Slashdot Mirror
71 Percent of Android Phones On Major US Carriers Have Out of Date Security Patches (betanews.com)
Ian Barker, writing for BetaNews: Slow patching of security flaws is leaving many US mobile users at risk of falling victim to data breaches according to the findings of a new report. The study from mobile defense specialist Skycure analyzed patch updates among the five leading wireless carriers in the US and finds that 71 percent of mobile devices still run on security patches more than two months old. This is despite Google releasing Android patches every month, indeed six percent of devices are running patches that are six or more months old. Without the most updated patches, these devices are susceptible to attacks, including rapidly rising network attacks and new malware, also detailed in the report.
I find it hard to believe that 29% of android devices have ALL the available security patches installed and are running a current version.
I have a Galaxy S4 on AT&T. I just checked, and it's at Lollipop 5.01 and says its "Android security patch level" is 2015-11-01. Nevertheless, when I push the software update button, AT&T assures me that my current software is up to date. Apparently, 5.01 is the latest version available for an S4, but what about security patches? Are they just done making them? Was AT&T planning on telling me that?
I guess I'm a bad consumer, using a four year old phone.
That the end-user can't get basic android updates directly is Android's major flaw. OEM's should of been required to support the AOSP and any changes should of been done via extensions to the AOSP. Thus any device could easily stay updated for at least their current major version of Android.
I highly doubt that 29% of Androids are up to date.
This is just major carriers. Imagine how many unpatched Androids are out there on Boost, Cricket, Tracfone, etc. My wife has an Android on Tracfone and never had a security update notification.
Taking guns away from the 99% gives the 1% 100% of the power.
We're running old software because the manufacturers don't care about us after they've gotten our money. My experience with the Motorola G4 is a prime example of this. The phone came out in May 2016 with Android 6. Android 7 was released in August 2016, just three months after my phone was released, and I still don't have any update available for my phone despite the fact that Android 7 has been out for seven months! The worst part is that the OS on the G4 is practically stock Android, so it should take relatively little effort to customize the image and push it out. It seems the only way to guarantee access to new versions of Android is to buy a Google phone but the Pixel has one of the worst performance to price ratios of any Android phone. At this point, I have no idea what my next phone will be, but I have a lot of ideas about what it won't be.
I highly doubt that 29% of Androids are up to date.
Keep in mind that the security patch level field was added in Android Marshmallow (IIRC), and I expect that's what they're using to determine patch date. If so, KitKat and Lollipop devices aren't counted, and this really says that 29% of Android devices that are new enough to have Marshmallow or Nougat are up to date. That's not surprising, though it's obviously still far too low.
Unless, of course, the report assumes that anything running Lollipop or older is not recently patched, which seems like a reasonable assumption.
Note to ACs: I usually delete AC replies without reading them. If you want to talk to me, log in.
Android has a lot more problems than you think and Google does nothing to solve it.
We need a standard ARM platform, just like we've had the x86 platform since roughly 1981. And Google has all the resources to create and enforce it. And since they don't I wonder if they are malicious or negligent or it's just part of their business plan which is called "planned obsolesce". Too bad, in Google's case this obsolesce involves even original Google devices like Nexus 5 (stopped receiving any updates since October 2016) and it will soon be joined by Nexus 6.
That's just horrible.
I've never had bad guys or bad software infect my phone but I'm pretty sure that each "update" from google grabs more and more of my personal data and sells it to the highest bidder. Exactly who/what are these updates protecting us from?
By "up to date", do you mean that you have the latest firmware installed, or that the firmware that is installed has all the security fixes to Android that Google has issued?
IOW, are you sure your phone hasn't been orphaned?
The real "Libtards" are the Libertarians!
It's the vendors. Now we might be outliers, but everybody in my family installs patches whenever they come in. Maybe not immediately but at least later that day, i.e., when we're home and can be sure the phone is fully charged and maybe using WiFi if it looks like there's a lot of patches. When we were using Verizon, our phones were always getting version N when all the news and buzz was all about the newly released version N+1. When we switched carriers, Verizon still had our phones running the previous version of Android.
CUR ALLOC 20195.....5804M
It doesn't fit the business model of carriers & manufactures in the android world. Why update it, when you can just sell gullible people a new one? Most people (I'm in the USA) still think you have to purchase one from a carrier, so when they walk in after hearing their phone is "out of date" given most consumers are well...not very intelligent...will be pushed into a new phone that has the updates already installed. Then, a year from now they will do it all over again.
My work phone is still running 4.4.1. it has NEVER been offered an update ever. Samsung took the money and ran with this one. Personal phone being Nexus, updated monthly.
Mine is one of them, but it sure as shit isn't my fault.
If my carrier would provide updates I'd install them. If I could get patches I'd install them.
Don't blame me for not buying a new phone every 3 months.
Just cruising through this digital world at 33 1/3 rpm...
The real problem is a conflict of interest. If all manufacturers provided updates to their phones for 5 years, you could be sure that far fewer phones would be sold each year. So instead they cut off updates to encourage/force consumers to buy new phones more frequently - creating a larger market than it otherwise would be. What we need is a separation of hardware and software so that the hardware can be used until it dies without sacrificing the software security updates.