<story><title>Quadrooter: New Vulnerabilities Affecting Over 900M Android Devices [pdf]</title><url>https://www.checkpoint.com/downloads/resources/quadRooter-vulnerability-research-report.pdf</url></story><parent_chain></parent_chain><comment><author>lvs</author><text>The FCC absolutely must clamp down on EOL policies and security updates for phones.  It&amp;#x27;s a telecom infrastructure issue.  Sure it places a burden on companies like Google and Verizon, but they&amp;#x27;re the ones who deserve to carry that burden -- not consumers.  The secure lifetime of a device that is hundreds of dollars should not be only 2-3 years.  That leaves a dramatic number of consumers fully exposed and eliminates the secondary market for used technology.&lt;p&gt;Edit: Furthermore, if the companies are going to lock down devices and driver blobs so nobody else can fix them, all the more reason that the security of the device is their absolute responsibility.</text></comment>
<story><title>Quadrooter: New Vulnerabilities Affecting Over 900M Android Devices [pdf]</title><url>https://www.checkpoint.com/downloads/resources/quadRooter-vulnerability-research-report.pdf</url></story><parent_chain></parent_chain><comment><author>hannob</author><text>This is in a certain sense a typical checkpoint finding. It&amp;#x27;s probably a good finding and it&amp;#x27;s good that they point out the problematic andorid ecosystem.
But their announcement is then filled with some nonsense and marketing bullshit that&amp;#x27;s more likely to confuse users than help.&lt;p&gt;In their blog post they say [1]:&lt;p&gt;* &amp;quot;Use known, trusted Wi-Fi networks or while traveling use only those that you can verify are provided by a trustworthy source.&amp;quot;
What&amp;#x27;s that supposed to mean? Is a Wifi trustworthy if it&amp;#x27;s named Starbucks, because I just bought a coffee there?&lt;p&gt;* &amp;quot;End users and enterprises should consider using mobile security solutions designed to detect suspicious behavior on a device, including malware that could be obfuscated within installed apps.&amp;quot;
I call bullshit.&lt;p&gt;* And then further on [2]:
&amp;quot;ZoneAlarm® Mobile Security for Android™ keeps your mobile devices fully protected from malicious apps and Wi-Fi attacks.&amp;quot;
Oh really? Can they explain how they overcame the theoretical limits (halting problem) that prevent something like this from being possible?&lt;p&gt;A lot of it reminds me to the Misfortune Cookie vuln a while ago. Also a good find from Check Point in DSL routers, yet they claimed Zone Alarm can protect you, which was outright nonsense.&lt;p&gt;[1] &lt;a href=&quot;http:&amp;#x2F;&amp;#x2F;blog.checkpoint.com&amp;#x2F;2016&amp;#x2F;08&amp;#x2F;07&amp;#x2F;quadrooter&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;http:&amp;#x2F;&amp;#x2F;blog.checkpoint.com&amp;#x2F;2016&amp;#x2F;08&amp;#x2F;07&amp;#x2F;quadrooter&amp;#x2F;&lt;/a&gt;&lt;p&gt;[2] &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.checkpoint.com&amp;#x2F;resources&amp;#x2F;quadrooter-vulnerability-consumer&amp;#x2F;&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.checkpoint.com&amp;#x2F;resources&amp;#x2F;quadrooter-vulnerabilit...&lt;/a&gt;</text></comment>