Slashdot Mirror
71 Percent of Android Phones On Major US Carriers Have Out of Date Security Patches (betanews.com)
Ian Barker, writing for BetaNews: Slow patching of security flaws is leaving many US mobile users at risk of falling victim to data breaches according to the findings of a new report. The study from mobile defense specialist Skycure analyzed patch updates among the five leading wireless carriers in the US and finds that 71 percent of mobile devices still run on security patches more than two months old. This is despite Google releasing Android patches every month, indeed six percent of devices are running patches that are six or more months old. Without the most updated patches, these devices are susceptible to attacks, including rapidly rising network attacks and new malware, also detailed in the report.
I find it hard to believe that 29% of android devices have ALL the available security patches installed and are running a current version.
What, am I supposed to buy a new phone every year to keep up?
“He’s not deformed, he’s just drunk!”
My 3 year old android phone is fully up to date, software wise anyway.... I don't care if the other 71% want to go unprotected....
"File to fit, pound to insert, paint to match" - Aircraft Maintenance 101
I highly doubt that 29% of Androids are up to date.
Dewey, what part of this looks like authorities should be involved?
A strange game. The only winning move is not to play. How about a nice game of chess?
#DeleteFacebook
I have a Galaxy S4 on AT&T. I just checked, and it's at Lollipop 5.01 and says its "Android security patch level" is 2015-11-01. Nevertheless, when I push the software update button, AT&T assures me that my current software is up to date. Apparently, 5.01 is the latest version available for an S4, but what about security patches? Are they just done making them? Was AT&T planning on telling me that?
I guess I'm a bad consumer, using a four year old phone.
It's running android version 2.2.1! I feel as though I wont be the only one
That the end-user can't get basic android updates directly is Android's major flaw. OEM's should of been required to support the AOSP and any changes should of been done via extensions to the AOSP. Thus any device could easily stay updated for at least their current major version of Android.
Or rather, every incentive NOT to push security updates to phones. Just as they had every incentive to allow the act called Slamming, where you would get charged for a service you never agreed to, and the phone company got their cut of the transaction. In this case, their answer to securing your phone is that you should buy a new phone, up to date, with all the bells and whistles, a flagship model even! And they get their profit off adding on services to take full advantage of that new shiny plus profit from the sale of it! And if its out of date in 6 months because of security patches you aren't getting, well, they can let you pay a super extra special fee to upgrade your phone again early!
And your congressmen won't do shit about it, because this is data and privacy information and that pesky stuff doesn't need any kind of silly protecting!
This is why I love Blackberry. While its Android phones have their quirks, Blackberry is ACTUALLY delivering routine security updates, almost as fast as Google itself does.
I still mourn the death of BB OS10 which was a great phone operating system. They lost the "app store" wars, but it was a great OS.
I chose to continue with Blackberry when I made the switch to Android for exactly this reason.
We're running old software because the manufacturers don't care about us after they've gotten our money. My experience with the Motorola G4 is a prime example of this. The phone came out in May 2016 with Android 6. Android 7 was released in August 2016, just three months after my phone was released, and I still don't have any update available for my phone despite the fact that Android 7 has been out for seven months! The worst part is that the OS on the G4 is practically stock Android, so it should take relatively little effort to customize the image and push it out. It seems the only way to guarantee access to new versions of Android is to buy a Google phone but the Pixel has one of the worst performance to price ratios of any Android phone. At this point, I have no idea what my next phone will be, but I have a lot of ideas about what it won't be.
I used to own an Android phone and when i had it my carrier did provide updates. The problem was, there weren't just security updates, I had to upgrade to new versions of Android. There was no 4.4.1, it was jump from 4.4 to 5.0 or nothing. Since each version of Android moves things around, some new versions break old apps and there were battery/performance regressions when I tested 5.0 on another phone, I just decided to keep my main phone running the older version of Android. Getting hacked was less of a concern than dealing with a new version of Android. Rather than I upgrade I eventually switched operating systems.
So it's of little surprise most people are running out of date systems. Android phones often don't get updates and, when they do, it's worse than dealing with an unsecured device.
Android has a lot more problems than you think and Google does nothing to solve it.
We need a standard ARM platform, just like we've had the x86 platform since roughly 1981. And Google has all the resources to create and enforce it. And since they don't I wonder if they are malicious or negligent or it's just part of their business plan which is called "planned obsolesce". Too bad, in Google's case this obsolesce involves even original Google devices like Nexus 5 (stopped receiving any updates since October 2016) and it will soon be joined by Nexus 6.
That's just horrible.
(says Google.) Now, just how do you integrate insecure privacy nightmares into a sanitary OS? Oh wait, you don't...
Android devices are the worse, as much as I like them... Carriers lock them down, refuse to work/pay for the upgrades with the manufacturer (Sony/T-Mobile Z3+ was the prime example).
It's the vendors. Now we might be outliers, but everybody in my family installs patches whenever they come in. Maybe not immediately but at least later that day, i.e., when we're home and can be sure the phone is fully charged and maybe using WiFi if it looks like there's a lot of patches. When we were using Verizon, our phones were always getting version N when all the news and buzz was all about the newly released version N+1. When we switched carriers, Verizon still had our phones running the previous version of Android.
CUR ALLOC 20195.....5804M
It doesn't fit the business model of carriers & manufactures in the android world. Why update it, when you can just sell gullible people a new one? Most people (I'm in the USA) still think you have to purchase one from a carrier, so when they walk in after hearing their phone is "out of date" given most consumers are well...not very intelligent...will be pushed into a new phone that has the updates already installed. Then, a year from now they will do it all over again.
If I could remove all the crap apps they make me have (yes you too Google, not just V*******), I'd have an up to date phone.
Why is it the carrier's responsibility to patch someone else's handset? The device manufacturers should be making the patches and distributing them via the fucking internet. Let the carrier's be a dumb pipe - it's what they are best at. And if the device manufacturers don't patch their shit, don't buy their shit and go with someone who does.
I've never understood why people think that AT&T or Verizon should be writing and distributing patches for the thousands of shitty phones they sell - Best Buy doesn't make patches for all the shitty laptops and tablets they sell, and neither do the ISPs that connect them to the internet - it comes from the OEM or the OS publisher. In fact, the only retail relationship I can think of where the retailer is responsible for updates to something manufactured by someone else is with cars. And that works sooooo well that we should absolutely replicate that model with phones and tablets....
Slashdot still doesnâ(TM)t support Unicode after it was added to the HTML standard in 1997.
Mine is one of them, but it sure as shit isn't my fault.
If my carrier would provide updates I'd install them. If I could get patches I'd install them.
Don't blame me for not buying a new phone every 3 months.
Just cruising through this digital world at 33 1/3 rpm...
The real problem is a conflict of interest. If all manufacturers provided updates to their phones for 5 years, you could be sure that far fewer phones would be sold each year. So instead they cut off updates to encourage/force consumers to buy new phones more frequently - creating a larger market than it otherwise would be. What we need is a separation of hardware and software so that the hardware can be used until it dies without sacrificing the software security updates.
I would expect it to be higher than 71%. However, considering how every millenial and gen-z (the biggest consumer of phones) find they can't live unless they have the next (trivial) incremental update to a phone then from a carrier perspective there is no urgency. Especially since the next phone should have the latest android release that includes the latest security patches -- the one they would use prior to filling it with their bloatware. Also, lets not forget that these largest consumers don't care much about their stolen privacy since they share it regularly on FB and other social media. There was a story where a bot could identify people with 80%+ accuracy solely by their publicly available social media posts.
Sure the app situation sucks - if you want them. But the Tiled UI is far superior to the mess that is Android and it is actively updated. If you just want a secure phone with a great camera and text/mail/web and some basic apps, Windows Mobile is the way to go.
Developing for it is pretty easy to.
And there's the rub. The carrier doesn't want someone else to patch their phones, they want, they NEED control of the devices on their network, but like others have said, they don't really give two hoots after the sale. They will do as little as is needed to keep you a customer. What you don't know doesn't hurt them.
Since Google and the carriers record everything I do and are willing to sell it to anyone with a big enough pocketbook, it's hard to say I'm "protected" by having an up to date phone. My only real hope is to never patch and hope to root it some day so that I can actually protect it myself.