Slashdot Mirror
Some Android Device Makers Are Lying About Security Patch Updates (phonedog.com)
An anonymous reader shares a report: Security patches for smartphones are extremely important because many people store personal data on their devices. Lots of Android phones out there get regularly security patches, but according to a new report, some of them are lying about the patches that they've actually gotten. According to a study by Security Research Labs, some Android phones are missing patches that they claim to have. Wired explains that SRL tested 1,200 phones from more than a dozen phone makers for every Android security patch released in 2017. The devices tested include ones from Google, Samsung, Motorola, LG, HTC, Xiaomi, OnePlus, Nokia, TCL, and ZTE. The study found that outside of Google and its Pixel phones, well-known phone makers had devices that were missing patches that they claimed to have. "We found several vendors that didn't install a single patch but changed the patch date forward by several months," says SRL founder Karsten Nohl.
Boardroom banter: Why should we provide free updates, when we can sell them a new phone...
This is because Google won't write a universal Android unlocking tool... As long as the unwashed masses can't really tell what the manufacturer did, why bother with anything difficult? ........There's a name for it...... Security through Deniability?
Is anybody even remotely surprised?
One of the huge problems with Android is it is now so fragmented, and every vendor has filled it with their own custom shit and they've done god knows what to the core of it.
As soon as it's shipped, they move on to the next product. They have neither the time, resources, nor inclination to maintain older versions of phones -- because they want you to buy a new one.
The reality is, there are as many versions of Android as there are phones and companies who make them. And companies aren't going to spend the resources on a shipped product, because they've been paid for it already.
So, yeah, they don't to updates, don't plan to do updates, and refuse to admit that it was abandonware before you even got your hands on it.
To me, this is the greatest failing of Android.
Plenty of the blame goes on carriers. If you have the new hotness, expect fairly regular updates. If not, good luck. Planned obsolescence is a load of crap perpetrated by carriers and manufacturers. I'd actually put more of the blame on carriers now that you pay full price + interest for phones in the US.
Some missing info from the sumamry about the average number of missing patches per device from each manufacturer
Average missing patches per device from each manufacturer
0 or 1 - Google, Samsung, and Sony
1 to 3 - Xiaomi, OnePlus, and Nokia
3 to 4 - HTC, Huawei, LG, and Motorola
4 or more - TCL and ZTE
Time to offend someone
Isn't it a crime for a company to tell such blatant lies to the public? Can't customers sue the companies for endangering their sensitive data? Is the no regulatory oversight for this?
Debate is a form of harassment. Do not question my truth.
until the current crop of devices are bought and used up, or recalled and destroyed, i dont want to buy another PC,. laptop or a phone or tablet until all this heartbleed, or meltdown (the CPU bug) is resolved,
Politics is Treachery, Religion is Brainwashing
IANAL but this sure sounds an awful lot like fraud. They claim to be providing a service but don't actually provide it? The FTC should come down like a load of bricks on these companies.
Anons need not reply. Questions end with a question mark.
The question is how they know the devices are missing the patch. Did the test all of the problems covered in the patch, on 1,200 different devices? Seems unlikely.
Because of vendor specific code changes, patches don't always apply cleanly and need changes, or the issue may have been fixed by the vendor in a different way, or even not relevant to the vendor's dist.
not likely with the "it's not our fault if it goes wrong" language in the EULA, unless you're prepared to lawyer up and fight that first. Good luck.
I was wondering why my Moto Z Force was still vulnerable in lab testing even after patching it. I submitted an email to their security team and nobody responded, so I thought maybe I was a snowflake case. This is even more of a case to only purchase google made android devices.
Mine is 3 years and a half old. I've been using it without problem, except the usual : it was getting slower and slower.
After 3 years, I decided to make a full factory reset.
Before : I had control over more things, many application were completely disabled, including Facebook (I never created an account) and Evernote.
After : I got back some battery life and speed, although it's not consistent, I have to reboot from time to time. But the most annoying is that I lost control over many applications. I can no longer disable Facebook or Evernote. Thanks Samsung. And I'm always getting the updates, although I disabled automatic update in the Play Store.
Samsung, give me control over the phone I gave you money to own !
Sadly, there is no LineageOS for the Note 4. There are for older models, and even for the Note 8, but not for the 4.
Will I buy a Note 8 ? Guess what Samsung : I will not pay nearly 50% more for a phone that probably cost you less than the Note 4 did !
Totof
But it doesn't. Most consumers don't know that Google makes Android. Most probably don't even know that they have an Android per se. Hell, most probably don't know that their phone has an OS. But they sure know that Google is a great search engine.
You're special forces then? That's great! I just love your olympics!
Thanks to Project Treble the Android fragmentation problem is solved. People already demonstrated this by running generic Android OS images on top of even some obscure phone models, which actually comply with Treble. Treble compliance is mandatory for any device with Oreo and upwards. What treble is - basically complete separation of OS and HAL. It is now possible to update Android regardless of the oem as long as bootloader is not permalocked.
Lineage website does not list independent roms built from their source code, only official ones, and there are TONS that are unofficial, so just because a model is not listed doesn't mean a version of Lineage doesn't exist. You need to go onto XDA (best place to look) and look for not just your model, but part number and carrier. You may even have to look at your specific firmware version.
If you have a locked bootloader you can still use a modified rom however you need to retain the stock kernel, which severely limits your options. Some people have modded the stock rom to work and look like Lineage while using the stock kernel. My old S4 was running a modified stock rom but being a Verizon model it had a locked bootloader. When i bought my S5 I made sure it was an unlocked T-Mobile variant and it currently runs Lineage.
Samsung works with carriers and will lock the bootloader and sim depending on the carrier's wishes.The S4 has been the bane of rom builders because Samsung refused to help unlock it and and did a darn good job on it. Later models have actually been a bit easier as they eased up on their restrictions a bit. The S4 was caught in the middle of being hackable like previous versions and Samsung being willing to work with us instead of against us and got left behind.
Who does what? Verizon has an unlocked sim, but a locked bootloader.
AT&T locks both the bootloader and the sim however the very first AT&T S4 had an unlocked bootloader, the first update locked it down. 2 years ago ones with original firmware carried a 40% premium over almost all other models.
Sprint locks the bootloader, the sim and deletes the sub menu for sim changes. (seriously, F- Sprint.)
T-Mobile however locks nothing but you will pay a premium for used T-Mobile and unlocked phones for the very fact that they are unlocked.
BEWARE. Being impulsive with a Samsung is a very quick way to owning a nice paperweight. Flash the wrong modem and your phone is permanently bricked and not all rom builders know how or that they are supposed to strip that out, I lost an S3 this way testing a rom for someone. If you want to flash a Samsung you need to pay attention when you buy (get a T-mobile model) and be prepared to read a lot before you start hacking because otherwise it will not end well. Nice phones, but they are one of the bigger pains in the neck and are some of the least forgiving when it comes to hacking. You can almost always save an LG or HTC, but a Samsung is very quick to hard brick.