Join us live at 10am ET on 10/4 for a Made by Google event announcing our latest family of products.
Hey guys!
It's almost time again for the latest and greatest iterations of Pixel devices, where Google will show off their newest hardware and software upgrades to the masses.
Rumors indicate signs pointing to a new Tensor chip in the Pixel devices, temperature sensors, Magic Audio removal features for video clips, and even a Qualcomm-based chip in the Pixel Watch 2.
It's been well documented. They can also use them to place malicious files on and potentially gain access to the phone by having the Android phone read them and run malicious code.
So do you argue that all manufacturers should get rid of the usb port as well and switch to wireless charging because juicejacking is a thing?
That's a really poor argument to make when the usb port is more prone to attacks (as it requires 0 app use on the user front) vs sd cards, which requires a user to hand over permissions.
If you yank out an SD card on it from a phone that was forgotten behind:
You now have access to all of the potentially unencrypted files on it
Threat actors can replace trusted files with malicious ones to exploit potential vulnerabilities in applications running on the Android device
In 5 seconds you've walked away with it, as opposed to a laptop which requires you to physically unscrew it
If you have a phone without an SD card they only have access to the USB port, which is locked with software and in some cases hardware. Removing the SD card slot is one less attack vector, it will make the device more secure one way or another.
Leaving your laptop around someone can also yank the SSD. Modern laptop operating systems generally have the option to encrypt their storage devices.
You can encrypt microSD cards but you must do file transfers through the phone itself through USB which I guess is no different than having an encrypted drive on a laptop. I haven't looked into how modern SD encryption works on Android.
Arguing security flaws based on someone having physical acess to a device is on a completely different level of vulnerabilities.
Thats like treating vulnerabilities like Spectre/Meltdown/Downfall/Zenbleed on the same category as ones that require physical access to the machine, many which dont get names due to being severe is small because they are firmware patched quickly.
On the topic of SD card encryption, its not native to android, however many companies who offer sd card models(e.g Samsung) have encryption as a setting put in theirselves.
Taking someones phone to then put a file on it is not something I would call a security risk, let alone one that warrants removal of such a basic feature.
Leaks suggest that it would be a MLX90632 sensor, which Melexis describes as "a miniature SMD thermometer IC for accurate non-contact temperature measurement, especially in thermally dynamic environments and when available space is limited".
I have absolutely no idea either why Google would add a thermometer to its phones, it's definitely a senseless addition and it doesn't help that the MSRP for the Pixel 8 got a $100 bump vs the Pixel 7.