Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.mobile.android > #33248 > unrolled thread

QuadRooter security flaw -- confusion

Back to article view | Back to comp.mobile.android

Contents

  QuadRooter security flaw -- confusion "Percival P. Cassidy" <Nobody@NotMyISP.net> - 2016-08-09 12:14 -0400
    Re: QuadRooter security flaw -- confusion Tim <timothybil@yahoo.com> - 2016-08-09 12:31 -0500
      Re: QuadRooter security flaw -- confusion "Percival P. Cassidy" <Nobody@NotMyISP.net> - 2016-08-09 13:58 -0400
        Re: QuadRooter security flaw -- confusion Tim <timothybil@yahoo.com> - 2016-08-09 22:38 -0500
          Re: QuadRooter security flaw -- confusion nospam <nospam@nospam.invalid> - 2016-08-09 23:57 -0400
          Re: QuadRooter security flaw -- confusion Chris <ithinkiam@gmail.com> - 2016-08-10 07:20 +0000
          Re: QuadRooter security flaw -- confusion Andy Burns <usenet@andyburns.uk> - 2016-08-10 09:27 +0100
        Re: QuadRooter security flaw -- confusion "Percival P. Cassidy" <Nobody@NotMyISP.net> - 2016-08-11 13:08 -0400
    Re: QuadRooter security flaw -- confusion Nigel Wade <nmw@local.domain> - 2016-08-10 09:48 +0100

#33248 — QuadRooter security flaw -- confusion

Yesterday morning, immediately after reading about the QuadRooter 
security flaw that exists in some QualComm chips, I ran the Check Point 
QuadRooter Scanner app, which told me that my Nexus 5X phone (with the 
July security patches) was *not* affected.

My wife's Nexus 5X (bought a few days before mine) already had the 
August security patches, and the Check Point QuadRooter Scanner app told 
us that her phone *was* affected.

Yesterday afternoon my phone got the August security patches, and I ran 
the Check Point QuadRooter Scanner app, which told me that my Nexus 5X 
phone *was* affected.

I then ran QualComm's own scan tool on both phones, and it told me that 
my phone is *not* affected but that my wife's *is* affected.

I hope the new security fix comes soon.

Perce

[toc] | [next] | [standalone]

#33253

"Percival P. Cassidy" <Nobody@NotMyISP.net> wrote in news:e0udobFdf2kU1
@mid.individual.net:

> Yesterday morning, immediately after reading about the QuadRooter 
> security flaw that exists in some QualComm chips, I ran the Check Point 
> QuadRooter Scanner app, which told me that my Nexus 5X phone (with the 
> July security patches) was *not* affected.
> 
> My wife's Nexus 5X (bought a few days before mine) already had the 
> August security patches, and the Check Point QuadRooter Scanner app 
told 
> us that her phone *was* affected.
> 
> Yesterday afternoon my phone got the August security patches, and I ran 
> the Check Point QuadRooter Scanner app, which told me that my Nexus 5X 
> phone *was* affected.
> 
> I then ran QualComm's own scan tool on both phones, and it told me that 
> my phone is *not* affected but that my wife's *is* affected.
> 
> I hope the new security fix comes soon.
> 
> Perce
> 
One thing to do would be to compare apps between your phone and your 
wife's. If the scanner is corrent, then the source could be an app that 
your wife has that you don't.

FFIW, Quadrooter told me that my Nexus 7 (2013)[August security patch 
installed] is vulnerable to the CVE-2016-5340 vulnerability, which is not 
patched yet. It is supposed to be patched in the next security update.

[toc] | [prev] | [next] | [standalone]

#33254

On 08/09/2016 01:31 PM, Tim wrote:

>> Yesterday morning, immediately after reading about the QuadRooter
>> security flaw that exists in some QualComm chips, I ran the Check Point
>> QuadRooter Scanner app, which told me that my Nexus 5X phone (with the
>> July security patches) was *not* affected.
>>
>> My wife's Nexus 5X (bought a few days before mine) already had the
>> August security patches, and the Check Point QuadRooter Scanner app
> told
>> us that her phone *was* affected.
>>
>> Yesterday afternoon my phone got the August security patches, and I ran
>> the Check Point QuadRooter Scanner app, which told me that my Nexus 5X
>> phone *was* affected.
>>
>> I then ran QualComm's own scan tool on both phones, and it told me that
>> my phone is *not* affected but that my wife's *is* affected.
>>
>> I hope the new security fix comes soon.
>>
>> Perce
>>
> One thing to do would be to compare apps between your phone and your
> wife's. If the scanner is corrent, then the source could be an app that
> your wife has that you don't.
>
> FFIW, Quadrooter told me that my Nexus 7 (2013)[August security patch
> installed] is vulnerable to the CVE-2016-5340 vulnerability, which is not
> patched yet. It is supposed to be patched in the next security update.

But I thought that this vulnerability was in the hardware, not in any 
particular apps that may have been installed. My wife's phone is white 
whereas mine is black, so even though were bought only days apart they 
could very well have significantly different manufacturing dates and 
different chip revisions.

Why did the August update apparently introduce a new vulnerability in 
mine, and why does the Check Point Scanner give a different result on my 
phone from QualComm's own?

Perce

[toc] | [prev] | [next] | [standalone]

#33263

"Percival P. Cassidy" <Nobody@NotMyISP.net> wrote in
news:e0ujsmFeve0U1@mid.individual.net: 

> On 08/09/2016 01:31 PM, Tim wrote:
>> One thing to do would be to compare apps between your phone and your
>> wife's. If the scanner is corrent, then the source could be an app
>> that your wife has that you don't.
>>
>> FFIW, Quadrooter told me that my Nexus 7 (2013)[August security patch
>> installed] is vulnerable to the CVE-2016-5340 vulnerability, which is
>> not patched yet. It is supposed to be patched in the next security
>> update. 
> 
> But I thought that this vulnerability was in the hardware, not in any 
> particular apps that may have been installed. My wife's phone is white
> whereas mine is black, so even though were bought only days apart they
> could very well have significantly different manufacturing dates and 
> different chip revisions.
> 
> Why did the August update apparently introduce a new vulnerability in 
> mine, and why does the Check Point Scanner give a different result on
> my phone from QualComm's own?
> 
> Perce
> 
> 
The four vulnerabilities that QuadRunner is checking four are bugs in one 
or more Qualcom drivers. Three of them were patched in the August 
security update, at least in the Google version of the update. As I said, 
the fourth one has not been patched as of the August update. You might 
want to read this article, as it has probably the best straight info on 
the whole mess.

http://www.computerworld.com/article/3105569/android/android-
quadrooter.html?token=%23tk.CTWNLE_nlt_computerworld_operating_systems_
2016-08-09&idg_eid=ae31bf6e68b90ef2418b7739a7c9f188
&utm_source=Sailthru&utm_medium=email&utm_campaign=Computerworld%
20Operating%20Systems%202016-08-09
&utm_term=computerworld_operating_systems#tk.cw_nlt_computerworld_operati
ng_systems_2016-08-09

Sorry for the length of the URL, but it is what it is. Oh for the days 
when URLs would fit in the address box, and hitting the page back key 
didn't require re-downloading all the stuff you just downloaded a minute 
or two before.

[toc] | [prev] | [next] | [standalone]

#33264

In article <XnsA65FE664A5B33timothybilyahoocom@216.166.97.131>, Tim
<timothybil@yahoo.com> wrote:

> > 
> The four vulnerabilities that QuadRunner is checking four are bugs in one 
> or more Qualcom drivers. Three of them were patched in the August 
> security update, at least in the Google version of the update. As I said, 
> the fourth one has not been patched as of the August update. You might 
> want to read this article, as it has probably the best straight info on 
> the whole mess.
> 
> http://www.computerworld.com/article/3105569/android/android-
> quadrooter.html?token=%23tk.CTWNLE_nlt_computerworld_operating_systems_
> 2016-08-09&idg_eid=ae31bf6e68b90ef2418b7739a7c9f188
> &utm_source=Sailthru&utm_medium=email&utm_campaign=Computerworld%
> 20Operating%20Systems%202016-08-09
> &utm_term=computerworld_operating_systems#tk.cw_nlt_computerworld_operati
> ng_systems_2016-08-09
> 
> Sorry for the length of the URL, but it is what it is. 

no it isn't.

all that's needed is up to the .html.

everything past the ? is tracking information and can be deleted.

also, if you enclose the url in angle brackets, the length doesn't
matter.

<http://www.computerworld.com/article/3105569/android/android-
quadrooter.html>

> Oh for the days 
> when URLs would fit in the address box, and hitting the page back key 
> didn't require re-downloading all the stuff you just downloaded a minute 
> or two before.

that's a different issue.

[toc] | [prev] | [next] | [standalone]

#33268

Tim <timothybil@yahoo.com> wrote:
> "Percival P. Cassidy" <Nobody@NotMyISP.net> wrote in
> news:e0ujsmFeve0U1@mid.individual.net: 
> 
>> On 08/09/2016 01:31 PM, Tim wrote:
>>> One thing to do would be to compare apps between your phone and your
>>> wife's. If the scanner is corrent, then the source could be an app
>>> that your wife has that you don't.
>>> 
>>> FFIW, Quadrooter told me that my Nexus 7 (2013)[August security patch
>>> installed] is vulnerable to the CVE-2016-5340 vulnerability, which is
>>> not patched yet. It is supposed to be patched in the next security
>>> update. 
>> 
>> But I thought that this vulnerability was in the hardware, not in any 
>> particular apps that may have been installed. My wife's phone is white
>> whereas mine is black, so even though were bought only days apart they
>> could very well have significantly different manufacturing dates and 
>> different chip revisions.
>> 
>> Why did the August update apparently introduce a new vulnerability in 
>> mine, and why does the Check Point Scanner give a different result on
>> my phone from QualComm's own?
>> 
>> Perce
>> 
>> 
> The four vulnerabilities that QuadRunner is checking four are bugs in one 
> or more Qualcom drivers. Three of them were patched in the August 
> security update, at least in the Google version of the update. As I said, 
> the fourth one has not been patched as of the August update. You might 
> want to read this article, as it has probably the best straight info on 
> the whole mess.
> 
> http://www.computerworld.com/article/3105569/android/android-
> quadrooter.html?token=%23tk.CTWNLE_nlt_computerworld_operating_systems_
> 2016-08-09&idg_eid=ae31bf6e68b90ef2418b7739a7c9f188
> &utm_source=Sailthru&utm_medium=email&utm_campaign=Computerworld%
> 20Operating%20Systems%202016-08-09
> &utm_term=computerworld_operating_systems#tk.cw_nlt_computerworld_operati
> ng_systems_2016-08-09
> 
> Sorry for the length of the URL, but it is what it is. Oh for the days 
> when URLs would fit in the address box, and hitting the page back key 
> didn't require re-downloading all the stuff you just downloaded a minute 
> or two before.

You can shorten most urls manually. All the guff after the '?' is just
marketing or tracking info. Trim it to 'android-quadrooter.html' and you're
done.

[toc] | [prev] | [next] | [standalone]

#33269

Tim wrote:

> http://www.computerworld.com/article/3105569/android/android-
> quadrooter.html?token=%23tk.CTWNLE_nlt_computerworld_operating_systems_
> 2016-08-09&idg_eid=ae31bf6e68b90ef2418b7739a7c9f188
> &utm_source=Sailthru&utm_medium=email&utm_campaign=Computerworld%
> 20Operating%20Systems%202016-08-09
> &utm_term=computerworld_operating_systems#tk.cw_nlt_computerworld_operati
> ng_systems_2016-08-09
>
> Sorry for the length of the URL

Don't apologise, chop the redundant parts out of it!

<http://computerworld.com/article/3105569>

[toc] | [prev] | [next] | [standalone]

#33292

On 08/09/2016 01:58 PM, I wrote:

>>> Yesterday morning, immediately after reading about the QuadRooter
>>> security flaw that exists in some QualComm chips, I ran the Check Point
>>> QuadRooter Scanner app, which told me that my Nexus 5X phone (with the
>>> July security patches) was *not* affected.
>>>
>>> My wife's Nexus 5X (bought a few days before mine) already had the
>>> August security patches, and the Check Point QuadRooter Scanner app
>> told
>>> us that her phone *was* affected.
>>>
>>> Yesterday afternoon my phone got the August security patches, and I ran
>>> the Check Point QuadRooter Scanner app, which told me that my Nexus 5X
>>> phone *was* affected.
>>>
>>> I then ran QualComm's own scan tool on both phones, and it told me that
>>> my phone is *not* affected but that my wife's *is* affected.
>>>
>>> I hope the new security fix comes soon.

>> One thing to do would be to compare apps between your phone and your
>> wife's. If the scanner is corrent, then the source could be an app that
>> your wife has that you don't.
>>
>> FFIW, Quadrooter told me that my Nexus 7 (2013)[August security patch
>> installed] is vulnerable to the CVE-2016-5340 vulnerability, which is not
>> patched yet. It is supposed to be patched in the next security update.
>
> But I thought that this vulnerability was in the hardware, not in any
> particular apps that may have been installed. My wife's phone is white
> whereas mine is black, so even though were bought only days apart they
> could very well have significantly different manufacturing dates and
> different chip revisions.
>
> Why did the August update apparently introduce a new vulnerability in
> mine, and why does the Check Point Scanner give a different result on my
> phone from QualComm's own?

I erred in describing one of the QuadRooter scanner apps as "Qualcomm's 
own": although the app's name starts with "Qualcomm," it is the product 
of another business that wants me to use their "mobile security" app and 
wants to entice me to pay for an upgrade, just as the Check Point one is.

Perce

[toc] | [prev] | [next] | [standalone]

#33270

On 09/08/16 17:14, Percival P. Cassidy wrote:
> Yesterday morning, immediately after reading about the QuadRooter security flaw that exists in some QualComm chips, I ran the Check Point QuadRooter Scanner app, which told me that my Nexus 5X phone (with the July security patches) was *not* affected.
>
> My wife's Nexus 5X (bought a few days before mine) already had the August security patches, and the Check Point QuadRooter Scanner app told us that her phone *was* affected.
>
> Yesterday afternoon my phone got the August security patches, and I ran the Check Point QuadRooter Scanner app, which told me that my Nexus 5X phone *was* affected.
>
> I then ran QualComm's own scan tool on both phones, and it told me that my phone is *not* affected but that my wife's *is* affected.
>
> I hope the new security fix comes soon.
>
> Perce

Read this:
http://www.androidcentral.com/google-confirms-verify-apps-can-block-apps-quadrooter-exploits

and then just keep calm, and carry on.

[toc] | [prev] | [standalone]

Back to top | Article view | comp.mobile.android

csiph-web