I know for a fact most people click every link they receive, or I wouldn't get so much mandatory security training at work, so if millions of people are just walking around after downloading random PDFs and word documents from their email onto their phone, what does this mean?
Mostly in the form of OEM-installed data collection/"analytics", but yeah.
Probably a lot of people install sketchy apps from Google Play too. Apple's not immune but it's a lot harder, you basically have to be pissing off a government. If you are then it's still entirely possible you're 0-click owned without ever noticing.
The malware comes pre-installed on phones these days even
Nah but working exploits in PDF and DOCX parsers are relatively hard to come by now. Those usually only get used on you if you're a special target in some way.
Unless you don't update your software lol
Someone needs to make another internet-crashing computer worm like in the old days, as a bit
Now states just use these exploits to oppress people
Oh dang all the old "haha you're computer is fucked now" and nothing else viruses and worms were just anarchist cybersecurity training
Unless you don't update your software lol
this is the key distinction. Many people who click on sketchy links all the time also don't update anything unless forced to (understandable but bad security practice lol). Plus even if you do, most phones don't get updates for that long, so if you're rocking a 3 year old phone odds are its not getting them any more unless it's Apple (pixel and samsung are trying to catch up tho)
Software for normals is pretty good at auto-updating these days, even against the will of the user. Plus modern exploit mitigation techniques make actually turning security bugs (which are rarer in operating systems where userspace runs on a VM, like Android) into consistently-working exploits difficult. I'm sure some people get got by e-mail-originating malware using old exploits but I'm not sure how widespread it actually is
I mean sure, true enough but people do hate updating and it only takes one app or component to not auto-update against their will to leave a hole. But yeah, most nasty links these days don't actually install an exploit on your device they just phish for your actual credentials. this trend is probably also influenced by the fact that people with 4 year old phones aren't likely to be high value targets to steal from
I don't think I have ever updated a phone app and thought "wow this is an improvement I sure am glad I updated"
exactly! I'm not saying people are wrong not to update, but if given the option many won't because of mostly valid reasons like that. free/open source apps tend to be better in this regard, generally security fixes will be backported to old versions for the lifetime of the OS, rather than forcing everyone to update to the latest version to get the security fixes. More recent developments like rolling release distros and flatpak, snap, etc. are moving away from this though... (for both good and bad reasons). But at least if it's open source there will always be the option of backporting the security fix, proprietary apps don't even give you (or the community at large) the option
I intentionally click malware at work if I’m given the option. it’s not my problem, fuck the company.
My personal stuff is cleaner than a pornstars asshole.
Company policy here is if you get your computer infected with malware, you're responsible for any damages caused to the computer or if any data gets leaked (i.e. you'll get fired). Reasoning being you're only allowed to download corporate packaged apps 🙃
I'll leave the 3k dollar machine on a public table while I take a piss cause I can't be arsed to protect it but I won't even download an adblocker in case it has malware in it
