Don’t be evil, amirite?
I didn’t realize people used GitHub for blogging. I don’t know why but it gives me a linkedin feeling.
Tons of people do it, but usually you get your own domain.
I guess it’s free hosting on a website people have heard of
I reached out to Goodyear when my car radio was stolen, and they ignored me!
Well what’s being said is that Goodyear sent someone in full uniform to break into your car to steal your radio and give it to the first scalper they found.
OP bought a cheap-shit no name phone and the cheap shit no name manufacturer pushed an update that had malware in it. At no point is Google responsible for any of that.
It certainly doesn’t equate to Google themselves infecting the phone.
I’m all for calling Google what they are, and I personally have spent the last couple years degoogling as much as possible. But this is a clear cut case of “you get what you pay for.”
Updates go through the phone manufacturer, if you can’t trust the manufacturer you can’t trust the update.
This was a supply chain attack and the poster knows that. It’s not a software vulnerability.
The poster put a disclaimer right at the top stating that this is a supply-chain attack but points out that Google themselves put this phone on a list of “certified safe devices” and that Google had no response to his reporting the malware to them.
He also points out that this is one of the most commonly purchased devices from the Lifeline program meaning this issue can have a large impact on many vulnerable people.
At no point has a Google Play certification ever claimed that devices will be immune from supply chain attacks. The manufacturer is responsible for the breach and correcting the issue.
Also, OP is using a tool for software exploit reporting. Social media probably would have been a better outlet. Or even better their representatives since this phone is provided at tax payer expense.
This article is still a really long explanation about how they complained to the wrong people and were ignored.
At no point has a Google Play certification ever claimed that devices will be immune from supply chain attacks. The manufacturer is responsible for the breach and correcting the issue.
Then what are they certifying and what makes this phone worthy of certification while some other no-name brand isn’t?
Nobody is claiming that Google is responsible for removing the malware and patching the vulnerability but they are responsible for the certification list that they voluntarily compiled and released.
Think of it like the travel advisories put out by the US State Department. They’re not responsible for ending cartel violence in Sinaloa Mexico but they are responsible for informing others of the potential dangers present in Sinaloa.
Also, OP is using a tool for software exploit reporting. Social media probably would have been a better outlet
Social media requires that enough third-party individuals read and spread this information before it becomes visible enough to major companies like Google. Contacting them directly is a much faster and more direct approach, but using both approaches is probably best overall for something important. Social media virality just ensures that they can’t ignore you when you contact them directly.
The certification means what they say it means. It’s publicly available information.
And they say it means these devices are “safe” and “secure.” I can see why you didn’t want to define it yourself as it completely contradicts your argument.
Not sure what they mean google certified. They are talking about some random used minor brand phone puchased though a questionble supply chain not a new Google phone purchased from well known vendors. From a security perspective it is well known that many brands do not have great updates. Get a new Google Pixel if you want better updates and get it from a trusted vendor.
Interesting. Do kernel and other base system updates even come though Play? I thought a lot of this stuff comes from the original vendor. I have no idea if the malware the article is talking about came through Play or through vendor mechanisms.
