Slashdot Mirror
Wireless Carriers Put On Notice About Providing Regular Android Security Updates
msm1267 writes "Activist Chris Soghoian, who in the past has targeted zero-day brokers with his work, has turned his attention toward wireless carriers and their reluctance to provide regular device updates to Android mobile devices. The lack of updates leaves millions of Android users sometimes upwards of two revs behind in not only feature updates, but patches for security vulnerabilities. 'With Android, the situation is worse than a joke, it’s a crisis,' said Soghoian, principal technologies and senior policy analyst with the American Civil Liberties Union. 'With Android, you get updates when the carrier and hardware manufacturers want them to go out. Usually, that’s not often because the hardware vendor has thin [profit] margins. Whenever Google updates Android, engineers have to modify it for each phone, chip, radio card that relies on the OS. Hardware vendors must make a unique version for each device and they have scarce resources. Engineers are usually focused on the current version, and devices that are coming out in the next year.'"
Does Dalvik have the same security problems Oracle Java does? If so this is a serious problem
Some drink at the fountain of knowledge. Others just gargle.
Handset manufacturers should stop screwing with it so much, if they used pure android it wouldnt be so much work to get updates out.
And haven't had an update since the first year.
They (Verizon) should at least push updates while it's still under contract.
Every new revision of Android is this large, monolithic package that seems to take years to get right. If Android were more modular, you could have teams working in parallel on various modules, and releasing them as needed. This is what regular Linux does, so I don't see why Android doesn't do more of it. Other than the Google Apps package, everything else seems to be lumped together. (and yes, I know it's more modular behind the scenes, but if it isn't that way for the user, it's a moot point.)
--- Generation X: The first generation to have SIG lines inferior to their parents... ---
How about instead of spending money on modifying those new versions of Android to work on old models, offer ways to unlock the bootloaders so that people can get the security updates they desperatly need through third party ROMs such as Cyanogenmod?
I got the first post! Suck on that, Baquack Obamailure!
"said Soghoian, principal technologies and senior policy analyst with the American Civil Liberties Union."
Finally, an article about the dangers of Android that quotes someone I'm prepared to listen to. I'm not entirely sure why the ACLU would be involved in this stuff, but I do have some respect for them and believe them to be objective in this matter.
I'm tired of the barrage of articles about the security problems with Android, and the need for anti-virus to resolve them - quoting people paid by the anti-virus companies.
Another way in which iOS is superior. Every user gets offered every OS update, within a day of it's release.
It's a mystery to me why people put up with Android's deficiencies.
Is this the reason why Google are having such a hard time selling Nexus devices? Are the hardware manufacturer + carriers reluctant to allow teh NExus 4 on the market at "Google prices"?
If the carriers were what most of us want, i.e. dumb pipes, then we could possibly own our phones and upgrade them in a much easier fashion (so long as the hardware manufacturer is still providing updates).
Verizon's treatment of the Samsung Galaxy Nexus has been an eye opening experience and I'm still trying to figure out an alternative solution.
Android really needs a system where security updates can be delivered outside of entire OS updates. Carries could enjoy their OS lock-in while users still manage to get security.
A novel idea! Maybe the carriers could stop f**king with the OS and make it easier to upgrade?
Engineers are usually focused on the current version, and devices that are coming out in the next year.
So what you're saying is that it's absolutely PERFECT for the wireless industry, eh? Keep people wanting the future product that you have to buy before the end of your contract!
I wish I were joking.
Whenever Google updates Android, engineers have to modify it for each phone, chip, radio card that relies on the OS. Hardware vendors must make a unique version for each device and they have scarce resources
How come the cyanogenmod people do a better job than everyone else in the industry?
I just upgraded a LS670 last weekend to cyanogenmod. CM9 if I recall. Its faster, looks better, more features, MUCH newer which would imply fewer holes, overall quite a massive improvement over stock. It no longer has cell service, I'm using this phone as a wifi microtablet, quite happily.
"Science flies us to the moon. Religion flies us into buildings." - Victor Stenger
I have ClockworkMod Recovery and it's a royal pain to update the OS. AT&T pushed an update to my Skyrocket a few months ago and I haven't updated yet because of it. And the whole re-rooting afterwards...
Karma: Bad
for *BSd becTause
I'm shocked that an easily rootable platform such as Android has security holes...
How is this unexpected? Unlike Apple phones and Microsoft phones, Android are a mishmash of some open source stuff, and some carrier specific stuff. This is part of the reason that I, at least, went with a MS Phone, instead of an Android phone. It reminds me of Linux: the core of it may all be the same, but by the time you slap all kinds of custom stuff on top of it, every single version is essentially different from every other version, and compatibility goes down the drain. So of course the carriers are going to be very delayed in updating everything: they have to juggle multiple versions of "Android" phones, and each update has to be tested and customized for each version. There IS a downside to the wide amount of customization that Android allows. Apple and MS phones, on the other hand, are true walled gardens, so they're much easier to update.
I don't respond to AC's.
The problem is Android phone manufacturers, rooted in traditionally consumer electronics oriented companies, are pumping out far more models than they could ever hope to provide adequate support for, as they aren't used to actually having to provide long term support for anything. This is one area they could really learn something from Apple, whose home computer roots have taught them what's involved with proper support. As consumer electronics get smarter, you're gonna see the same types of problems from everything these guys produce... next up, smart televisions. Those companies would have us just throw these perfectly good older devices away, and upgrade to a new ones, but I don't think consumers much like that idea - or at least, I know I don't.
Google, Samsung, and Verizon have scarce resources? Are earning little from this? Bitch, please x2
(-1: Post disagrees with my already-settled worldview) is not a valid mod option.
In previous comments related to carriers and phones, I stated that I am done with carrier games.
I am done with carriers selling me "discounted" phones which are actually far over-priced when required and unwanted data plans are added to the mix. I am done with carriers and their spyware and bloatware. I am done with carriers controlling the obsolesence of my device by providing late updates or failing to update them at all.
Long ago I recognized the potential for security issues which predictably would not be managed by the carriers well or at all.
Apple has it easier and it was by design. There are fewer models of iPhone so everyone is happier. Users know what they've got. The accessory makers are better guaranteed sales of mass produced products. Apple's carriers don't get to corrupt the iPhone and therefore there is more sanity when it comes to user concerns like bugs and security.
I have a Google Nexus. Not quite my ideal phone, but less expensive than unlocked/unbranded Samsung Galaxy S3. It is more likely to get updates and fixes and within my power to install and use custom ROMs.
Carriers care more about themselves than their customers. It is clear and evident. Why keep hoping and demanding that they care? Know them for what they are and respond.
For Android, updates only come with phone contracts.
So, if you buy a wifi Android device (similar to an iPod Touch), how do you get updates?
Answer: You don't. There is no business model for updating that kind of device.
Discuss.
Usually, that’s not often because the hardware vendor has thin [profit] margins. Whenever Google updates Android, engineers have to modify it for each phone, chip, radio card that relies on the OS. Hardware vendors must make a unique version for each device and they have scarce resources. Engineers are usually focused on the current version, and devices that are coming out in the next year.
That's pretty funny, because there's a small group out there that manages to provide nightly updates for almost EVERY PHONE ON THE MARKET for free... http://get.cm/?type=nightly
It seems to me like a carrier could simply let you switch to CM10 and get your updates from them as long as you agree that their updates are your problem and not the carriers... oooh... wait... the problem isn't updating Android... the problem is updating all their adware revenue bullshit to work with android, not the OS. I forgot. Sorry!
Are you in?
First, stating the obvious - Google acquired Android.
This means even Google cannot get it right.
The CyanogenMod community puts a lot of hard work into trying to support old models, but Google/Motorola will not release the information on how to unlock the bootloader.
Most modders view this as a serious hit to Google's "no evil philosophy".
It is more than just Google Android OS -> Phone Manufacturer but also then on to the Cell Carrier. Yes a new Android OS rolls out, and yes the Phone Manufacturer has to tweak drivers and what not. But after that the Cell Carrier then tries to splice on their apps other misc. clutter. This 3-phase pipeline is just murder for delivery. At each transition there is pushback. There had been, for example, discussion on the Droid BIONIC forums on how Verizon rejected a build from Motorola (for ICS) due to "poor quality."
Right when there's new DMCA rules that don't allow you to jailbreak your phone. Yet, if a carrier refuses to patch their phones, one can't legally load a new firmware on it, right?
If an update bricked a phone and the owner died because even 911 wouldn't work, the carrier would be saddled with a slam-dunk loser case that would cost them at least $50 million dollars in settlements, fines, and legal fees.
This is very interesting in the context of the recent US ban on unlocking. As I understand it, the argument for banning unlocking has to do with the carriers wishing to retain at least partial ownership over your handset. As such, surely they're responsible for security implications? However, they're never keen on the effort involved in keeping older devices secure (which is more of a new threat in the age of android smartphone than it was on older proprietary non-app, non-data handsets).
So what happens when the handset is still in use but old enough that the carrier can't be bothered to support any more? Will they be faced to take responsibility for security issues? I don't know the average expected life of phones these days but I expect that a couple of years ties in with max contract length so is likely to be the support period.
In the UK, the sale of goods act covers the quality of goods sold and they must be "sufficiently durable" - if you can prove the manufacturers goods aren't up to snuff they have to fix them for you. Certainly in a phone I'd expect that leaving a known security hole with no patch should fall into this remit. And how long do the goods need to be "sufficiently durable"? Six years. That could prove a major headache here at least. I'm not sure what equivalent consumer protection laws there are in the US that could cover the same eventualities?
This separation is what Firefox OS does actually.
There is the lower level linux kernel/Gonk layer and then Gecko running on top of that. So Gecko can be patched with small over-the-air updates (these may come straight from Mozilla). Either way the burden on a carrier would be notably less.
As a bonus Gonk is based on the same code Android uses, so if a carrier wants to port Firefox OS onto Android compatible hardware it should be relatively easy.
> they have scarce resources
If he said that he can't have any idea what's actually going on. I mean, the US wireless carriers are practically printing money. The fact that they don't update phones has a lot more to do with the fact that they're completely incompetent and most decidedly evil.
They should only be selling phones as stock Android if the carriers are unwilling to manage changes whenever a security update or new version of the Android OS is available.
But ... it's OPEN!
And this is exactly why I threw in the towel on Android. Two reference phones, bought unlocked, were abandoned. After the second one, and seeing my daughter's ancient iPhone 3GS continue to receive updates, I bought an iPhone 5. Perfect world? No. But I do get regular updates and it works with my iTunes/Apple TV. None of the phones worked perfectly in my Ford with SYNC, but sending text messages is limited to feature phones (reading on the iPhone was added in the latest Ford software update). Smartest thing Apple did was maintain control of updates.