Slashdot Mirror
71 Percent of Android Phones On Major US Carriers Have Out of Date Security Patches (betanews.com)
Ian Barker, writing for BetaNews: Slow patching of security flaws is leaving many US mobile users at risk of falling victim to data breaches according to the findings of a new report. The study from mobile defense specialist Skycure analyzed patch updates among the five leading wireless carriers in the US and finds that 71 percent of mobile devices still run on security patches more than two months old. This is despite Google releasing Android patches every month, indeed six percent of devices are running patches that are six or more months old. Without the most updated patches, these devices are susceptible to attacks, including rapidly rising network attacks and new malware, also detailed in the report.
I find it hard to believe that 29% of android devices have ALL the available security patches installed and are running a current version.
What, am I supposed to buy a new phone every year to keep up?
“He’s not deformed, he’s just drunk!”
My 3 year old android phone is fully up to date, software wise anyway.... I don't care if the other 71% want to go unprotected....
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I highly doubt that 29% of Androids are up to date.
Dewey, what part of this looks like authorities should be involved?
A strange game. The only winning move is not to play. How about a nice game of chess?
#DeleteFacebook
In light of all the recent surveillance revelations, maybe it's actually in the interests of these companies to drag their feet on security patches.
After all, they wouldn't want to jeopardize any of those big money contracts with some 3 letter agency.
I have a Galaxy S4 on AT&T. I just checked, and it's at Lollipop 5.01 and says its "Android security patch level" is 2015-11-01. Nevertheless, when I push the software update button, AT&T assures me that my current software is up to date. Apparently, 5.01 is the latest version available for an S4, but what about security patches? Are they just done making them? Was AT&T planning on telling me that?
I guess I'm a bad consumer, using a four year old phone.
Given the hands-off approach to making carriers push out updates it's no wonder. I still get some security updates on my Galaxy S5, but god knows most of them were probably outdated before 2016.
There's no profitability in pushing out recent updates to old devices that aren't being consistently paid for on installment plans, especially when you can just force people to upgrade for new OSes.
It's running android version 2.2.1! I feel as though I wont be the only one
That the end-user can't get basic android updates directly is Android's major flaw. OEM's should of been required to support the AOSP and any changes should of been done via extensions to the AOSP. Thus any device could easily stay updated for at least their current major version of Android.
Or rather, every incentive NOT to push security updates to phones. Just as they had every incentive to allow the act called Slamming, where you would get charged for a service you never agreed to, and the phone company got their cut of the transaction. In this case, their answer to securing your phone is that you should buy a new phone, up to date, with all the bells and whistles, a flagship model even! And they get their profit off adding on services to take full advantage of that new shiny plus profit from the sale of it! And if its out of date in 6 months because of security patches you aren't getting, well, they can let you pay a super extra special fee to upgrade your phone again early!
And your congressmen won't do shit about it, because this is data and privacy information and that pesky stuff doesn't need any kind of silly protecting!
I regularly check the patch status of the computers I use and install updates when available. I know how to do that. I read the messages from the Google Play Store alerting me to available patches for the apps on my phone and apply those patches and updates to the apps as appropriate. But every time I check the system updates status on my phone, the status is always the same - "Your device's software is up to date." What's an end user to do? The phone says it's OS is up to date. How am I to know if that's true or not? FWIW, the last time my phone gave me a message that there was any sort of system update available was several months ago. Every week there are new updates for my PC, and for the apps on my phone. But the OS patch level remains months behind and the phone doesn't know any better. And so neither does the end-user.
This is why I love Blackberry. While its Android phones have their quirks, Blackberry is ACTUALLY delivering routine security updates, almost as fast as Google itself does.
I still mourn the death of BB OS10 which was a great phone operating system. They lost the "app store" wars, but it was a great OS.
I chose to continue with Blackberry when I made the switch to Android for exactly this reason.
We're running old software because the manufacturers don't care about us after they've gotten our money. My experience with the Motorola G4 is a prime example of this. The phone came out in May 2016 with Android 6. Android 7 was released in August 2016, just three months after my phone was released, and I still don't have any update available for my phone despite the fact that Android 7 has been out for seven months! The worst part is that the OS on the G4 is practically stock Android, so it should take relatively little effort to customize the image and push it out. It seems the only way to guarantee access to new versions of Android is to buy a Google phone but the Pixel has one of the worst performance to price ratios of any Android phone. At this point, I have no idea what my next phone will be, but I have a lot of ideas about what it won't be.
To access VR and shit.
It'll be full of backdoors and the entire world population can be totally controlled by a single entity.
I used to own an Android phone and when i had it my carrier did provide updates. The problem was, there weren't just security updates, I had to upgrade to new versions of Android. There was no 4.4.1, it was jump from 4.4 to 5.0 or nothing. Since each version of Android moves things around, some new versions break old apps and there were battery/performance regressions when I tested 5.0 on another phone, I just decided to keep my main phone running the older version of Android. Getting hacked was less of a concern than dealing with a new version of Android. Rather than I upgrade I eventually switched operating systems.
So it's of little surprise most people are running out of date systems. Android phones often don't get updates and, when they do, it's worse than dealing with an unsecured device.
Android has a lot more problems than you think and Google does nothing to solve it.
We need a standard ARM platform, just like we've had the x86 platform since roughly 1981. And Google has all the resources to create and enforce it. And since they don't I wonder if they are malicious or negligent or it's just part of their business plan which is called "planned obsolesce". Too bad, in Google's case this obsolesce involves even original Google devices like Nexus 5 (stopped receiving any updates since October 2016) and it will soon be joined by Nexus 6.
That's just horrible.
Canadian, purchased a Nexus from Koodo/Telus so that the phone was unlocked. It was, but the service provided never pushed OS revisions out. I saw that they were being done in the US and on later Nexus models but never for what we had... At least the Apple products are upgraded 18 +/- months before code bloat kills their performance.
My iPhone is always up to date.
(says Google.) Now, just how do you integrate insecure privacy nightmares into a sanitary OS? Oh wait, you don't...
Android devices are the worse, as much as I like them... Carriers lock them down, refuse to work/pay for the upgrades with the manufacturer (Sony/T-Mobile Z3+ was the prime example).
It's the vendors. Now we might be outliers, but everybody in my family installs patches whenever they come in. Maybe not immediately but at least later that day, i.e., when we're home and can be sure the phone is fully charged and maybe using WiFi if it looks like there's a lot of patches. When we were using Verizon, our phones were always getting version N when all the news and buzz was all about the newly released version N+1. When we switched carriers, Verizon still had our phones running the previous version of Android.
CUR ALLOC 20195.....5804M
It doesn't fit the business model of carriers & manufactures in the android world. Why update it, when you can just sell gullible people a new one? Most people (I'm in the USA) still think you have to purchase one from a carrier, so when they walk in after hearing their phone is "out of date" given most consumers are well...not very intelligent...will be pushed into a new phone that has the updates already installed. Then, a year from now they will do it all over again.
If I could remove all the crap apps they make me have (yes you too Google, not just V*******), I'd have an up to date phone.
Mine is one of them, but it sure as shit isn't my fault.
If my carrier would provide updates I'd install them. If I could get patches I'd install them.
Don't blame me for not buying a new phone every 3 months.
Just cruising through this digital world at 33 1/3 rpm...
I can't get mine updated unless I hack it. Manufacturer won't put out updates.
Please tell us who your vendor is, or how you otherwise manage to keep your phone up to date.
The real problem is a conflict of interest. If all manufacturers provided updates to their phones for 5 years, you could be sure that far fewer phones would be sold each year. So instead they cut off updates to encourage/force consumers to buy new phones more frequently - creating a larger market than it otherwise would be. What we need is a separation of hardware and software so that the hardware can be used until it dies without sacrificing the software security updates.
I would expect it to be higher than 71%. However, considering how every millenial and gen-z (the biggest consumer of phones) find they can't live unless they have the next (trivial) incremental update to a phone then from a carrier perspective there is no urgency. Especially since the next phone should have the latest android release that includes the latest security patches -- the one they would use prior to filling it with their bloatware. Also, lets not forget that these largest consumers don't care much about their stolen privacy since they share it regularly on FB and other social media. There was a story where a bot could identify people with 80%+ accuracy solely by their publicly available social media posts.
Sure the app situation sucks - if you want them. But the Tiled UI is far superior to the mess that is Android and it is actively updated. If you just want a secure phone with a great camera and text/mail/web and some basic apps, Windows Mobile is the way to go.
Developing for it is pretty easy to.
Since Google and the carriers record everything I do and are willing to sell it to anyone with a big enough pocketbook, it's hard to say I'm "protected" by having an up to date phone. My only real hope is to never patch and hope to root it some day so that I can actually protect it myself.