for messages, there is always a risk in the pipeline between modem and the system service, but the Messages app is just another app you can update through Google Play or whatever store you prefer. Same with the dialer app and plenty of other apps. The super-integrated components that make for preferred exploitation targets on iOS aren't set up the same way on Android (not that Android doesn't have other attack vectors, of course).