Thanks for making this comment. This post is a wonderful example of the rampant marketing that has given the security industry a bad name.
- The title is technically accurate, which is the best kind of accurate for clickbait. This is not a novel vulnerability representative of an application security flaw within Google - the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here.
- There's a logo and cute name for something which is, again, not a novel vulnerability.[2]
- Scaremongering tactics are used throughout to hype up the finding.[3][4] Deliberately ominous language like "...for now" is perhaps tolerable when it's coming from a media outlet, but it's certainly unacceptable from a firm conducting original security research.
All things told, this is closer to "threat intelligence" than real security research. A much better source for this news is the blog post by Google's Director of Android Security, Adrian Ludwig (first footnote, linked elsewhere in this thread as well). In particular, notice the succinctness and the serious, yet detached professionalism associated with the post.
In any case, there are legitimate arguments to be made in favor of extending software or device support lifetimes for vulnerability patches, but the onus is on device manufacturers to coordinate this. In the meantime, it would be great if fewer firms practiced this sort of manic self-promotion, but unfortunately there's little incentive not to.
-------
1. https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi
2. http://blog.checkpoint.com/wp-content/uploads/2016/11/goo_bl...
3. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_4...
4. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_2...
- The title is technically accurate, which is the best kind of accurate for clickbait. This is not a novel vulnerability representative of an application security flaw within Google - the malware campaign specifically targets older devices using previously known vulnerabilities.[1] There is no new exploit research here.
- There's a logo and cute name for something which is, again, not a novel vulnerability.[2]
- Scaremongering tactics are used throughout to hype up the finding.[3][4] Deliberately ominous language like "...for now" is perhaps tolerable when it's coming from a media outlet, but it's certainly unacceptable from a firm conducting original security research.
All things told, this is closer to "threat intelligence" than real security research. A much better source for this news is the blog post by Google's Director of Android Security, Adrian Ludwig (first footnote, linked elsewhere in this thread as well). In particular, notice the succinctness and the serious, yet detached professionalism associated with the post.
In any case, there are legitimate arguments to be made in favor of extending software or device support lifetimes for vulnerability patches, but the onus is on device manufacturers to coordinate this. In the meantime, it would be great if fewer firms practiced this sort of manic self-promotion, but unfortunately there's little incentive not to.
-------
1. https://plus.google.com/+AdrianLudwig/posts/GXzJ8vaAFsi
2. http://blog.checkpoint.com/wp-content/uploads/2016/11/goo_bl...
3. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_4...
4. http://blog.checkpoint.com/wp-content/uploads/2016/11/info_2...