Your unpatchable, insecure Android mobe will feel right at home in the Internet of Stuff era

Oh, joy.

Rockchip CPU here, not Snapdragon, but the take-away for me is: the cheap tablet is a toy and untrusted.

Mine's the one with the electrician's tape over the cameras. But still, someday they will come for me: "You. You are among the ones we seek, one of the cynics, the balas perdidas, the blackguards, les commentards pourri. For we have nipped your browser history from you silly tablet."

"And you, yes even you, have posted on... El Reg. To the Black Hole with you, sir!"

The Problem for IoT

As long as there several steps between the kernel or OS and the user security will always be dicey at best. With the IoT, this will be the norm, at least three hops if not four or five.

Ummmm yeah....

Given that your average (dodgy) android app + average user = install + insane/unnecessary access without checking anyway... Isn't this a little bit....fancy?

Oh wait. Terrible Danger!!! .. Big Drama Reveal !!!1!one! ...Much Hype!! So Terrible!! [/unimpressed]

Sorry, but we are far beyond that

Since classes of exploits like Rowhammer(JS) we know that sandboxes are only an illusion. It may help against errors, but effectively it cannot help against malevolent code. This is why it's so important that we prevent malevolent code from running at all. In short if you are running malware, you are doomed. The complex layers upon layers of code in modern mobile and desktop OSes do nothing meaningful to mitigate against this, they only introduce new security critical bugs.

The far bigger problem is of course that those bugs found here potentially could be used from the network side.

"The Internet of Things is going to bring more and more un-patchable and insecure electronics onto the market, it's feared."

Fear you should it indeed - because the level of certainty that it's going to happen is almost par with death and taxes.

Re: Qualcomm

"Qual" = german word for struggle, agony, torment.

Oh No!

Not my unpatchable, insecure Android phone as I move into the new era of the Internet of Things!!!

Oh well I guess I could just buy another one for £50 and get on with life.

Commoditization and disposability cut both ways you know.

CyanogenMod

For the Nexus 4 at least, there's only an update when someone builds it. The latest v12.1 was dated 2015-10-07, so is probably missing some Google updates. There are some v13 nightlies but I don't know if they're usable.

Closed drivers need to die

Closed drivers are a big part of the problem here.

You can't update something that has closed drivers unless the vendor cares enough to get involved. And they won't care if they are on to the next shiny.

Linux deliberately doesn't have a stable kernel ABI or API so all of it is free to evolve.

Also "open" kernel bits don't get merged if there are just for closed userspace drivers. So these open parts just rot when the vendor has moved on.

GNU/Linux userland doesn't really do stable ABIs because most of the time you can just recompile the world, all in the repository with build dependencies, and make everything use the latest and greatest and only have a, latest version of each lib. This is awesome, it really is. But closed drivers just don't fit into this world. So you get either freezing death spreading along the dependencies of closed parts, or you have to drop support for things. Which is really annoying when it's the GPU and you are doing a graphics project! Or the other way, where you can't update the kernel because of some closed component, meaning you can't use the latest Bluez on your Bluetooth project!

If GNU/Linux and the Linux went closed friendly, it would start building up legacy crud like Windows or now Android for that matter. So that's not a solution. On Android it doesn't seam so bad because it's a throw away platform, but even then it's building.

So a big part of the solution is open drivers.

For the internet of things, to stop it being the internet of infected old things, the hardware needs to be standardized so we can put our own modern firmware on when vendors move on.

The problem is I don't think there is enough far sighteness around to stop the internet of infected things happening. And only when most people's toaster and fridge are spam botnets and their TV sends everything to a blackmail gang, will real steps actually be taken to sort this unholy mess out.

jailbreak

Does this mean that I can pry my fascist carrier off my Moto G?

Thank you so much, Motorola, for refusing to allow me to unlock my bootloader. I have such warm feelings for you when you cave to the unreasonable demands for control of your partners, at the expense of your end users. I would certainly recommend you to everyone when you do things like this.

kernel version?

I just checked both my recent Android devices (one of which is a fully patched Nexus 7, running Marshmellow) and both are running a Linux kernel version 3.4.x, so why is kernel 3.10 mentioned?

Is this bug related to Android version or Linux kernel?

Will this method of getting root access trip KNOX?

Internet of Schadenfreude

Admit it, the IoT is the Schadenfreudegelegenheit of the century.

Like Donald Trump, it's funny until it happens to you.