Google Attacks The Messenger Over Android Vulnerability
from the not-very-friendly dept
There was plenty of news over the weekend about a security flaw found in Google's Android mobile operating system that could allow certain websites to run attack code and access sensitive data. The security researchers have said they won't reveal the details of the flaw, even though it's apparently a known flaw that is in some of the open source code in Android that Google did not update. However, that didn't stop Google from attacking the messenger, claiming that the security researcher who discovered the flaw broke some "unwritten rules" concerning disclosure. First of all, there is no widespread agreement on any such "unwritten rules" and many security researchers believe that revealing such flaws is an effective means of getting companies to patch software. Considering that Android's source code was revealed last week, it's quite reasonable to assume that many malicious hackers had already figured out this vulnerability, and making that news public seems to serve a valuable purpose. It's unfortunate that Google chose to point fingers, rather than thanking the researcher and focus on patching the security hole.![Hide This Hide this](https://ii.techdirt.com/s/t/i/topclose.png)
Thank you for reading this Techdirt post. With so many things competing for everyone’s attention these days, we really appreciate you giving us your time. We work hard every day to put quality content out there for our community.
Techdirt is one of the few remaining truly independent media outlets. We do not have a giant corporation behind us, and we rely heavily on our community to support us, in an age when advertisers are increasingly uninterested in sponsoring small, independent sites — especially a site like ours that is unwilling to pull punches in its reporting and analysis.
While other websites have resorted to paywalls, registration requirements, and increasingly annoying/intrusive advertising, we have always kept Techdirt open and available to anyone. But in order to continue doing so, we need your support. We offer a variety of ways for our readers to support us, from direct donations to special subscriptions and cool merchandise — and every little bit helps. Thank you.
–The Techdirt Team
Filed Under: android, flaw, messenger, security
Companies: google
Reader Comments
Subscribe: RSS
View by: Time | Thread
Flaws and Patches
Second, flaws need to be illuminated in the FOSS world faster than in the "proprietary" world. More eyes on the code.
Let Google whine they have built a multi billion dollar company on FOSS and FOSS tools.
Google put someone on it and fix the problem already!
[ link to this | view in chronology ]
Re: Flaws and Patches
[ link to this | view in chronology ]
Google..
[ link to this | view in chronology ]
Re: Google..
Also sad is that I'm certain that the apocalypse is going to become a self-fulfilling prophecy thanks to the fundamentalists rising in the ranks of our governments.
[ link to this | view in chronology ]
Re: Re: Google..
[ link to this | view in chronology ]
Re: Google..
[ link to this | view in chronology ]
Not to rain on Android or iPhone's parade... but, well you know...
[ link to this | view in chronology ]
FOSS
That's just bad form. Not saying I wouldn't do it, but it's bad form. In open source, it's better to just file a bug in the bug tracking system as a security bug and let the handlers respond before going to the papers. Mozilla even pays a bug bounty for this. It's more like $500 instead of $50000, but people complain less.
I'm assuming that Google has a maintained Bugzilla-style system. That may not be the case.
[ link to this | view in chronology ]
Not trusting the computer
I've never seen so many bug patches in my life as in the past 6 months. Then they won't tell you the details of what the update does. Maybe it does nothing but provide access to your files.
I remain curious what the top CIA guy meant when he said the only safe computer was 'unplugged in a corner and not connected to any network'.
Does he know something we don't? Thanks Top CIA guy for the heads-up.
[ link to this | view in chronology ]
Re: Not trusting the computer
I have a customers who is an attorney, for whom I built a client database system (turnkey, including hardware). Just before I loaded his data into the system, I disconnected it from his network, and told him NEVER connect that system to the internet again. And NEVER install any other software on it. I provided several USB flash drives for backups using backup software that I wrote, and told him NEVER put those drives into any other machine except the hot backup that I also provided. I super-glued an RJ45 plug into the ethernet connectors on both systems. As long as he follows those directions, those system cannot be hacked unless somebody gains physical access to them. (Ok, it's possible for somebody with the right gear to eavesdrop remotely, but the script-kiddies don't have access to that sort of thing. Yet.)
--
www.chl-tx.com The 2nd Amendment isn't about hunting ducks.
[ link to this | view in chronology ]
Re: Not trusting the computer
I remain curious what the top CIA guy meant when he said the only safe computer was 'unplugged in a corner and not connected to any network'.
What he means is that the only foolproof security is total inaccessability, and not just with computers. Any lock can be defeated. Any wall can be breached. The only way to be certain is to put it where the locks, doors, and walls themselves cannot be reached. Launched to the moon, for example.
So, too, with computers. As long as it is powered up waiting, and will accept you logging in, your security can be breached. All one needs is to know enough to fool the computer into believing the attacker is you.
[ link to this | view in chronology ]
Re: Re: Not trusting the computer
If you can launch it to the moon, then somebody else can launch themselves to the moon and go get it and break into it. I think when we're talking about security here, we mean remote access security. Clearly no physical security system is impenetrable, but that's not the point. The point is no computer security system is impenetrable either, so the only perfect protection from remote exploits is to completely disconnect the computer from all networks.
[ link to this | view in chronology ]
Does he know something we don't? Thanks Top CIA guy for the heads-up.
It makes sense to me - with a slight paranoid touch, you can easily reason that every computer system can eventually be hacked. Therefore, the only way to secure it is to keep it the hell out of the way of the world ("the only safe computer is in the centre of a nuclear explosion" doesn't have the same ring).
[ link to this | view in chronology ]
Re:
It still won't be able to tell your secretes.
[ link to this | view in chronology ]
Re: Re:
I also doubt that there are many people who use Van-Allen Phreaking
[ link to this | view in chronology ]
[ link to this | view in chronology ]
Re:
[ link to this | view in chronology ]
Re: Re:
So start your anti-Google campaigns and wait for your next start-up corporate savior to come along.
[ link to this | view in chronology ]
False Dilemma
[ link to this | view in chronology ]
ummm....
[ link to this | view in chronology ]
Re: ummm....
[ link to this | view in chronology ]
Re: Re: ummm....
How is Google being evil?
FTFA:
[ link to this | view in chronology ]
Google
[ link to this | view in chronology ]
They're Both Wrong
Everyone = happy.
In Charlie Miller's defense: Google doesn't have to whine about it. Its code, its flawed just for the fact that people created it. Deal with it. So you didn't get a heads up, don't feel bad for yourself. Say to the guy "Why didn't you tell us first...meh, who cares, lets fix this before it becomes a major problem." And accept a little hurt pride. Its not about the ego, its about getting it done right. Even if it means everyone knows about it.
Everyone = happy.
My two cents.
But then again, the world doesn't work my way.
[ link to this | view in chronology ]
Unwritten Rules
These "Security Experts" (hackers) need to know these rules.
The first step is always to notify the company privately of the security issue to see if they will respond.
It is at that point, when a determination is made to whether or not to go public with the issue.
If a company was not responding to the issue even after being notified (let's say within 90 days - software development takes time), then the security group has the option to go the public to get the company to move on the issue.
The one good thing I can say is at least the security isn't releasing details on the flaw, but they still should have gone to Google in private first.
[ link to this | view in chronology ]
Re: Unwritten Rules
[ link to this | view in chronology ]
Unwritten Delusions.
I can see the benefits of giving the software companies a heads up, however those companies with bad track records, which Google proud member of, should not be afforded any such courtesy.
I'm not sure I find the selling of the exploits to third parties very palatable, but with the absence of merchantability that the software market throughly enjoys there's not much one can do about that other then frown :P
[ link to this | view in chronology ]
Re: Unwritten Delusions.
From all I know, the last company on that list should be google.
[ link to this | view in chronology ]
Re: Re: Unwritten Delusions.
[ link to this | view in chronology ]
[ link to this | view in chronology ]