Always strive to learn something useful. --Sophocles

This is mind-bogglingly bad. "Samsung shipped an estimated 100 million smartphones with botched encryption, including models ranging from the 2017 Galaxy S8 on up to last year’s Galaxy S21."

FOUR YEARS they blew it?! And Samsung was supposed to be the flagship of Droid phones?! There were two major flaws, one was fixed after it was revealed, then the second, dealing with initialization vectors, which was also there from the beginning, wasn't fixed until another paper was published.

Sorry, I'll happily stick with my lovely walled-garden iPhone. But to each their own. It may have its own issues, but I think their attitude to security is better than the Android paradigm.

As a commenter on Slashdot points out, "... Apple just issued a Security Update in September, 2021 that patches iOS 12, covering models clear back to lhe iPhone 5s." Instead, Google just obsoleted the Pixel 3, released three years ago.

'Build things fast and break shit' indeed. Great paradigm when you have your life's history in a device in your pocket. And it's not secure.

https://threatpost.com/samsung-shattered-encryption-on-100m-phones/178606/

https://mobile.slashdot.org/story/22/02/24/222207/samsung-shattered-encryption-on-100-million-phones#comments

The defense contractor arm of Boeing is going to make a highly secure smart phone, based on the Android platform.

"Earlier this week, it was revealed that aerospace firm Boeing was working on a high security mobile device for the various intelligence departments. This device will most likely be released later this year, and at a lower price point than other mobile phones targeted at the same communities. Typically, phones in this range cost about 15,000-20,000 per phone, and use custom hardware and software to get the job done. This phone will most likely use Android as it's main operating system of choice, which lowers the cost per phone, since Boeing's developers don't have to write their own operating system from scratch."

$15-20k per unit. Yep, sounds like a defense contractor. Wasn't it just recently that the NSA announced that it was going to do a secure phone system based on Android? I'm sure their unit cost would be a bit lower.

I am curious, though, who would build this? Boeing is not an electronics manufacturer per se, they're certainly not a cell phone maker. If they intend this for covert use, they're going to have to buddy-up to someone like Nokia or Samsung or LG to make the phone look like a standard smart phone to allay suspicion, plus it can't really have a Boeing label on it, that'd be a bit of a giveaway.

Seems to me that it's a monumental waste of money if the NSA is already doing a similar project.

http://mobile.slashdot.org/story/12/04/15/1513222/boeing-preparing-an-ultra-secure-smartphone

Ah, yes: March 8, NSA and German government encrypting Android phones: http://thewayne.livejournal.com/787608.html


Last month the results of the 'Honey Stick Project' were announced in which Symantec 'lost' several bugged smart phones to see what people do when they find one. The results pretty much confirm the worst of human nature.

"In order to get a look at what happens when a smartphone is lost, Symantec conducted an experiment, called the Honey Stick Project, where 50 fully-charged mobile devices were loaded with fake personal and corporate data and then dropped in publicly accessible spots in five different cities ...Tracking showed that 96-percent of the devices were accessed once found (PDF), and 70-percent of them were accessed for personal and business related applications and information. Less than half of the people who located the intentionally lost devices attempted to locate the owner. Interestingly enough, only two phones were left unaccounted for; the others were all found."

My aunt found a cell phone in a casino. The smart thing to do would be to give it to casino security, instead she took it home. Fortunately it still had a charge when she told me about it, and I found an address book entry for Dad and called it and found out his daughter had lost it, conveniently she worked for FedEx in El Paso, so she called the Las Cruces office and I dropped it off there. I don't think I would poke in to a discovered smart phone beyond trying to identify the owner and get it back to them, but human nature being what it is, who knows? This particular lost phone wasn't a smart phone, which reduces the temptation to pry in to personal information. My phone does contain sensitive information, but the really sensitive info is in a password-protected encrypted system, so it's fairly safe. And there's no banking info on it, nor has it ever accessed my bank account, so that's safe.

Plus, it's an iPhone, so it's easy for me to remotely brick if I lose it, assuming the discoverer doesn't know how to pop the SIM chip.

http://mobile.slashdot.org/story/12/03/12/2351227/honey-stick-project-tracks-fate-of-lost-smartphones


And finally, Google's Android app store Play has been found to have lots of malware lurking inside in the form of apps that send expensive SMS messages without you knowing it.

"We've seen quite a few Android malware discoveries in the recent past, mostly on unofficial Android markets. There was a premium-rate SMS Trojan that not only sent costly SMS messages automatically, but also prevented users' carriers from notifying them of the new charges, a massive Android malware campaign that may be responsible for duping as many as 5 million users, and an malware controlled via SMS. Ars Technica is now reporting another Android malware discovery made by McAfee researcher Carlos Castillo, this time on Google's official app market, Google Play, even after Google announced back in early February that it has started scanning Android apps for malware. Two weeks ago, a separate set of researchers found malicious extensions in the Google Chrome Web Store that could gain complete control of users' Facebook profiles. Quoting the article: 'The repeated discoveries of malware hosted on Google servers underscore the darker side of a market that allows anyone to submit apps with few questions asked. Whatever critics may say about Apple's App Store, which is significantly more selective about the titles it hosts, complaints about malware aren't one of them.'"

This would well and truly suck. I think that most of the freedoms that Android offers are great, but as it has been said, the price of freedom is eternal vigilance and it's difficult for an end user to be vigilante about the software on their phone because most of us are not programming experts that would allow us to determine if a program is safe or not.

http://mobile.slashdot.org/story/12/04/14/195215/more-malicious-apps-found-on-google-play

They're applying strong crypto and logging to the voice stack, not much detail as to whether the data on the phone is encrypted which I think would be fairly trivial. They're also discussion about Germany encrypting other smart phone OS's. It'd be cool if the software were released to the public, but that'd totally screw law enforcement and CALEA.

http://www.h-online.com/security/news/item/NSA-German-government-using-Android-for-secure-phones-1466294.html

First, available only in beta on Android phones right now, is an application called iOnRoad. You mount your phone on a windshield or dash carrier, and your phone monitors the driving conditions around you and sounds alerts if the distance between you and the car in front of you begins reducing precipitously. It's not perfect, but it is interesting. They say an iPhone version will be available later this winter.

http://www.wired.com/geekdad/2012/01/ionroad-app-for-android/


Next week's CES show marks the 5th anniversary of the introduction of the iPhone. It wasn't available at retail until June, but the slavering began in January.

I got an iPhone 4S just after Thanksgiving last November and I've been quite happy with it. It's been reliable, it reduces the number of devices in my pocket from 2-4 down to 1, and it's reliable. It will be interesting to see how smart phones, both iOS and Android, continue to evolve.

http://www.wired.com/gadgetlab/2012/01/iphone-five-year-anniversary/

The thot plickens. BT alleges that Android violates:
* 6,151,309: a 2000 patent for "service provision system for communications networks"
* 6,169,515: a 2001 patent for a "Navigation information system"
* 6,397,040: a 2002 patent for location tracking of users
* 6,578,079: a 2003 patent for a "communications node for providing network based information service"
* 6,650,284: a 2003 patent for an "information system" with "a fixed part and a mobile part"
* 6,826,598: a 2004 patent for "storage and retrieval of location based information in a distributed network of data storage devices"

The suit was filed in Delaware, I'm curious why they didn't go for West Texas. It'll be interesting to see how this plays out. I'm really sick and tired of patent wars, the system has mutated far beyond what it was intended what patents should protect.

http://www.h-online.com/open/news/item/Google-sued-over-Android-and-services-by-BT-1397721.html

http://yro.slashdot.org/story/11/12/19/139236/bt-sues-google-over-android

A couple of things in the news about the HP TouchPad, the WebOS tablet device that was blown-out in August for $99. The OS and the tablet got pretty good reviews, up until the point that HP decided to abandon all WebOS development at a cost to them of a billion dollars or so. It's the operating system that they acquired when they bought out Palm Pilot, and it powered their Palm smart phones.

The first piece of news is that HP is having a mondo big sale on eBay tomorrow, Sunday, 11 December, at 6pm Central Standard Time, and will be blowing out "an unspecified quantity" of factory refurbished units at the $99+ price. An accessory pack will be available, and the units will have a 90 day warranty.

http://techcrunch.com/2011/12/07/hp-touchpad-ebay/

http://hardware.slashdot.org/story/11/12/08/1545236/hp-reviving-the-99-touch-pad-on-december-11th

The other piece of news is that HP is releasing the WebOS to the open source community. It was speculated that RIM, the makers of Blackberry, would buy it. I think it would have been a good fit for RIM, but I guess it didn't happen. HP claims that they will be an active participant in the project, but I tend to question that since they've bought in to Windows Mobile OS for cell phones. No one is making hardware for this OS, and the Android community have been very active in porting to it, so I'm not sure how useful WebOS going open source will be.

I think you're going to see two things. The highest amount of activity will be the Android TouchPad community as they'll be trying to get their apps already in the various Android app stores working on the TouchPad. You'll see some WebOS activity for the newness of it, people will study it to see how they did things and what other interesting things they can adapt in to other open source projects. Some people will write some bug fixes and new interconnectedness link software, but I don't think this will be a huge group. I think the least activity will be people doing new development in WebOS. There's no growing hardware base: all of the hardware has been made, and that number will suffer a steady decline over the years as it fails and is with increasing rapidity eclipsed by newfangledness. I don't think that you'll see any manufacturers building hardware for the WebOS, it's too easy to just make it for Android, which has a growing and vibrant community.

So you've got two camps (IMO): the hackers who want an inexpensive tablet to root, port Android to it, and enjoy the heck out of it, and the people who don't pry beneath the covers and buy an inexpensive tablet and use it until it gets glitchy, then they'll bitch that they can't get it repaired and dump it for an iPad or Android tablet or eBook reader.

That's what I think, but what do I know.

http://www.wired.com/gadgetlab/2011/12/hp-webos-open-source/

http://www.h-online.com/open/news/item/HP-to-make-webOS-an-open-source-project-1393262.html

http://mobile.slashdot.org/story/11/12/09/1857254/hp-making-webos-open-source


This puts me in a bit of a conflicted bind. I was planning on buying a Nook Tablet from Barnes & Noble, if you're a member you can get them for $225. It would be brand-spanking new and have all sorts of wonderful support available through a major corporation that, as far as I'm hearing, is doing a very good job of keeping customers happy with it. Or I might be able to drop less than half that for a unit that has no company support, only a 90 day warranty, and to expand it's capability I'd have to install a new operating system on it that would be dependent on varying quality levels of community support.

I'm probably going to go with the Nook. I'm tired of having to wrestle with software, I don't want to think about the number of systems that I've had to patch, bring back from the dead, and sacrifice brindled calves to in the pale moonlight over the last 20+ years as an IT person. I just want to have confidence that my shit will work when I hit the power button, and that it won't be difficult to find good resources to fix it if it glitches or dies.

Sounds a lot like Zone Alarm Pro, the only software firewall that I have a lot of experience with (and quite liked).

http://yro.slashdot.org/story/11/05/04/0428224/Marlinspikes-Droid-Firewall-Kills-Tracking


In other news, Apple released an iOS patch today to fix their location tracking kerfuffle.

Amazon requires that your phone be set to allow apps from untrusted sources, which can open your phone to exploits. Google's app store does more inspecting, but is still not invulnerable. Amazon won't consciously allow compromised apps through, but you never know. And Amazon doesn't have a remote kill switch to remove installed apps that are found to be compromised like Google does.

http://www.wired.com/gadgetlab/2011/03/amazon-app-store-security/