Slashdot Mirror
Samsung To Push Monthly Over-the-Air Security Updates For Android
wiredmikey writes: Smartphone maker Samsung said on Wednesday that it soon will implement a new Android security update process that fast tracks mobile security patches over the air when security vulnerabilities are uncovered. The South Korea-based maker of popular Android smartphones said that it recently fast tracked security updates to its Galaxy devices in response to the recent Android "Stagefright" vulnerabilities uncovered late last month by security firm Zimperium. News of the initiative is great for Android users. For years, wireless carriers and phone manufacturers have been accused of putting profits over protection and dragging their feet on regular operating system updates, making Android users vulnerable to malware and other attacks. Nexus is also joining the monthly OTA update club.
Promises, promises, promises...
I'm curious how they'll "encourage" users to upgrade to the latest shiny if the slightly tarnished shiny is still up-to-date...
it's so simple; but where's the profit?
Samsung needs to offer custom roms for there phones there don't void any warranty when installed over the carrier roms of there phones. As well the rooting tools if needed to install a custom rom.
Does anyone remember the time when software just WORKED? When you didn't have an update of something every single day? What is it with phone users? I know everyone seems to want the latest and greatest. But DOZENS of app updates a week is just boring. And when the phone is updating you can barely use it.
I thought the future was going to be full of ads. It seems the future, actually, is just full of updates...
Samsung may promise timely over the air security updates, but will the carriers deliver?
My Samsung Galaxy Alpha is from AT&T and the "Check for updates" is also labeled "AT&T Software update" NOT Android/Samsung update, so I am still at the mercy (such as it is) of AT&T for the security of Android on my phone.
Device released prior to not eligible for updates.
ELOI, ELOI, LAMA SABACHTHANI!?
Samsung can make all of the updates they want, but if Verizon and other companies just sit on them, it won't do us much good.
Yes, that would be a great way to lose business from every single one of the carriers they do business with.
Samsung is just as good at abandoning Android updates as ever but they do have "Security policy updates" they can roll out whenever they like.
Now, someone else flesh this out, 'cause I have to go.
So with my otherwise perfectly functional 2011 plain old Nexus that hasn't seen an upgrade since Jellybean I'm out of luck? Eh, life in the big city, I guess.
“He’s not deformed, he’s just drunk!”
This is how Android can survive as a reliable platform. Props to Samsung for promising to honor the payments I make monthly basis for support.
Its not all about profit, its about service. Right? Thats what will differentiate the better carriers, in addition to the coverage, bandwidth and oh.. yeah.. HARDWARE!!
What about the disastrous SwiftKey vulnerability? It makes Samsung Android systems vulnerable too. Samsung said they'd fix it back in June, but we still have no patch.
When buying an Android phone: Measure how many days it takes from the vulnerability report (at least publicly) until it's patched in phones already used by customers. Focus on phones more than 2 years old, since your phone will be that age someday. Then: Don't buy from unresponsive makers. I suspect that if a few buying guides included those numbers, some manufacturers and service providers would start paying attention.
- David A. Wheeler (see my Secure Programming HOWTO)
That or just not push out steaming piles of garbage like the Lollipop update for the S5.
Plus it only helps if the users install them.
Some users aren't fond of having the root access they got (sometimes after risks or struggle) taken away on a monthly basis.
People buy phones from a carrier? Wow. So 90s.
Came here to say this.
The problem has never really been Android's willingness to correct and publish security-related patches; the problem is that the carriers control OTA and therefore limit OTA update support for phones that are fairly new. According to the carrier, if you want a secure phone, you'll just have to buy a new one from them.
Welcome to the Panopticon. Used to be a prison, now it's your home.
You mean back before it was networked (or otherwise shared data with potentially-hostile parties) so that the bugs didn't matter? And before people really started looking very hard for the bugs?
Sure, I remember then. You had shitloads of bugs, but you didn't know about most of them, and when you did know about one ("if you type too long of an answer in this char[40] blank, it makes weird things happen, so make sure to keep your answer 40, oops, I mean 39 characters or less"), you had little reason to care about them. (And if a bug is unmanifested, is it really a bug? 1985 answer: no. 1995 answer: yes.)
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
Imagine that happening on a computer that didn't fit in your pocket. "I can't upgrade my desktop from 12.04 to 14.04 because Comcast won't let me." It would almost be enough to make you stop buying PCs from your ISP!
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
When buying an Android phone: Measure how many days it takes from the vulnerability report (at least publicly) until it's patched in phones already used by customers. Focus on phones more than 2 years old, since your phone will be that age someday. Then: Don't buy from unresponsive makers. I suspect that if a few buying guides included those numbers, some manufacturers and service providers would start paying attention.
It would be very helpful if there were a website that tracked cellphone support information, such as outstanding defects, and average defect correction time. I don't know of any such existing site, but suspect it would be a splendid opportunity to attract a large number of clicks.
This is a new update mechanism for security updates [and bug fixes, hopefully] for the device firmware (e.g. kernel) that makes it less painful for phone vendors and carriers to implement.
A few things to note [most of this is conjecture on my part, as software engineer, until the details emerge]:
- Android source code (e.g. kernel, dalvik, etc.) is maintained via git (with a Google wrapper program called "repo"). I regularly update a source tree via this.
- git has extremely powerful branching and merging capabilities. Thus, it's very easy to create a fix in one version and get git to apply the resulting patch/delta to other branches of the tree. That is git's forte. For example, do the security fix in the latest under development branch and then propagate it to all older branches [can be automated easily].
- Because you're just changing a small portion [we hope that the bug fix is only a hundred lines of code or so], the patch can easily be applied.
- Because the change is relatively small (e.g. 4.4.2 to 4.4.2.1) vs. going from 4.4.x to 5.0.0, it's far less QA testing as the old rev has been extensively QA'ed as a whole.
- This will encourage vendors/carriers to adopt this, even for old phones, because it's just a bug fix and not feature creep that might require more powerful hardware.
- This mechanism won't cut into margins because it is [will be] an automated way to apply just security updates (e.g. [gasp] Windows update). This could still have been done in the past, but it wasn't as easy [as Google seems to want to make it].
- Vendors/carriers will still be able to "up sell" to the latest and greatest for new features. So, no conflict/disincentive.
- Vendors/carriers will be encouraged because it's now easy to do, everybody will be doing it, and [a serious] black eye for any vendor/carrier that doesn't [far more so than in the past].
- And the legal liability for Google, vendors, and carriers for the MMS vulnerability is so severe, that any company that does not implement this could be sued into oblivion. For example, in the PC world, would any motherboard vendor decide they would prohibit critical security bug fixes via Windows update?
Like a good neighbor, fsck is there
Hang on a second... I understand what you're saying, and I'll definitely believe it applies to phones originally bought from a carrier. However, if I were to buy a Samsung directly from the manufacturer and then use it with a carrier, I'm not beholden to the carrier for updates, right? Since it's not a carrier-branded phone, I can just get updates over any valid internet connection, right?
Or does what you're saying even apply to non-branded unlocked phones? If it does, wow... I didn't realize the update regime was *that* screwed up.
Makes me wonder whether they are including garbage like "Uber"-type-installations in these "security updates". I didn't want Uber, it was forced on me by the carrier, "ChatOn", which judging by the autostarts app is hooked into every possible event, was provided by Samsung. Though I have never even opened the app it still runs at boot and receives notification of everything that happens on the device. As it is "system software" it cannot be removed. Carriers can fuck off, my next phone will be nexus or related, directly from google.
Great, awesome, now can we finally get updates for laptop video cards now too? You know, especially the ones marketed as "gaming laptops" that only ever get one driver release and are incompatible with the chipset manufacturer's source drivers?
How about a read-only switch on the device ..
Among the four major U.S. networks, are there still any that don't have a carrier that itemizes the price of the phone and service?
MVNOs have been itemizing hardware and service for a long time. Among non-virtual U.S. carriers, T-Mobile led the way with its "Even More Plus" plan that did not include a handset, which eventually evolved into its current "un-carrier" pricing structure. Ting, an MVNO, started on the Sprint network and has expanded to be a T-Mobile MVNO as well. But what MVNO is any good for "unlocked" phones on Verizon (now that it's using UICCs for CDMA+LTE) or on AT&T?
What phone are you using that makes it so you can barely use it when it is getting an update? Perhaps you have too many apps?
My Nexus 7 (2012) tablet running Lollipop is unusably slow while an app is being installed or updated.
APIs are SUPPOSED to shield developers from constantly changing parent software, be it a browser or an OS.
Supposed to, yes, but a lot of app developers unwittingly end up depending on behaviors that the API specification called undefined, unspecified, or implementation-defined. Such dependency is a defect, but that doesn't stop applications from being published with hidden defects.
It is an insult to good developers who actually take more than 5 seconds to sit down and think, "HMMM, you know, changing this would break literally everything, better not do that!"
How about "the way we designed it it three years ago is vulnerable to a certain class of attacks that was discovered a couple months ago"? Windows Vista, for instance, had to break compatibility with interactive services because of the Shatter attack.
So once a month you can lose root, have all new problems with data speeds, battery life, etc. introduced, and have new permanent applications installed. All wrapped up in nice shiny gratuitous interface changes.
This posting is provided 'AS IS' without warranty of any kind, implied or otherwise.
Not unless you can guarantee that the defect will be found and patched before it's exploited.
The FakeID bug was patched before any exploit. Read again what swillden wrote: "Google also examine the contents of other app stores, and non-store app repositories. There wasn't a single instance of an app with a faked certificate chain, anywhere, until the public disclosure of the bug." Even when Google made like Flo from Progressive Insurance, scanning its own app store and those of its competitors, it still found no exploitation of this particular defect.
How about "I can't connect this computer bought elsewhere to Comcast's network because Comcast won't let me"? Good luck getting anything other than a Verizon or Sprint phone working on Verizon, Sprint, or Sprint MVNOs, because these networks use CDMA2000 instead of the more widespread GSM/UMTS.
you won't get updates if you rooted the galaxy. *naya*naya*.
can we get a link to official galaxyupdate.com website?
My Samsung was recently updated with the latest AT&T update that came out.
I started getting hits on my firewall for traffic going to Chinese IP addresses on TCP port 5287. Some sites are saying this is a RAT (remote access tool) and that it was "included" in the latest android firmware update from AT&T.
Since my AT&T phone is "locked" and I can't get root access, I won't be able to install a proper firewall on the phone to block this traffic when away from my wifi. I will need to keep an IPSec/VPN tunnel open to my firewall to ensure all traffic goes through my policy enforcement. What a pain...
None of the mobile anti-virus software detects the baidu malware/trojan:
Malware Bytes: NOPE
Avast: NOPE
Kaspersky: NOPE
Yet I see the traffic banging on my firewall constantly. This makes me wonder if the mobile anti-virus/malware software actually does anything???
Have you ever seen anything like an app that does a netstat report to show you where your phone is "phoning home" to ? How about an app that would work essentially like NTOP but for your phone, so you can see all the places your device is going and where you might not want it to go?
However, if I were to buy a Samsung directly from the manufacturer and then use it with a carrier, I'm not beholden to the carrier for updates, right? Since it's not a carrier-branded phone, I can just get updates over any valid internet connection, right?
I did forget about the possibility of BYOD, but as far as I know the big carriers get really passive-aggressive about putting your device on their network. I guess if you contract with an MVNO, or sign up for their poorly-publicized BYOD programs, they may not be as bad. And then, possibly, the manufacturer can update without interference from the carrier.
But I suspect that BYOD phones on wireless networks is a vanishingly small minority compared to the far more typical "go to carrier, buy contract and (locked-in) phone at the same time" scenario.
Welcome to the Panopticon. Used to be a prison, now it's your home.
The US wireless carrier may be selling the phones for disposable prices, but they're paying the manufacturer the real price (with highly negotiated discount rates and volume plans, I'm sure, but the manufacturer isn't selling them below cost.)
I've got a Galaxy S4 Mini, because it was smaller than the newer phones they had on the market at the time, and I wanted a phone that would fit in my pocket. Probably should have gotten an Apple iPhone instead.
Bill Stewart
New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks