Slashdot Mirror
FTC Orders Apple, Google, Microsoft, BlackBerry, Samsung To Divulge Mobile Security Practices (networkworld.com)
coondoggie quotes a report from Networkworld: The Federal Trade Commission today said it issued a 10-page letter to eight leading players in the mobile communications arena requiring them to tell the agency how they issue security updates to address vulnerabilities in smartphones, tablets, and other mobile devices. Apple, BlackBerry, Google, HTC America, LG Electronics, Microsoft, Motorola Mobility, and Samsung must provide the following: The factors that they consider in deciding whether to patch a vulnerability on a particular mobile device, detailed data on the specific mobile devices they have offered for sale to consumers since August 2013, the vulnerabilities that have affected those devices, and whether and when the company patched such vulnerabilities.
The CARRIERS decide who gets the updates and when.
That would also be great for their fellow three letter agencies!
This is so nice of the government — protecting me from these nasty capitalists.
I wonder, if those among them, who cooperate with the police (and/or donate to the correct politicians), will be granted exceptions...
In Soviet Washington the swamp drains you.
Don’t buy phones that are locked to the carrier’s update schedule. Spend a little more and get something you can patch on your own terms.
Perhaps you’ve heard of iOS and/or Nexus devices?
Apple: We release updates directly to phones because we control the software and hardware stack
Google: We publish updates to the core OS, Android vendors implement updates. We we release updates to google apps on the play store. Vendors devices access to the play store if they sign a contract with us.
Samsung: We released 56 different phone models in 2014 and it's a pain in the dick updating even the flagships because of all the.. Uhm.. Value added software we load on them.
HTC: Uh. We publish updates on flagship models if it's convenient. Hey.. Uh.. Anyone want to buy a phone company?
Motorola: Who owns us now? Do we still make phones?
Blackberry: We're relevant! Our phones are secure.. Uhm.. Nevermind that we gave away our root keys when we said we didn't. Please buy a phone from us.
LG: What?
(except, perhaps apple, who maintains a stranglehold on iOS)
we provide the updates to the CARRIER, and it is primarily THEIR responsibility to distribute updates to THEIR customers. it is not our fault if they fuck up the software so bad that they can no longer simply pass-through updates as provided by us.
While I'm all in favor of more transparency in security vulnerability and patching processes, I wonder where the FTC gets the authority to order phone manufacturers to disclose this information. Is there some congressional statute they're acting under, or did they just make this up? Do they have unlimited power to require any company that manufactures and sells any product whatsoever to disclose anything they (the FTC) wants, or is there some narrower law they are working under?
If I can be modded down for being a troll, can I be modded up for being an orc, or a balrog?
Does the FTC have the authority to compel the production of this information?
try to obstruct security again.
The other tries to outlaw encryption.
(If at first you don't succeed, do it different next time!)
In Germany, we only need one agency for this kind of hypocrisy: The "BSI" has _both_ the duty to promote the security of IT _and_ the duty to help with placing trojans on whatever computer the gouvernment wants to spy on. Go figure how much trust people have in advice from BSI...
After all, they are insignificant in the mobile world.
Pre-9/11, the NSA had a similar bent... They had a group working on securing stuff, and a group working on cracking stuff.
See Cliff Stoll's "The Cuckoo's Egg". He talks about his visit to NSA.
General Relativity: Space-time tells matter where to go; Matter tells space-time what shape to be.
The FTC, according to the letter, is doing this on the basis of a "resolution." No law. No regulation. Just they _resolved_ it in order to complete a study. They're basically making a willful power grab. I wonder if the manufacturers will bite or fight? I think they should tell them where to stick it.
The FCC or NSA has more authority to do this than the FTC. The NSA through a FISA court order seems the most likely way to grant any legal authority in the matter. This is otherwise a blatant power grab. What the hell is wrong with the executive branch these days? In the lame duck years, it seems to be going out of its way to assert new, untold powers by only their say-so. This requires a regulation that does not exist, and can only be made by the legislature.
Finally, just what the hell does this have to do with trade policy/regulation? This is clearly NSA mission territory in my book. I would actually be comforted if the NSA took an interest in this and started helping us secure our technology instead of hanging on to a pool of vulnerabilities that any nation could exploit.
Carriers and/or OEMs who abandon phones within 5 years of introduction should be compelled to release any signing keys that they used to lock bootloaders.
If Verizon wants to create a walled garden with locked bootloaders, then they have a responsibility to maintain it. Any devices that do not receive quarterly security patches should be forced open, allowing Cyanogenmod (et al) to become an option for security fixes. Novice users can then use third party security support, and power users can wipe Verizon's beloved NFL bloatware with prejudice.
I wish I had an LG with a leaked key, rather than my Samsung that lives in a straightjacket. I would never buy Samsung again. My Samsung will be retired far before the end of the useful life of the hardware.
If we're going to ban Samsung at the borders, let's not do it over rounded corners. Let's do it to control the hardware that we own.
Since they now will publish vulnerabilities they know, and which have been fixed, and how they determine what is important to fix!!!
- Tjp
I am in wallow with my inner money grubbing capitalistic pig. ... Oink!
I have one - it got 5.1 Lollipop late last year, and it just got a security update.
he factors that they consider in deciding whether to patch a vulnerability on a particular mobile device, detailed data on the specific mobile devices they have offered for sale to consumers since August 2013, the vulnerabilities that have affected those devices, and whether and when the company patched such vulnerabilities.
We also want detailed information on how your update process can be subverted by the FBI.
carriers restrict what updates are made available to customers on their network.
So what blocks updates for Wi-Fi tablets? My carrier is Xfinity or Chick-Fi or Wendynet.
What in the Constitution grants the FTC the power to demand this information?
The fact that phones are manufactured in East Asia and sold across state lines for use on networks that communicate across state lines. There's your "commerce with foreign nations, and among the several states" that the Constitution grants the Congress "power [...] to regulate". And the Congress has chosen to exercise this power by creating the FTC and FCC.
The FCC launched an inquiry in partnership with the FTC. I submitted a story to slashdot on the FCC inquiry, yet somehow this is what we get.
Regardless, this is a big story, as the way security patches have been handled -- or more preciesly ignored by the carriers and manufacturers -- has become a huge problem. We're talking millions of vulnerable internet-connected mobile devices out there which, the way things are now, will never get patches for severe exploits like Stagefright.
www.gaiageek.com
Well, not exactly the carriers. Or the manufactures either.
Most people who use cell phones in the US are totally unaware of the certification process in place for those phones.
The main game in town is PTCRB. This makes up most of the GSM/UMTS and LTE carriers in the US and Canada. Verizon has their own program, which by and large follows GCF, the European counterpart to PTCRB, but based on open standards. Though, VzW mixes in proprietary standards.
The certification for PTCRB has a LOT of testing involved. For a modern phone supporting 2G/3G/LTE, we are talking in excess of 15k separate tests which are run for conformance testing. This doesn't even include Field testing. Now, the manufactures cannot run these tests on their own, unless they are a PTCRB lab, which is very uncommon. Normally, they need to use a test house, which will determine the testing scope, run the tests, create the reports and then upload the test reports to PTCRB who will then approve the product.
Now.. that certified product is linked to a SVN number. That is the last 2 digits after the IMEI number. That lets the network know which version of HW/SW your phone is.
Every single time a new SW version comes out, they need to certify it again. Normally, this is done via an ECO (engineering change order) and the testing scope is pretty small. It still can take weeks though, depending on how busy the labs are. That's only PTCRB!
If they also have VzW it's way more of a pain.
The GCF model is a lot better IMO. It is self certification. The tests need to be run in the lab though, but there is no need to go through all the paper work stuff for a software update. Just some due diligence to ensure you didnt break anything and you will not harm the network.
Though, if they want to change the feature set or add a band... that's a whole new ball of wax.
Actually, if they enabled a band, they would technically need to get a new FCC ID as well. Then the model name would also need to change and it would be considered a variant product as far as PTCRB is concerned.
Similar story for Bluetooth SW/HW as well. Except that goes through the BT SIG.
The FTC need to mind their own business. Their job is to focus on TRADE, not security.
To hell with the FCC also.
They self proclaimed authority over the Internet, and so we don't recognize them ANYPLACE.