25 points moooooky 3 days ago 6 comments
mzajc 1 hour ago | parent
This is a very neat and approachable write-up, but is the final result really a hack? If I understand correctly, you're getting an unprivileged shell on a device you own and have paired with your smartphone; more or less equivalent to installing a terminal emulator on your smartphone, except it's smart glasses in this case.
Should the ability to own one's devices really be treated as a vulnerability and reported to security teams?
no-dr-onboard 1 hour ago | parent
"hack" on hackernews essentially means "I used my computer to do something". The overwhelming population of people here aren't security engineers, but rather developers.
mzajc 1 hour ago | parent
I considered that, but the mentions of pwn2own and the bug bounty program have me thinking "hack" is used in the security/mainstream sense.
stavros 48 minutes ago | parent
How is it not a hack to do something on a device that doesn't let you do it? Yes, the device should let you do whatever you want, but it doesn't, therefore this is a hack.
I'm going to try it on my glasses, and disable autoupdating ASAP.
frenchsalmon 52 minutes ago | parent
Nice. How robust is this with software upgrades though? Also looks like arbitrary code execution in the app sandbox, so no persistance?
RobMurray 21 minutes ago | parent
It's really sad that getting a shell on a device you own is now considered a vulnerability.