A security researcher reports eight months of Android vulnerability research - over 85 submissions and 30+ distinct zero-click findings - detailing a pattern of how Google handled those reports. The researcher reverse-engineered Pixel and Samsung telephony components, submitted working proofs of concept, and then audited Google's shipped factory images to compare exact binaries and functions. Findings were classified into four verdicts (patched, still present, N/A, can't-determine) after byte-level comparison. The central claim: multiple reports were closed as duplicates, infeasible, or "not a vulnerability," yet eight of those closed reports were later changed in shipping code with no reward or credit, while many others remain unpatched despite closure. A promised $500 bounty for two older bugs was only half-paid, and the other half has been stalled in “manual exception” processing for over eight months.
The researcher documents specific technical fixes and failures: added permission guards for PixelModemService MintReceiver; bound-check additions in framework PduParser.parseParts; underflow and length checks in libpixelimsmedia components (RtpSession, RtcpChunk, RtpDecoderNode); and a privileged permission added to DeviceProvisioningService in ShannonRcs.apk. Administrative errors are highlighted too: Google admitted linking unrelated reports to the same internal canonical ID and retracted an earlier "not a security vulnerability" closure. The report alleges a recurring pattern of silent fixes, incorrect triage, and delayed or withheld payments, supported by direct binary diffs against shipped images.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
OpenAI is facing increasing legal risks after uncovering hacks related to its technology. The situation raises questions about liability for misuse of AI tools and cybersecurity breaches. (ft.com)
A researcher at a Russian plague laboratory in Siberia died from an unknown infection following a laboratory accident. Russian authorities have implemented special measures, but the exact nature of the released pathogen remains unclear. (scrippsnews.com)
European Commission staff dislike the EU's 'sovereign' backup platform Element Pro, calling it ineffective and poorly designed. The EC implemented it to reduce reliance on US tech, but staff skepticism remains high due to usability issues and concerns over data security. (gizmodo.com)
A researcher at a Russian plague laboratory has died from an unidentified infection. Authorities have not disclosed details about the cause of death or the infection. (cnn.com)
AI systems can trigger nuclear conflicts by amplifying human cognitive blind spots and overwhelming decision-makers during crises. Superintelligence is not necessary for AI to escalate nuclear risks, as current systems influence human judgment and actions. (thebulletin.org)
Site-blocking bills like the DEFEND IP Act aim to protect intellectual property but instead promote censorship and overblocking. These laws threaten the open web by creating systems that can be misused to restrict access to websites indiscriminately. (eff.org)
Today's best Hacker News stories, summarized and screenshotted, one email a day.