Keep Your Android Phone Safe From Pixnapping - DTNS 5124

0:02This is the Daily Tech News for Tuesday, October 14th, 2025. We tell you what you need to know, follow up on the context of those stories, and today, really, really try to help each other understand something. Today, we walk you through the pick-snapping exploit for Android, what you do and do not need to worry about, and how to avoid falling victim to it. Oh, I hope we fulfill that promise. I'm Tom Merritt. I'm Jen Cutter. Let's start with what you need to know with that big story. All right, so you know, you know you listen to this show. You should always be careful what apps you install on your devices, but here's an extra reason for Android users to be careful.

0:41And big thanks to Lujuan73 on our subreddit for calling attention to this one. Scientists from the University of California, Berkeley, University of Washington, UC San Diego, and Carnegie Mellon University presented a paper this week at the 32nd ACM Conference on Computer and Communication Security. So this is a, you know, submitted paper in a peer-reviewed situation. The paper is called Pick Snapping, Bringing Pixel Stealing Out of the Stone Age. So not pick snapping, but picks napping, like kidnapping, but for your pixels, and you'll understand why in a minute. The team's exploit, and by the way, this is them discovering the exploit and then telling people about it so that it can be shut down, not something that's in the wild.

1:27It requires you to install a malicious app. So that's your first line of defense. Don't install a malicious app. That sounds easy. But of course, if people didn't get tricked into installing malicious apps all the time, this wouldn't be much of a concern. But if you have the hubris to think I will never be tricked into installing a malicious app, then you don't need to worry. Once that malicious app gets installed, however they trick you into installing it, it takes advantage of the pick snapping exploit to read any data displayed on the screen without needing special system permissions. So Jen, that's the basis of this is they're not hacking into the security of Android.

2:07They're seeing what's on your screen and saying, well, if there's a multi-factor code up there, now we got it. It does this by invoking Android programming interfaces that can cause the targeted app to send said sensitive information to Android's rendering pipeline to be displayed on the screen. So the malicious app can make the app send something. You don't have to wait for the user to do it. The app will then run graphical operations on the pixels on the screen. And the way it was described in the Ars Technica piece, for example, they might draw a transparent piece of content over the other content.

2:46So your malicious app draws the transparent content. That causes the GPU to treat the pixels from the targeted app, like the multi-factor authentication app, differently. Then the malicious app can exploit a side channel attack in the GPU. The one they use in their research is GPU.zip. That's a known side channel vulnerability that has been mitigated. But in this case, it still exists. So they're able to use it. They say they could use others, though, if GPU.zip were to get shut down. And to oversimplify what they're doing, basically by drawing that transparent frame over the multi-factor code, it takes more time for a frame to be rendered on the screen behind that transparent image.

3:33and that extra time can be detected to determine whether a pixel is white or not. So there's like C or not C, colored or not colored. And the app can use that information to map pixels to letters, numbers, shapes, and then deduce, oh, that's the code 326755. Now I have your multi-factor code. This attack takes time. So it doesn't always work in the 30 seconds you need while that code is on the screen for the multi-factor authentication app. If you're going after a different kind of information that isn't time sensitive, it's not a problem. But they were able to refine how this works and able to capture multi-factor codes on Pixel devices.

4:19They couldn't do it on the Galaxy S25. Might be, I did not read this, because of the way Samsung provides their own interpretation of screen with one UI and all that. If you have obfuscated information, hidden information, say a pass key or something where nothing is displayed on the screen, this vulnerability can't access that. It's only stuff that can be displayed on a screen. It works on the Google Pixel. It works on the Samsung Galaxy S25. Google has released partial mitigations as of the September Android Security Bulletin. A modified version of the exploit, however, can still work. And Google says further mitigations are coming in the December Android security bulletin.

5:03No in the wild exploits have been discovered yet. I was very happy to read that last no in the wild stuff because I'm thinking, okay, how do I explain this to my parents? My parents switched back to Android. They got just such a good deal. They didn't want to spend the money on the new apples. Because like malicious apps, again, like every listener knows the deal there. We don't have to go back to that. But to my parents, my dad's phone is bare bones. My dad has what came with the phone. And that's what the phone is for. It's for being a phone. My mom loves every little coloring book and puzzle app under the sun.

5:39No matter who made it, I don't think she's ever looked at who made it. And I always wonder, like, how much stuff is sneaking through on the quote unquote women apps. Yeah. And the Google Play Store does try to stop malicious apps from coming in. So, you know, there is protection that your mom doesn't have to take advantage of. That'll happen. So chances are she won't download the wrong one, but stuff can sneak through. And the mitigations coming in December are really your best hope for that is to say, like, make sure to be patched. Make sure to be updated. Get that security update so that you're not worried about this.

6:15Yeah, because like there, I'm pretty sure they got like the galaxies, which helps like not a lot of two factor for, say, my parents specifically. And the big thing for them would have been passwords. But since passwords generally show up as the little dots, they are mostly okay with that because that would be considered obfuscated because nothing is on there unless they hit the little I button to see the password. And then this sounds like something that this could have grabbed. It has to target the area of the screen it thinks the information is going to be on. It's not doing screen capture. That's an important side note.

6:53Smaller beer. Yeah. So in this case, SMS could conceivably be more secure. It's less secure overall, but in this specific case, because the app doesn't know when you're going to get an SMS, right? And so it can't force you to get a second factor code sent to it. And the way the app usually works is it initiates the launch of the app. So it's really going after, do you have Authy or Google Authenticator or something like that? Like it said in the explainer, where you know where that bit's going to show up, much easier to target. Yeah, exactly. So this, again, they are going to release the source code at a responsible time.

7:35There is no in-the-wild exploit, but the source code is not out there yet. And Google is working on the mitigations for this. It doesn't always work all the time. It takes some effort. The chances that your average person is going to fall victim to this anytime soon are low. and if you keep your Android security updates coming, you will hopefully never fall victim to this. But it is something to be aware can happen when you're explaining to people why they need to be careful about what apps they download. Well, I love the line in the title of bringing stuff out of the Stone Age. And my first thought was, this is like somebody peeking over your shoulder, which is the oldest school.

8:13I mean, sort of. Yeah. They can't see very well. They can only see things that they decided to to to look at but they can't they could look over your shoulder yeah dtns is made possible by you the listener thanks to dale mcahy matt zaglin jeff wilks welcome to our new patron razvan and we got a raise from pete so thank you razvan and pete pete yay Yay!

8:43There's more we need to know today. Let's get to the briefs. Just a reminder that Windows 10 officially is out of support and therefore end of life as of now, October 14th. Right now, as I am reading these words on October 14th, that's it. Your PC will continue to work. It just won't get any more updates. You've got a few options. You can upgrade to Windows 11 if your machine supports it. You can buy a PC that does. Or you can enroll in extended security updates for Windows 10, which will be provided until October 13th, 2026 of next year, obviously. You can get those for free by agreeing to use Microsoft Cloud backups, use 1000 Microsoft reward points for people who've been collecting those, or you can pay$30.

9:33Windows 10 is more than 10 years old. But I love it. I still want to keep it. I know. I know. 2005 was 10 years ago when Windows 10 was announced. In 2015, were you still using the Windows from 2005? Probably. I tend to be like, obviously, when I was in corporate environments, you use what they give you. So when I was at the bank way, way, way back, we had Windows NT for a lot of stuff. Oh, sure. Yeah. For enterprise and embedded systems. And that's another point of the story. If you're in an enterprise, you've got a whole different situation with Microsoft on support. But yeah, I'm using 10. I'm happy with 10.

10:17I do not have a laptop or desktop that is capable of 11, which is another motivating factor for me keeping 10 around. When I finally got the option in Windows Update to enroll in this new program, it was very frustrating for me who runs local accounts and only local accounts and who is very careful to not have cloud logins. That's step number one of proceeding in this. Oh, yeah, just tie your login forever to your Microsoft account. I was like, no, there has to be another way. There has to be another way. And I haven't discovered it yet. But when I looked online to see what people have done for workarounds, which I haven't found a successful one, they've had different screens than I've had.

11:03So I'm wondering, like, is this a Canada problem? I'm going to have to look into it more now that more people are pushed. There are different screens in Europe where they're not allowed to charge. Yeah, exactly. I'm thinking like, okay, how do I fool this? Do I need a VPN? Can I trick them into thinking, oh, no, my computer's always been in Europe? Yeah, yeah. Yeah, or just, you know, take a quick trip. Just bring it with me. Yeah. At the 2025 OCP Global Summit in San Jose, NVIDIA said it is donating its Vera Rubin NVL144 architecture to the Open Compute Project as an open standard. This is not a GPU design.

11:44It's a more power-efficient rack server architecture, which is designed to support Vera Rubin GPUs, which are coming in 2027, but it can be used for other things as well. And while we're talking about NVIDIA, the company will begin selling its DGX Spark desktop. This is something previously referred to as Project Digits. On October 15th, the$3 ,999 desktop is 2.6 pounds, runs NVIDIA's DGX OS, which is a custom version of Ubuntu, has a GB10 super chip, which combines a 20-core Grace CPU with a Blackwell GPU, 128 gigabytes of LPDDR5X memory, and custom software, all of which can let scientists run powerful models locally on their own version of this desktop.

12:33There are also versions of this coming from other vendors, Dell, HP, Lenovo, and Asus. We're all showing off versions of this at Computex, so keep an eye out for those coming soon. NVIDIA is also working on a more powerful model with a GB300 Grace Blackwell Ultra Desktop Super Chip. That one would have 20 petaflops of desktop performance and 784 gigabytes of unified system memory. So, Tom, are you buying one of these? You know, there's a silly, ridiculous part of me that wants to buy one of these. Yeah, my brain's like, oh, do it. It would be wasted. Like, I don't have time to take advantage of the power that this has.

13:13But just the idea of like, ooh, I could run my own training models locally is pretty cool. Microsoft debuted its first in-house image generator called MAI Image One. It specializes in generating photorealistic images with natural lighting and landscapes. The model is being tested on LM Arena with plans to roll out to co-pilot and Bing image creator soon. And if your brain immediately went to the old school Microsoft XP landscape desktop, only photorealistic, I am sure there will be plenty of examples of people testing that in the specific Microsoft generator very soon. Yeah. To me, the story means we are slowly getting the alignment of the major players, right?

14:01Everybody's going to have an image generator. For a while, I think I tended to group Microsoft and OpenAI together because Microsoft was using OpenAI's models, would have access to its new models exclusively. Obviously, that relationship is ongoing and evolving, and Microsoft wants to be putting its own models out there more often, and they've beefed up the staff to do it. So you have the CEO of AI, Suleiman, saying, hey, we can do this on our own. Here's our in-house image generator, and it's pretty good. Is it better than other generators? I don't know. I'll leave that to the LM Arena testing, but it's competitive, right?

14:39And even if it's not better now, it means that Microsoft is going to continue to be in this race. OpenAI announced Monday that it has partnered with Broadcom for 10 gigawatts worth of custom-designed AI accelerator racks that will be deployed to OpenAI data centers and partner data centers from 2026 through 2029. They're working on a custom chip as part of that. In fact, they're in a little bit of a tussle with SoftBank's ARM over whether to use Broadcom's chip more often or some other ARM design chip. Since the beginning of September, OpenAI has signed deals for six gigawatts of chips from AMD, 10 gigawatts from NVIDIA, and an infrastructure deal with Oracle.

15:21Deployments are to begin in the second half of 2026 for all of those as well. OpenAI is expected to have two gigawatts of capacity by the end of this year, but none of these deals are happening or going into deployment until the end of next year. They are part of a goal to reach 250 gigawatts of capacity in the next eight years, 250 gigawatts. That would cost$10 trillion if they were able to make it all happen at current prices. OpenAI is expected to make$13 billion in revenue this year, if you're wondering how much they make now. They're going to have to make a lot more if they're going to be able to pay for that.

15:59Meanwhile, AMD is partnering with Oracle to develop 50 ,000 MI450 chips in Oracle's data centers by Q3 next year. All of these numbers are so big. I can't conceptualize it. They're just so big. it's going to be fascinating to watch how this unfolds and i know a lot of folks say it's going to be a disaster there's not enough power to do this uh it's irresponsible the companies are probably being over enthusiastic in many ways uh i wouldn't deny that uh but they are counting on the fact that compute price is going to come down that efficiency is going to go up that advances in these chips are going to make things easier to run and more power efficient to run.

16:51And so the price of the 250 gigawatts, I think the banking is that price will go down and the revenue will go up. I compare it, I think, a lot to the dot-com era where nobody went broke building data centers for internet, even though most of the dot-coms crashed out and failed, right? Because the capacity ended up getting used. And we'll see some rubber meet the road pretty soon at the end of next year. Like that's a decently fast turnaround for a project of this scale. Yeah. And just so people listening, don't get confused. It's not like all of it's going to be ready at the end of next year, but that's when it starts getting deployed.

17:31Yeah. And big numbers too. Scientists at UC San Diego and the University of Maryland discovered that by using an$800 off-the-shelf satellite receiver, they could monitor unencrypted data from satellites used for routing voice calls, text messages, and internet traffic, including Wi-Fi from airplanes. It also included communications with critical infrastructure like energy and water. Now, the data was in an obscure format, which they needed three years to consistently decode. The scientists alerted providers, including AT &T and T-Mobile, which have since encrypted the traffic, though not everyone they contacted have done so at this time.

18:13Yeah, they didn't name the people who hadn't. That's why they named AT &T and T-Mobile. T-Mobile apparently fixed this pretty fast. It's kind of the definition of security through obscurity, though, isn't it? Yeah. Well, I love the dedication. It's like, yeah, let's work on this for three whole years. We got this. Well, if I get this right from the reading of their interviews and discussions about this, they, they pointed, you know, well pointed, I'm oversimplifying, but you know, they, they listened to the satellites and assumed it would be encrypted that they would just get a bunch of encrypted data.

18:45And they're like, wait, this data is not encrypted. We don't know exactly what it is, but we can take some time to work on that. And that's what they were able to figure out. So it's the kind of thing where it was probably reasonable when you first deployed these satellites that like, well, nobody's going to be able to monitor this stuff. Nobody's going to be able to figure out the format in which this data is, unless you're, you know, some University of Maryland or UC San Diego student who has nothing but time for three years. And it turns out, well, that's exactly what happened. Yeah, old school never goes away.

19:16It's satellite war driving. Yeah, yes. Warp driving. Oh, I hope that catches on. the u.s supreme court has declined to hear appeals to a second case that challenged section 230 safe harbor protections for internet companies previously it declined to hear a case holding meta accountable for the radicalization of a mass shooter this time it declined to hear an appeal holding a dating app accountable for connecting a minor with adults who were later convicted of sex crimes against the minor in both cases lower courts ruled that the platform was not responsible for the conduct of the users. And in one case, in the second case, the users were punished, or at least three of the four were.

20:03What the Supreme Court is saying here is not that they agree or disagree. They're saying there's no reason for us to weigh in, especially in the second case. They said there's no confliction in the decisions of the lower courts. They're all very consistent. We don't see anything in Section 230 that stands out that we need to weigh in and say, we think you're misinterpreting it, so we're not going to weigh Yeah, there's a lot of political rhetoric around Section 230 as to whether it should exist or not. So it is kind of nice to see how the courts are keeping it pretty solid at this time. Yeah, and saying there is nothing in here that requires a judge to intervene.

20:45Good news and bad news for Android phone users. Android Police reports that Google has made a server-side change that stops apps from crashing on Pixel 10 devices. Android Police shared detailed logs with Google to help the company identify the problem in an update to Google Play services that was causing the intermittent bug. However, Samsung has stopped the rollout of One UI 8 for users of the older Galaxy S22, and Samsung has not explained why. yeah some s22 users who got the update were complaining of things like battery drain but that's also kind of common with an update so it's hard to tell if that's the actual reason or if there's something else but good work android police getting to help google with the the kind of weird crashes those kind of weird crashes are really hard to to track down the government of the netherlands used a never before invoked cold war era law to take over automobile chipmaker Nexperia after the U.S.

21:48warned that Nexperia would need to replace its Chinese CEO or go on a sanctions list. In response, China has put export controls on Nexperia components coming from its Chinese factories. So this is going to complicate making cars is the upshot. Yeah, I was trying to research this yesterday to find more precedent or any other rumbles of other nations doing this thing. Tom, do you have a crystal ball? Do you know where this is going? I don't. I imagine this is going to get caught up in the US-China trade negotiations, which right now are at their more combative ebb as they ebb and flow. I wonder if they reinstate a different CEO and then release this from Dutch control.

22:34But I don't think the Netherlands, Maybe I'm wrong, but I don't think the Netherlands wants to be in the business of running an automobile chipmaker. So that's the one thing I feel confident is that they won't continue to run this, but I'm not sure what the end result is going to be. Finally, some quick headlines that are just good to know if you want to understand the news in the future. Just quick bits. Perk up your ears. Microsoft has made it more difficult to activate the Internet Explorer mode in the Edge browser after discovering attackers exploiting a zero-day vulnerability in the mode.

23:09TP-Link announced it has conducted its first successful trial of Wi-Fi 8 hardware, which would bring reliability improvements over Wi-Fi 7. In a press release for the streaming version of the F1 movie, Apple noted that Apple TV Plus is now just called Apple TV. Password manager Dashlane is partnering with Yubico to let users use their FIDO2 YubiKey as the primary authentication for passwordless access to their password vault. Analysis from Graphite found that while the percentage of AI-generated articles rose sharply after the launch of ChatGPT in November 2022, the percentage converged in November 2024 and has been roughly equal ever since.

23:57Yay, humans. Anduril Industries, headed by Oculus founder Palmer Luckey, announced EagleEye on Monday. It's a system that can deliver live video, sensor data alerts, and more into a soldier's helmet. Google will invest$15 billion in a 1 gigawatt data center in India to be built within the next five years. Instagram's going to restrict content shown to those younger than 18 in Australia, Canada, the UK and the US. They are going to hold it to the same standard as US's PG-13 movie rating, which does not allow extreme violence, sexual nudity and graphic drug use. And family users of Spotify in seven countries can soon make managed accounts for children that can filter out adult music and content and far more importantly, keep the kids songs from affecting their recommendations.

24:45Yes, Baby Shark will no longer be your number one. That's everyone's example. Join in the conversation. Actually, it's probably a K-pop Demon Hunters song at this point. Join in the conversation in our Discord, which you can join by linking to a Patreon account at patreon.com slash DTNS. We end every episode of DTNS with some shared wisdom. Today, Rob has some thoughts on AI helping productivity. Responding to Friday's discussion, Rob Bugs Life commented on our Patreon, with the news items today, the stuff Jen mentioned and that I have seen on my own job, I'm not sure I can trust any of the reports of efficiencies gain when being self-reported by companies.

25:30When employees are told to find ways to use these tools and report back on gain deficiencies, they will find ways to at least appear to be following orders because they don't want to lose their jobs, which means a lot of that data in the future may be artificially boosted. From my own experience, there are no doubt benefits, but I would be lying if I said it added more than 15%, maybe 20 % efficiency to some tasks. Definitely not to everything. Keep sharing and thanks for keeping everything level-headed. Thank you, Rob. I'm happy I sounded level-headed as opposed to such a doomer because I always feel like I'm ragging on AI a bit too much, but I can only go with my lived experiences and the lived experiences of those I trust and who have showed me stuff.

26:17But 15 % to maybe 20 % efficiency is efficiency. So if people can keep bringing that forward, I think you will see less people being mad at it in the future. I don't know if this is my own bias showing, but I feel like everybody is trying to cheer against or for AI like it's a team. And I am trying very hard to look at it like a tool. And I look at it and when people say it's good for nothing, I dispute that. I'm like, no, it's good for things. It has helped me. It has improved and made things faster for me. 15, 20 % seems about right. Honestly, like it helps a little bit. If you're somebody who's like, it's changing everything, it's taking over, it's going to eliminate this and that.

27:03I'm like, maybe someday. I don't see that happening tomorrow. It isn't quite as good as a lot of its more enthusiastic supporters say, but that's not to say it's not good and not getting better all the time. To me, it's just like supporters of the internet, I remember in the 90s and early 2000s were like, this is just going to change how we work. And it did, but it didn't totally change everything about how we work. Yeah. In terms of the team thing, I was part of a migration from WordPerfect to Word. And boy, was that a team-based thing. People were so, so mad. but you don't hear about it anymore.

27:43Word one. Yeah. And honestly, if you are refusing to try these tools because you just think they're bad, you're doing yourself a disservice in two ways. One is you're not taking advantage of something that could actually help you in a small way. And two, even if you just want to be against them, it's better to know why and how they work and criticize them for the things they are bad at than to just not experience them at all. What are you thinking about? Do you have some insight into a story like Rob here? Because we love to hear it. Please share with us over at feedback at dailytechnewsshow.com.

28:23Big thanks to Rob for contributing to today's show. Thank you for being along for Daily Tech News Show. You can keep us in business. Become a patron. You can do it very easily. And you get a bunch of bonus shows too. Patreon.com slash DTNS. Talk to you soon.

28:43The DTNS family of podcasts, helping each other understand. Diamond Club hopes you have enjoyed this program.