Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.misc > #7969 > unrolled thread

SwiftKey vulnerability lets hackers easily take control of devices

Back to article view | Back to comp.misc

Contents

  SwiftKey vulnerability lets hackers easily take control of devices Sylvia Else <sylvia@not.at.this.address> - 2015-06-19 17:25 +1000
    Re: SwiftKey vulnerability lets hackers easily take control of devices voyager529 <voyager529@live.com> - 2015-06-25 15:27 -0400
      Re: SwiftKey vulnerability lets hackers easily take control of devices Sylvia Else <sylvia@not.at.this.address> - 2015-06-26 19:12 +1000
        Re: SwiftKey vulnerability lets hackers easily take control of devices Mike Duffy <see_website@signature.block> - 2015-06-26 20:08 -0400
          Re: SwiftKey vulnerability lets hackers easily take control of devices Marko Rauhamaa <marko@pacujo.net> - 2015-06-27 08:12 +0300
            Re: SwiftKey vulnerability lets hackers easily take control of devices Mike Duffy <see_website@signature.block> - 2015-06-27 01:24 -0400
              Re: SwiftKey vulnerability lets hackers easily take control of devices Marko Rauhamaa <marko@pacujo.net> - 2015-06-27 08:29 +0300
          Re: SwiftKey vulnerability lets hackers easily take control of devices Sylvia Else <sylvia@not.at.this.address> - 2015-06-27 18:12 +1000
            Re: SwiftKey vulnerability lets hackers easily take control of devices polygonum <rmoudndgers@vrod.co.uk> - 2015-06-27 13:14 +0100

#7969 — SwiftKey vulnerability lets hackers easily take control of devices

<http://www.independent.co.uk/life-style/gadgets-and-tech/news/samsung-galaxy-hack-swiftkey-vulnerability-lets-hackers-easily-snoop-on-phones-10325574.html>

So, some obscure technical mistake has introduced a vulnerability into 
the phones.

Well, actually no. It appears the problem is just that the software 
auto-updates itself without ensuring that the server is trusted, and 
(presumably) not requiring that the update be cryptographically signed.

So, just mind-boggling incompetence. Nothing new there.

Most countries have consumer protection laws. If someone suffers a loss 
as a result of this, they really ought to sue Samsung.

Sylvia

[toc] | [next] | [standalone]

#7980

On Fri, 19 Jun 2015 17:25:16 +1000, Sylvia Else
<sylvia@not.at.this.address> wrote:

><http://www.independent.co.uk/life-style/gadgets-and-tech/news/samsung-galaxy-hack-swiftkey-vulnerability-lets-hackers-easily-snoop-on-phones-10325574.html>
>
>So, some obscure technical mistake has introduced a vulnerability into 
>the phones.
>
>Well, actually no. It appears the problem is just that the software 
>auto-updates itself without ensuring that the server is trusted, and 
>(presumably) not requiring that the update be cryptographically signed.
>
>So, just mind-boggling incompetence. Nothing new there.
>
>Most countries have consumer protection laws. If someone suffers a loss 
>as a result of this, they really ought to sue Samsung.
>
>Sylvia

Interesting question: If Samsung only licensed the software from
Swiftkey, would it really be Samsung who should shoulder the lawsuit,
or Swiftkey themselves?

[toc] | [prev] | [next] | [standalone]

#7985

On 26/06/2015 5:27 AM, voyager529 wrote:
> On Fri, 19 Jun 2015 17:25:16 +1000, Sylvia Else
> <sylvia@not.at.this.address> wrote:
>
>> <http://www.independent.co.uk/life-style/gadgets-and-tech/news/samsung-galaxy-hack-swiftkey-vulnerability-lets-hackers-easily-snoop-on-phones-10325574.html>
>>
>> So, some obscure technical mistake has introduced a vulnerability into
>> the phones.
>>
>> Well, actually no. It appears the problem is just that the software
>> auto-updates itself without ensuring that the server is trusted, and
>> (presumably) not requiring that the update be cryptographically signed.
>>
>> So, just mind-boggling incompetence. Nothing new there.
>>
>> Most countries have consumer protection laws. If someone suffers a loss
>> as a result of this, they really ought to sue Samsung.
>>
>> Sylvia
>
> Interesting question: If Samsung only licensed the software from
> Swiftkey, would it really be Samsung who should shoulder the lawsuit,
> or Swiftkey themselves?
>

Unless the relevant consumer laws state otherwise, it would be against 
Samsung, since the consumer has no contract with Swiftkey.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#7991

On Fri, 26 Jun 2015 19:12:37 +1000, Sylvia Else wrote:

> Unless the relevant consumer laws state otherwise, it would be against 
> Samsung, since the consumer has no contract with Swiftkey.

Did you ever read (all the way to the end) the Samsung licence agrreement?

I gave up and turned off auto-update of my phone when I got to the special
section for Quebec. I am not a lawyer, but on the face of it it looks
imperturbably unenforceable according to Quebec law.

Quebec law clearly states that french documents where available take
precedence over english translations under the civil code. But the Quebec
addendum (in french) states that the english copy of the contract takes
precedence over the french translation. So you end up with a circular
reference in the legal precedence relationship of the two versions.

-- 
http://pages.videotron.com/duffym/index.htm

[toc] | [prev] | [next] | [standalone]

#7992

Mike Duffy <see_website@signature.block>:

> Quebec law clearly states that french documents where available take
> precedence over english translations under the civil code. But the Quebec
> addendum (in french) states that the english copy of the contract takes
> precedence over the french translation. So you end up with a circular
> reference in the legal precedence relationship of the two versions.

I fail to see the circularity. I'm seeing a pattern emerging:
translations are informative, originals are normative.


Marko

[toc] | [prev] | [next] | [standalone]

#7993

On Sat, 27 Jun 2015 08:12:38 +0300, Marko Rauhamaa wrote:

> I fail to see the circularity.

The TOS says that local laws supercede provisions of the contract if there
is a conflict.

Quebec law says that french copies of any contract supercede versions in
any other language.
 
The french copy of the Quebec addendum to the contract states that the
english version of the contract supercedes the french version.

-- 
http://pages.videotron.com/duffym/index.htm

[toc] | [prev] | [next] | [standalone]

#7994

Mike Duffy <see_website@signature.block>:

> On Sat, 27 Jun 2015 08:12:38 +0300, Marko Rauhamaa wrote:
>
>> I fail to see the circularity.
>
> The TOS says that local laws supercede provisions of the contract if there
> is a conflict.
>
> Quebec law says that french copies of any contract supercede versions in
> any other language.
>  
> The french copy of the Quebec addendum to the contract states that the
> english version of the contract supercedes the french version.

No, the previous posting said French documents supersede English
*translations* and the English TOS supersedes the French *translation*.
No circularity there.

Maybe the previous posting was phrased sloppily.


Marko

[toc] | [prev] | [next] | [standalone]

#7999

On 27/06/2015 10:08 AM, Mike Duffy wrote:
> On Fri, 26 Jun 2015 19:12:37 +1000, Sylvia Else wrote:
>
>> Unless the relevant consumer laws state otherwise, it would be against
>> Samsung, since the consumer has no contract with Swiftkey.
>
> Did you ever read (all the way to the end) the Samsung licence agrreement?
>
> I gave up and turned off auto-update of my phone when I got to the special
> section for Quebec. I am not a lawyer, but on the face of it it looks
> imperturbably unenforceable according to Quebec law.
>
> Quebec law clearly states that french documents where available take
> precedence over english translations under the civil code. But the Quebec
> addendum (in french) states that the english copy of the contract takes
> precedence over the french translation. So you end up with a circular
> reference in the legal precedence relationship of the two versions.
>

I suspect many software licence agreements are, at least in part, 
unenforceable, particularly where the software comes as a necessary 
adjunct to a physical object such as a phone.

In the present case, even if the licence agreement purported to limit 
Samsung's liability in respect of the software, that would fail to get 
past consumer protection laws in jurisdictions such as Australia, where 
the law expressly prevents a supplier from contracting out of its 
liabilities under the law.

Sylvia.

[toc] | [prev] | [next] | [standalone]

#8000

On 27/06/2015 09:12, Sylvia Else wrote:
> On 27/06/2015 10:08 AM, Mike Duffy wrote:
>> On Fri, 26 Jun 2015 19:12:37 +1000, Sylvia Else wrote:
>>
>>> Unless the relevant consumer laws state otherwise, it would be against
>>> Samsung, since the consumer has no contract with Swiftkey.
>>
>> Did you ever read (all the way to the end) the Samsung licence
>> agrreement?
>>
>> I gave up and turned off auto-update of my phone when I got to the
>> special
>> section for Quebec. I am not a lawyer, but on the face of it it looks
>> imperturbably unenforceable according to Quebec law.
>>
>> Quebec law clearly states that french documents where available take
>> precedence over english translations under the civil code. But the Quebec
>> addendum (in french) states that the english copy of the contract takes
>> precedence over the french translation. So you end up with a circular
>> reference in the legal precedence relationship of the two versions.
>>
>
> I suspect many software licence agreements are, at least in part,
> unenforceable, particularly where the software comes as a necessary
> adjunct to a physical object such as a phone.
>
> In the present case, even if the licence agreement purported to limit
> Samsung's liability in respect of the software, that would fail to get
> past consumer protection laws in jurisdictions such as Australia, where
> the law expressly prevents a supplier from contracting out of its
> liabilities under the law.
>
> Sylvia.

The issue for me, right now, is to find out what I can do about it, or 
even if it affects me. I don't remember the last update my Samsung S2 
got! Sat with JellyBean 4.1.2 from 2013. I don't want to get rid the 
phone yet (am waiting to make a decision about replacement as the rest 
of this year's phones get released). Indeed, is the keyboard software

-- 
Rod

[toc] | [prev] | [standalone]

Back to top | Article view | comp.misc

csiph-web