安全与密码学2016checkpoint.com
Quadrooter：影响超过9亿台Android设备的新漏洞
Quadrooter: New Vulnerabilities Affecting Over 900M Android Devices
进阶 · 约 40 分钟读完前置知识：Android 系统架构、Linux 内核驱动、漏洞披露流程
导读
Check Point 的研究报告披露了影响超过 9 亿台 Android 设备的 Quadrooter 漏洞。问题出在高通芯片配套的预装驱动中，修复需要高通、OEM、运营商层层下发补丁，因此暴露面大且更新链条冗长。
HN 关注点：Android 安全更新碎片化、厂商与运营商的责任，以及安全公司在漏洞披露中夹带营销话术的问题。
后来怎么样
促使高通向 OEM 发布驱动补丁、多家厂商跟进修复，并成为讨论 Android 更新碎片化与厂商安全责任的标志性案例。但它并未改变补丁需经高通—OEM—运营商多层下发的结构。
HN 评论精选
这几条评论里：质疑 1 补充 2 亲历 1
补充呼吁监管强制厂商和运营商延长安全更新并承担安全责任。
FCC 必须严管手机的 EOL 政策和安全更新。这是电信基础设施问题。当然这会给 Google、Verizon 这类公司增加负担，但承担负担的应是它们，而不是消费者。一部几百美元设备的安全生命周期不应只有 2-3 年。这会让大量消费者完全暴露在风险中，并摧毁二手技术市场。补充：如果公司还要锁定设备和驱动 blob，让别人无法修复，那设备安全就更应完全是它们的责任。
lvs查看英文原文
The FCC absolutely must clamp down on EOL policies and security updates for phones. It's a telecom infrastructure issue. Sure it places a burden on companies like Google and Verizon, but they're the ones who deserve to carry that burden -- not consumers. The secure lifetime of a device that is hundreds of dollars should not be only 2-3 years. That leaves a dramatic number of consumers fully exposed and eliminates the secondary market for used technology. Edit: Furthermore, if the companies are going to lock down devices and driver blobs so nobody else can fix them, all the more reason that the security of the device is their absolute responsibility.
补充指出补丁链路复杂，且披露缺少实际修复覆盖数据。
报告说漏洞在高通芯片附带的驱动里，出厂预装，只能由分发商或运营商安装补丁；而它们要等高通提供修复后的驱动包。研究团队 2016 年 4 月通知高通，按 CERT/CC 的 90 天披露政策处理。高通确认风险高，并称已向 OEM 发布补丁。这种多层环节让安全更新非常困难：Android 更新本就要 OEM 加东西、运营商再加东西，固件更新又多一层。Check Point 披露做得对，但没说明补丁下发到多远、今天还有多少用户受影响。
gregmac查看英文原文
> The vulnerabilities are found in Qualcomm’s software drivers that come with its chipsets. Pre-installed on devices at the point of manufacturing, these vulnerable drivers can only be fixed by installing a patch from the distributor or carrier. Distributors and carriers can only issue patches after receiving fixed driver packs from Qualcomm. > The research team provided Qualcomm with information about the vulnerabilities in April 2016. The team then followed the industry-standard disclosure policy (CERT/CC policy) of allowing 90 days for patches to be produced before disclosing these vulnerabilities to the public. > Qualcomm reviewed these vulnerabilities, classified each as high risk, and confirmed that it released patches to original equipment manufacturers (OEMs). The complexity of this is really a problem for security updates. It's bad enough for Android updates: the OEM packages it and adds their stuff, then the carrier packages it and adds their stuff. A firmware update like this is yet another layer.. While Checkpoint did the right disclosure thing here, I notice they don't mention how far down the patches have gotten, or how many users are still vulnerable today.
质疑质疑 Check Point 的安全建议和产品宣传不靠谱。
这某种意义上是 Check Point 的典型发现。发现可能不错，指出 Android 生态问题也好。但公告里塞满废话和营销话术，更像是在混淆用户。博客说使用已知可信 Wi-Fi，旅行时只用能核实可信来源的网络——这到底什么意思？我在星巴克买了咖啡，名叫 Starbucks 的 Wi-Fi 就可信吗？又说用户和企业应考虑移动安全方案检测可疑行为，包括混淆在已安装应用中的恶意软件——我称之为胡扯。还说 ZoneAlarm Mobile Security 能让设备完全免受恶意应用和 Wi-Fi 攻击——真的吗？能解释如何克服停机问题这种理论极限吗？这让我想起之前的 Misfortune Cookie：Check Point 在 DSL 路由器上的好发现，却声称 Zone Alarm 能保护你，纯属胡说。
hannob查看英文原文
This is in a certain sense a typical checkpoint finding. It's probably a good finding and it's good that they point out the problematic andorid ecosystem. But their announcement is then filled with some nonsense and marketing bullshit that's more likely to confuse users than help. In their blog post they say [1]: * "Use known, trusted Wi-Fi networks or while traveling use only those that you can verify are provided by a trustworthy source." What's that supposed to mean? Is a Wifi trustworthy if it's named Starbucks, because I just bought a coffee there? * "End users and enterprises should consider using mobile security solutions designed to detect suspicious behavior on a device, including malware that could be obfuscated within installed apps." I call bullshit. * And then further on [2]: "ZoneAlarm® Mobile Security for Android™ keeps your mobile devices fully protected from malicious apps and Wi-Fi attacks." Oh really? Can they explain how they overcame the theoretical limits (halting problem) that prevent something like this from being possible? A lot of it reminds me to the Misfortune Cookie vuln a while ago. Also a good find from Check Point in DSL routers, yet they claimed Zone Alarm can protect you, which was outright nonsense. [1] http://blog.checkpoint.com/2016/08/07/quadrooter/ [2] https://www.checkpoint.com/resources/quadrooter-vulnerability-consumer/
亲历用户亲历 BlackBerry Priv 受厂商锁定、预装软件和运营商更新拖延困扰。
BlackBerry Priv——是的！我买这手机只是为了用钱包投票，支持更多公司做带键盘的 Android 手机。其他方面纯垃圾：是笨重的 phablet 尺寸，键盘连句号/逗号键都没有，更别说数字、tab。唯一可取是 OLED 屏和键盘，但键盘软件做得垃圾，OS 还塞满 bloatware。我等 root 等了好几个月想折腾。但 BlackBerry 带着穴居人式企业思维，觉得放 root 会吓跑还在买它产品的 5 个老头。我甚至买不到开发者版，像 Motorola 以前允许的那样。所以谢谢 Qualcomm 的粗糙代码，谢谢 BlackBerry 没做功课，谢谢 AT&T 压着 OS 更新直到有空给 bloatware 打补丁。
profeta查看英文原文
> BlackBerry Priv YES! i bought this phone only to "vote with my wallet" that more companies should make android phones with keyboards. It is pure garbage in any other aspect. It is the lame phablet size. The keyboard doesn't even have a DOT or COMMA key, let alone numbers, tab, etc. The only redeeming features is the OLED screen and keyboard. But then they made the software for the keyboard pure garbage, and filled the OS with bloatware. I've been waiting for root on this phone so i can start to hack away for months. But blackberry with its cave man corporate mentality, thinks that giving out root will scare the 5 old men still buying their products. I can't even buy a developer version like motorola (which have the same mentality) allowed before. So, thank you for the sloppy coding, Qualcomm! Thank you for not doing your homework, Blackberry! and thank you AT&T for holding OS updates until you can bother to patch your bloatware!
历次讨论
- 2016Hacker News 讨论帖175 分 · 124 评
同领域还值得读
如何入侵一台已关机的电脑：在 Intel ME 中运行未签名代码
How to hack a turned-off computer, or running unsigned code in Intel ME
这篇 Black Hat 2017 白皮书讨论 Intel Management Engine（ME）的安全问题：如何在 ME 中运行未签名代码，以及攻破处于关机状态的电脑的相关…
安全与密码学2017 · 543 分 · 107 评专业 · 约 40 分钟编辑精选比特币：一种点对点的电子现金系统（2008）
Bitcoin: A Peer-to-Peer Electronic Cash System (2008)
中本聪 2008 年发表的比特币白皮书，提出了无需可信第三方的点对点电子现金系统。
安全与密码学2017 · 536 分 · 394 评入门 · 约 45 分钟编辑精选GPRS 加密算法 GEA-1 的密码分析表明存在故意弱点
Cryptanalysis of GPRS Encryption Algorithms GEA-1 suggest intentional weakness
首次公开了对 GPRS 加密算法 GEA-1 和 GEA-2 的密码分析攻击。
安全与密码学2021 · 487 分 · 107 评专业 · 约 90 分钟编辑精选Signal 消息协议的形式化安全分析
A Formal Security Analysis of the Signal Messaging Protocol
用形式化方法分析 Signal 消息协议（TextSecure）的安全性：作者在多阶段密钥交换模型下，借助自动化证明工具对协议的密钥协商与 Double Ratchet 密钥更新…
安全与密码学2016 · 353 分 · 230 评专业 · 约 120 分钟编辑精选A2：模拟恶意硬件
A2: Analog Malicious Hardware
论文研究如何在芯片设计阶段植入模拟电路形式的恶意硬件后门，使其难以被常规检测发现。
安全与密码学2016 · 315 分 · 94 评专业 · 约 75 分钟编辑精选