AKA : they installed a backdoor to spy on people
I wonder if it is on the "Secure" OSs like Graphene and Calyx
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Android Phones Exposed to Remote Access Vulnerability
- Thread starter MacRumors
- Start date
- Sort by reaction score
AKA : they installed a backdoor to spy on people
I wonder if it is on the "Secure" OSs like Graphene and Calyx
Well the article here is very poorly written and it implies it affects all Android smartphones when its just the Pixels that are confirmed as affect.And yet Android users come into the iPhone forums to tell us how superior their platform is.
Here, a much better article.
Google will remove a carrier app from Pixel phones that left a 'troubling' security hole
A new report reveals that many Google Pixel phones sold over the past few years have a “Showcase” app installed...
9to5google.com
Showcase.apk is a carrier app created for Verizon to demo the phones in stores. Also this app doesn't come preloaded on the Pixel 9 for example. It will be a very quick and easy fix. Google doesn't sell many phones anyway, 0.00001% of Android users are potentially affected by this.
Also very important:
They actually tried to access the app and they couldn't
Last edited:
Pixel 9 doesn't come preloaded with this apk, its not affected.
And even if it was, a simple updated to remove the app is all that's needed.
https://grapheneos.social/@GrapheneOS/112967309987371034
"Wired was manipulated into spreading misinformation to market Palantir and iVerify by misrepresenting a vulnerability in a disabled demo app as being a serious problem which could be exploited in the real world. They should retract the article but won't."
"iVerify are scammers and anyone paying them money should rapidly stop doing it and remove their malware from their devices. The real security risk is giving remote code execution on your devices to one of these sketchy EDR companies lying about their capabilities and discoveries."
Not much more to say about it.
"Wired was manipulated into spreading misinformation to market Palantir and iVerify by misrepresenting a vulnerability in a disabled demo app as being a serious problem which could be exploited in the real world. They should retract the article but won't."
"iVerify are scammers and anyone paying them money should rapidly stop doing it and remove their malware from their devices. The real security risk is giving remote code execution on your devices to one of these sketchy EDR companies lying about their capabilities and discoveries."
Not much more to say about it.
Yeah also:
So in order to exploit it you need full access to the device at which point, why would somebody bother with this app? especially since its a Pixel thing mostly.
It is not confirmed to be limited to only Pixels. "It’s not clear if other Android devices also have “Showcase” installed, but Google is apparently “notifying other Android OEMs.” Also, this was a dormant app that no one was using, so it should have been removed a long time ago. Better late than never but it seems like Google was slow to deal with this.
Well actually only Pixels are confirmed to be affected, anything else is implied/assumed. The fact that Google notified others doesn't mean they are affected.
Anyway the app was always disabled and in order to activate it you need physical acces to the phone and it's password at which point why bother with this app at all? Also those at 9to5Google tried to activate the app themselves and couldn't, so its not walk in the park even if you want to do it to your own phone.
Google knew very well what this was and maybe set up a schedule for when they issue the app removal update. It's not a burning problem like it was initially implied.
"The application, called Showcase.apk, is normally dormant. But iVerify was able to enable it on a device in its possession, and the company believes skilled hackers could also enable it from afar."
I did the "research" and it turns out that he was wrong...and it only took one click to get to the WaPo article. So what "research" did you do?
Your key words are ‘for me’…
* The camera image processing easily beats iPhone for me. Photos look truer to what my eye sees, vs the over saturated weird skin tones on the iPhone (iPhone still wins on video)
* Snappier UI. The iPhone feels more fluid, but also feels slow in comparison. Some may remember the speed of ios6. That’s what my Pixel feels like.
* Call screening is a killer feature. The voicemail thing on iOS doesn’t compare
* It’s 2024 and I STILL can’t set an independent or rising volume level on my iPhone alarm. I don’t want to use bedtime.
* No need to carry two phones thanks to work profile. My iOS work colleagues all have to carry two iPhones which is kind of ridiculous.
* Many small things. The phone simply feels more like a ‘smart’ phone, and makes my iPhone feel very dull and limited.
To finish on positives for the iPhone, the oled and True Tone easily outclass the pixel display. I don’t know why Google doesn’t address this. And of course the apps are more polished because developer seem to love iOS. The aesthetic experience remains a winner for the iPhone. The focus is different for these two ecosystems. Strengths in both, which is why I use both.
This is a quote from GrapheneOS admin, who studied this kind of apps(and knows what they do), it's not a real vulnerability. In order to exploit it you need full device access anyway at which point, why would somebody bother with this app? iVerify is being disingenuous about the gravity of this because they are trying to take advantage of this to promote themselves.
Google said the following: “Out of an abundance of precaution, we will be removing this from all supported in-market Pixel devices with an upcoming Pixel software update,”
There's nothing to counter, even Google said:
“Out of an abundance of precaution, we will be removing this from all supported in-market Pixel devices with an upcoming Pixel software update,”
If this would have been a general Android vulnerability they would have issued an Android update not just a Pixel update.
Also you can be certain iVerify would have mentioned all the other affected Android OEMs if they existed, just to increase the impact. This is what they are after, coverage.
Last edited:
And yet Android users come into the iPhone forums to tell us how superior their platform is.
"Unpatchable" flaw in Apple M1/M2/M3 chips: GoFetch is the new Spectre - The Mac Security Blog
A serious flaw in Apple’s M1, M2, and M3 chips could enable attackers to break the security of Macs (and perhaps iPads and Apple Vision Pro). Here is everything you need to know about how GoFetch might affect you.
www.intego.com
Apple Chip Flaw Leaks Secret Encryption Keys
Plus: The Biden administration warns of nationwide attacks on US water systems, a new Russian wiper malware emerges, and China-linked hackers wage a global attack spree.
What’s your point?
PS: I am no Android user.
Intel also had a flaw and yet it was mitigated, however the m1/2/3 requires physical access….correct? I think that’s his point."Unpatchable" flaw in Apple M1/M2/M3 chips: GoFetch is the new Spectre - The Mac Security Blog
A serious flaw in Apple’s M1, M2, and M3 chips could enable attackers to break the security of Macs (and perhaps iPads and Apple Vision Pro). Here is everything you need to know about how GoFetch might affect you.www.intego.com
Apple Chip Flaw Leaks Secret Encryption Keys
Plus: The Biden administration warns of nationwide attacks on US water systems, a new Russian wiper malware emerges, and China-linked hackers wage a global attack spree.www.wired.com
What’s your point?
PS: I am no Android user.
If we are getting technical go deeper. Pointless fanboys wing batting does not make things better for anyone.
His point was simply that iOS is superior when it comes to high risk vulnerabilities and he used this event to claim it.
Security flaws and patching is not only a thing of non Apple tech.
Keep whatever system you use updated to the latest.
Article
cyber.gov.rw
Last edited:
The point is there are vulnerabilities and then there are vulnerabilities. Saying there is a vulnerability in a vacuum without supporting information is pointless. Zero day zero clicks are obviously the worse.
iOS has had its share. But when I look at the CVE list imo android has more red flags, imo.
Security flaws and patching is not only a thing of non Apple tech.
Keep whatever system you use updated to the latest.
Article