[Moto G6 Questions & Answers] chilinux:
$99 or $150 isn't what I was charged for the Moto G6. It was released for a price of $200.

The Federal Trade Commission has fined D-Link, TP-Link and ASUS for marketing *BUDGET* wireless routers that sold for much less than $200 or $150 or $99 for misrepresenting their products as providing security while "failing to take reasonable steps to secure."

According to David Kleidermacher, Google's head of security for Android, ""Android security made a significant leap forward in 2017 and many of our protections now lead the industry" and also "as Android security has matured, it has become more difficult and expensive for attackers to find high severity exploits."

Google owned Motorola, they should have been able to established policies and procedures for Motorola to make good on David Kleidermacher's statements. Or they should have made establishing those part of terms of the sale to Lenovo.

Lenovo and Motorola also market themselves as providing security even for budget devices with statements as:

* "Prevent unauthorized access with secure biometrics"

* "keeping your devices and systems secure and your digital privacy intact is a top priority"

At no point do they put any exclusionary statement such as "but only if it is not a budget device."

Also, while Motorola One is also a budget device, it does get more frequent updates. However, the Moto One is clearly not intended for purchase in the USA market and is missing support for several LTE bands.

And the Moto G6 is supposed to be a Treble/GSI device were any effort Motorola put into providing updates to flagship GSI devices should also apply to being able to also update the G6 for almost no additional effort.

So, I reject the claim no one should expect Feb 2019 security updates by May 2019 because it is simply a budget device.

Then let's also look at the claim that if financials or similar are not stored directly on the phone then it is not really a big issue.

To respond to that I am going to focus on just one Feb 2019 patch. There have been plenty of other security issues in Jan 2019 to now but for purposes of this discussion, I will just focus on one. The CVE-2019-1988 seems to still apply to still apply to any Motorola phone that is "up-to-date" but has a Jan 2019 security level. This vulnerability as a high impact score of 10 out of 10 and an easy exploitability score of 8.6 out of 10. The attack complexity is low and "could lead to remote code execution in system_server with no additional execution privileges needed."

What would need to result from this for it to be considered a violation of Lenovo and Motorola's marketing of making security a top priority?

What if an email or MMS ("text message") or instant message could do any of the following:

* Open and stream the microphone while the phone is locked

* Take and transmit pictures from either the front or rear camera while the phone is locked

* Send and receive text messages while the phone is locked

* Transmit phone location while the phone is locked

* Access and transmit email and files/documents on Google Drive and Google Docs while the phone is locked

Would any of this be disturbing? Is Lenovo/Motorola really delivering on "[preventing] unauthorized access with secure biometrics" if this is possible while the phone is locked?

I get this is all theoretical and I sound like I have been wearing a tin foil hat (maybe I am :p). Anyone want to find out? Anyone want to give me the phone number to a Moto G6? Anyone want to give me the email address that they use with their Moto G6? How confident are people that not having financials stored directly on the phone means CVE-2019-1988 is not a major issue?

So far, people's reactions have been similar to this forum that there is still things people can do to maintain their privacy while using a device in this state. No one wants to believe that a major company would leave them so exposed. Lenovo/Motorola seems to be banking on no one understand the full scope of the problem. But what if a Proof of Concept of a Remote Access Trojan launched not via installing an application but simply from viewing a PNG really happened, would anyone be interested that? Would being able to actually demonstrate a PoC RAT have any positive value in holding Motorola accountable to their marketing claims or simply feed "hackers" with an exploit? If it is already known to be easily exploitable, shouldn't it be safe to assume any criminal that wanted it already has created their own implementation?

What exactly is XDA's stand on a real PoC RAT full disclosure? Is XDA taking on the stance that a RAT disclosure is always only harmful? Or is it that Motorola's actions are harmful?