Bugs are always an unwelcome nuisance, especially during one’s holidays where none of the high-grade preventative measures purchased from seemingly honest traders appear to make the slightest bit of difference.
This summer (Northern Hemisphere readers), this has been true of both the family trip to the Mediterranean and a flurry of bug activity in the real, or virtual world.
You would have to have been a long way off grid to fail to see the (now familiar) shrieking headlines about the 900 Million (is that all?) Android devices that are vulnerable to the ‘Quadrooter’ set of vulnerabilities. Yes folks, we’ve got another one with its own name.
This is a series of four bugs, not in the Android code itself but in the code running on some of the chips used in (err, 900 million) Android devices that are manufactured by Qualcomm.
Discovered by Adam Donenfeld of Check Point and announced to much hysteria (thank you very much Check Point Marketing, fantastic work) at this year’s DEF CON in Vegas, these nasties enable code running on your phone, such as an application you might have downloaded, to obtain super powers and spy on you, exfiltrate data etc. etc.
These bugs are not ‘Remote Code Execution’ like our old favourite ‘Stagefright’, and furthermore due to the correct process being followed by Check Point and prompt action by Qualcomm (which must be loving all this media attention!) have all been patched. So if you have updated your Android device (which you should do as soon as you can), providing you vendor has implemented the Qualcomm fixes in their patches, you will be fine.
What was all the fuss about, you may well ask yourself? The fact of the matter is that it is only a matter of time before the rapid pace of development in most technologies, let alone mobile, will result in a monster exploitable issue that will have far reaching consequences.
We are certain that regulatory bodies worldwide will be examining this issue and will probably act with legislation that does very little but costs a fortune. The lights in Ofcom are probably burning late tonight, perhaps all the way to 1700.
As usual we recommend everyone to update their devices regularly, always purchase applications from the Play Store (try not to be an ‘early adopter’ if you can help it) and consider some Android anti-virus software – there’s loads of it about.
Not wanting Qualcomm/Google take all of the heat themselves, Microsoft has released this month’s Tuesday bundle of love that contains no fewer than five critical Remote Code Execution bug fixes.
Although you didn’t read about this on the front page of your newspaper or BBC News (maybe Microsoft should hire Check Point’s marketing people? Perhaps not!), it is potentially much more serious than the Qualcomm faux pas, containing fixes for Internet Explorer (surprise!), Microsoft’s Java engine (no biggy!), PDF processing, graphic engines and of course Office.
It doesn’t look like any of these are being exploited in the wild yet, but of course they will be, so get patching, or get the skeleton crew back at base to get patching while you settle down on your sun bed with a nice Big Data tutorial.
If you want to have a chat with one of our sunburnt experts about any of these issues, security in general, or our new favourite subject big data log analysis, contact us on: 020 7517 3900 or email [email protected].
