[Paraliotis3]

Does Crackberry or Blackberry are aware about this???
Priv is protected ?

[Dunt Dunt Dunt]

Everyone is aware.... couple of threads on this already.

Currently no the PRIV isn't protected from Specter, Meltdown doesn't apply. Have to see if the PRIV get's the January Patch and any future updates.

[glwerry]

It's not Crackberry's responsibility - they are a forum.

Blackberry is aware.

PRIV is NOT protected - as far as I have heard, only Microsoft has released updates to partially address the Meltdown issue.
I don't think that ANYONE has been able to patch Spectre yet - technically you would have to fix the actual hardware in both cases, but Meltdown is easier to address with a software patch.

It would be a good idea to update the Chrome browser, as I believe that has had some fixes done.

[Matty]

Does Crackberry or Blackberry are aware about this???
Priv is protected ?

As others have said. Blackberry is well aware of the issue and I'm sure they decided a couple months ago (when it was found) if they were going to patch it or not. All we can do is wait to hear from Blackberry. Don't think another thread is needed.

Google says their Jan 5th security patch partially fixes the issue and it will be fully patched later on. . 😃

[gizmo21]

Best thing beside not (sideloading) unknown apps is to use the newest Browserversion of one of the major devs like Google or Mozilla and perhaps use noscript add-ons.

But that is common sense anyway if you are security aware.

I guess we will also see bad mail/messaging-attachments in the future but to be aware of those is also a know vector anyway.

[thurask]

The CPU is partially vulnerable, in that the two high power Cortex A57 cores use speculative execution, i.e. Spectre, while the four low power Cortex A53 cores do not. No ARM chip other than the Cortex A75 (which is too new to matter here) is vulnerable to Meltdown.

In terms of OS-level mitigations, while Google claims Android isn't directly vulnerable to Meltdown or Spectre, they did introduce a tweak intended to make attacks like Meltdown/Spectre harder in the January 5, 2018 patch level. Since the Priv is officially EOL, and since precedent puts BB's promise to update the Priv at about the same trustworthiness as their promises for Nougat for the Priv and BB10 for the PlayBook, I doubt it'll get patched.

And, yes, apps themselves can introduce mitigations, like the browser example above. So keep up to date.

[Rico4you]

BlackBerry did announce when they talked about PRIV RE end of security updates that any security CRITICAL issues would be addressed for PRIV.

[Chuck Finley69]

BlackBerry did announce when they talked about PRIV RE end of security updates that any security CRITICAL issues would be addressed for PRIV.

Appears to be more talk, less action since device is EOL.

[Rico4you]

Appears to be more talk, less action since device is EOL.

Let's see if PRIV gets update Re Critical issue.
EOL? My PRIV running better than ever and get app updates. Use alongside my KEYone.

[Chuck Finley69]

Let's see if PRIV gets update Re Critical issue.
EOL? My PRIV running better than ever and get app updates. Use alongside my KEYone.

I'm referring to status from BB perspective regarding exiting hardware when I say EOL. I believe they've washed their hands of all hardware support not paid for by a current licensee. Meltdown and Sceptre will just push users to new devices sooner and BB will just let things bleed out till official EOL. So I'm saying a "practically EOL" situation, unfortunately.

[Rico4you]

I'm referring to status from BB perspective regarding exiting hardware when I say EOL. I believe they've washed their hands of all hardware support not paid for by a current licensee. Meltdown and Sceptre will just push users to new devices sooner and BB will just let things bleed out till official EOL. So I'm saying a "practically EOL" situation, unfortunately.

Respectful opinion.

[GiveMeAnthony]

If you have Chrome or a Chromium based browser like Brave, then you can go to chrome://flags/#enable-site-per-process in the address bar and enable strict site isolation. According to Google, this should mitigate attacks by isolating sites into separate address spaces. Chrome 64 will include actual patches.

[CarstenF]

According to ct" magazine, a variant of Meltdown can be used to attack the 2 Cortex A57 cores in the Priv. Also of course, a variant of Spectre can be used to attack all cores.

[thurask]

According to ct" magazine, a variant of Meltdown can be used to attack the 2 Cortex A57 cores in the Priv. Also of course, a variant of Spectre can be used to attack all cores.

The Cortex A53 cores in the Priv (and KEYone/Motion) lack speculative execution, so neither Spectre nor Meltdown can affect them. As well, according to ARM, the Cortex A57 is vulnerable to Spectre but not Meltdown.

[anon(10268214)]

Since the Priv is officially EOL, and since precedent puts BB's promise to update the Priv at about the same trustworthiness as their promises for Nougat for the Priv and BB10 for the PlayBook, I doubt it'll get patched.

Not to mention the fact these vulnerabilities were well known in the industry for months before being made public. It would be very surprising if BlackBerry was not aware of them. How else could any of the OEMs have had patches ready so soon after the official announcement?

Clearly, had BlackBerry intended to patch it on the PRIV they would have simply waited an extra month or two before declaring the PRIV officially EOL.

[conite]

Not to mention the fact these vulnerabilities were well known in the industry for months before being made public. It would be very surprising if BlackBerry was not aware of them. How else could any of the OEMs have had patches ready so soon after the official announcement?

Clearly, had BlackBerry intended to patch it on the PRIV they would have simply waited an extra month or two before declaring the PRIV officially EOL.

BlackBerry was notified about Krack on Oct 13th.

Despite that, they were the first to patch for it. They beat Apple and Google by 3-5 weeks.

Priv got the Oct patch (its last) and the DTEKs got the Nov patch early/mid Nov with the Krack fix included. The KEYᵒⁿᵉ got a 2nd Oct patch in very early Nov with the fix included too.

As far as Spectre, Meltdown is concerned, I'm not sure Qualcomm had all the answers back then. It will be a long-term iterative fix process. The first gen fixes are really just appearing this month (Jan).

[anon(10268214)]

BlackBerry was notified on Oct 13th.

Despite that, they were the first to patch for it. They beat Apple and Google by 4-6 weeks.

Priv made the Oct patch (its last) prior to that, but the other 3 got the Nov patch early in the month, and the Krack fix was included.

What does KRACK have to do with it? That's a WIFI vulnerability. Why are you confusing the issue and attempting to manipulate the conversation? This discussion is about Meltdown/Spectre not KRACK. And no, the PRIV has not been patched for it (unless you can prove it) and probably never will be...because as I said, BlackBerry conveniently terminated support for the PRIV (and patted themselves on the back for it) one month before Meltdown/Spectre was made pubic.

[conite]

What does KRACK have to do with it? That's a WIFI vulnerability. Why are you confusing the issue and attempting to manipulate the conversation? This discussion is about Meltdown/Spectre not KRACK. And no, the PRIV has not been patched for it (unless you can prove it) and probably never will be...because as I said, BlackBerry conveniently terminated support for the PRIV (and patted themselves on the back for it) one month before Meltdown/Spectre was made pubic.

You didn't read my entire post. It was context.

Priv did get the Krack fix, but since the first iteration of Spectre patches are just flowing out now, it obviously didn't get that.

[anon(10268214)]

You didn't read my entire post. It was context.

Priv did get the Krack fix, but since the first iteration of Spectre patches are just flowing out now, it obviously didn't get that.

I did read the entire post, and in the 'context' of KRACK being completely unrelated to the vulnerability in question...I found it to be deliberately misleading. Still do.

[G_Unit MVP]

BlackBerry did announce when they talked about PRIV RE end of security updates that any security CRITICAL issues would be addressed for PRIV.

Yes, but they have a funny way to define "CRITICAL"....

[misterabrasive]

I did read the entire post, and in the 'context' of KRACK being completely unrelated to the vulnerability in question...I found it to be deliberately misleading. Still do.

I hope you don't mind if I have a little cheese to go with your whine.

[anon(10268214)]

I hope you don't mind if I have a little cheese to go with your whine. https://uploads.tapatalk-cdn.com/201...5bb028ae3b.jpg

Thanks for showing up to cut the cheese! I'll be leaving now Lol...

[jajor]

BlackBerry was notified about Krack on Oct 13th.

Despite that, they were the first to patch for it. They beat Apple and Google by 3-5 weeks.

Priv got the Oct patch (its last) and the DTEKs got the Nov patch early/mid Nov with the Krack fix included. The KEYᵒⁿᵉ got a 2nd Oct patch in very early Nov with the fix included too.

As far as Spectre, Meltdown is concerned, I'm not sure Qualcomm had all the answers back then. It will be a long-term iterative fix process. The first gen fixes are really just appearing this month (Jan).

Blackberry was notified on 13 october but QNX which is part of Blackberry on 28 August .??? It's strange.

[conite]

Blackberry was notified on 13 october but QNX which is part of Blackberry on 28 August .??? It's strange.

Yup. Odd but true.

[CarstenF]

The Cortex A53 cores in the Priv (and KEYone/Motion) lack speculative execution, so neither Spectre nor Meltdown can affect them. As well, according to ARM, the Cortex A57 is vulnerable to Spectre but not Meltdown.

The link stated by you actually does NOT say that the A57 cores used in the Blackberry Priv are not vulnerable to Meltdown.
On the contrary, in the table it is listed that the A57 is vulnerable to bounds check bypass, which I think is a variant of Meltdown, at least checking for an out of bounds exception is used in Meltdown. Unfortunately in that links ARM does not use the terms Meltdown or Spectre, so one has to guess. Meltdown could also be variant 3a in the table, but that variant also affects the A57.
Also, the leading German IT magazine ct' lists the A57 as being vulnerable to a variant of Meltdown.