Some Android Device Makers Are Lying About Security Patch Updates (phonedog.com)

An anonymous reader shares a report: Security patches for smartphones are extremely important because many people store personal data on their devices. Lots of Android phones out there get regularly security patches, but according to a new report, some of them are lying about the patches that they've actually gotten. According to a study by Security Research Labs, some Android phones are missing patches that they claim to have. Wired explains that SRL tested 1,200 phones from more than a dozen phone makers for every Android security patch released in 2017. The devices tested include ones from Google, Samsung, Motorola, LG, HTC, Xiaomi, OnePlus, Nokia, TCL, and ZTE. The study found that outside of Google and its Pixel phones, well-known phone makers had devices that were missing patches that they claimed to have. "We found several vendors that didn't install a single patch but changed the patch date forward by several months," says SRL founder Karsten Nohl.

Comments

Planned Obsolescence

[A10Mechanic]

Boardroom banter: Why should we provide free updates, when we can sell them a new phone...

Re:Planned Obsolescence

[Anonymous Coward]

"My phone is still totally fast and has plenty of space, but I'm missing a few security patches, so I'll just buy a new phone." said no customer ever.

Re:Planned Obsolescence

[green1]

I sort of just did...

I had a Samsung Galaxy Note 4. It's a better phone in almost every way to any phone on the market today. (processor is a hair slower than the newest phones, but I'd never found it slow at all, and it's hardware feature set was so far beyond any other device you can buy now as to more than make up for it) But it also hasn't had a security patch in a long time, and several high profile security exploits have come out since the last one. As a result I decided to "upgrade" to a new phone. I miss the large screen on the Note4 (all the new phones quote larger numbers for screen size, but due to the 2:1 aspect ratio have fewer square inches, and less usable space as it's too narrow). I miss the IR transmitter on the Note4, I miss the removable battery (I was on my 3rd battery, something not possible on modern phones), I miss the MHL video output (very few phones have any wired video output capability anymore, despite that it used to be near ubiquitous) I miss the textured back that didn't require a bulky case to simply be able to hold on to.

But I also knew that I couldn't reasonably hold on forever with the vain hope that someone releases decent hardware again some day.

Re: Planned Obsolescence

[Pax_Europa]

I've inherited a hand-me-down Note 4 and am currently running the wonderful Resurrection Remix ROM (7.1),undervolted and underclocked, rooted with Magisk, and it's a fantastic phone IME.

I've just noticed yesterday that Resurrection Remix has just released a new Oreo version for phones that include the Note 4,so it looks like it's still got some life left in this model yet.

No shit ....

[Anonymous Coward]

Is anybody even remotely surprised?

One of the huge problems with Android is it is now so fragmented, and every vendor has filled it with their own custom shit and they've done god knows what to the core of it.

As soon as it's shipped, they move on to the next product. They have neither the time, resources, nor inclination to maintain older versions of phones -- because they want you to buy a new one.

The reality is, there are as many versions of Android as there are phones and companies who make them. And companies aren't going to spend the resources on a shipped product, because they've been paid for it already.

So, yeah, they don't to updates, don't plan to do updates, and refuse to admit that it was abandonware before you even got your hands on it.

To me, this is the greatest failing of Android.

Re:No shit ....

[farble1670]

One of the huge problems with Android is it is now so fragmented, and every vendor has filled it with their own custom shit and they've done god knows what to the core of it.

You get what you pay for.

And one of the huge benefits of Android is that you aren't locked into one manufacturer. This is why you can get Android devices with SD card slots, dual SIMs, dual screens, touch sensitive sides, built in projectors, big screens, small screens, etc. If you don't want any of that, by all means buy Apple.

Heck, you can even by an Android phone that gets the most up to date software and patches. All you have to do is pay for it. It costs about as much as an iPhone... surprised?

Re:No shit ....

[farble1670]

Even Google stopped supporting their Pixel phones, when almost their only selling point was getting proper updates.

Google guarantees 3 years of updates (OS updates, not just patches) on the Pixel 2, and the Pixel 1 is guaranteed 3 years of patches (but I think only 2 years of OS updates):
  https://www.theverge.com/circu...

Carriers...

[yodleboy]

Plenty of the blame goes on carriers. If you have the new hotness, expect fairly regular updates. If not, good luck. Planned obsolescence is a load of crap perpetrated by carriers and manufacturers. I'd actually put more of the blame on carriers now that you pay full price + interest for phones in the US.

Missing info from summary

[Bob the Super Hamste]

Some missing info from the sumamry about the average number of missing patches per device from each manufacturer
Average missing patches per device from each manufacturer
0 or 1 - Google, Samsung, and Sony
1 to 3 - Xiaomi, OnePlus, and Nokia
3 to 4 - HTC, Huawei, LG, and Motorola
4 or more - TCL and ZTE

Re:Missing info from summary

[ctilsie242]

I am surprised that HTC is on the 3-4 list. I've had very good luck with them ensuring that patches come out on time. Even though they are not a "tier 1" maker like Samsung, they produce decent phones that may not have the latest bells and whistles... but they do the job and do it well. They also allow for bootloader unlocking, which is a make or break thing, as a root firewall is a must these days.

Re:Missing info from summary

[tlhIngan]

I am surprised that HTC is on the 3-4 list. I've had very good luck with them ensuring that patches come out on time. Even though they are not a "tier 1" maker like Samsung, they produce decent phones that may not have the latest bells and whistles... but they do the job and do it well. They also allow for bootloader unlocking, which is a make or break thing, as a root firewall is a must these days.

The article is not about patches coming out on time. It's about patches that come out missing.

It's easy to make a security patch that patches nothing other than updating the date you see in the about screen.

That's what the article is about - just because your device is "up to date", doesn't mean it has all the patches. They basically took a patched phone and re-ran the vulnerability tests on them, only to find the patches were not applied despite claims they were by having the patches up to date.

Lying to the public?

[VeryFluffyBunny]

Isn't it a crime for a company to tell such blatant lies to the public? Can't customers sue the companies for endangering their sensitive data? Is the no regulatory oversight for this?

Re:Lying to the public?

[crunchygranola]

And the article has exactly that information in it:

A review of a CFPB database obtained by the AP through a Freedom of Information request shows that the bureau issued an average of two to four enforcement actions a month under former Director Richard Cordray, President Obama’s appointee. But the database shows zero enforcement actions have been taken since Nov. 21, 2017, three days before Cordray resigned.

Yeah, curse the news a bullshit when you didn't bother to even take a single peek at it.

i am not buying any more new hardware

[FudRucker]

until the current crop of devices are bought and used up, or recalled and destroyed, i dont want to buy another PC,. laptop or a phone or tablet until all this heartbleed, or meltdown (the CPU bug) is resolved,

Sounds like fraud.

[Gravis Zero]

IANAL but this sure sounds an awful lot like fraud. They claim to be providing a service but don't actually provide it? The FTC should come down like a load of bricks on these companies.