Android security better, but still dependent on manufacturers, carriers

Just over 1 in 5 smartphone users are doing everything they can to ensure their phones are safe from online hackers and real-world thieves, survey data shows. But many Android users, no matter how conscientious they are, will still be vulnerable, because their phone manufacturers or telecom carriers aren't making the latest security updates and patches available.

The variegated state of the Android ecosystem has always been a problem for users seeking to ensure their smartphone is patched up to date against the latest publicly disclosed cybersecurity flaws — and new figures show it’s still a huge issue, despite some progress.

Updates produced by Android have to be customized by the handset manufacturer. Samsung alone offers 13 models of Android phone, each one sold by up to 200 different telecom carriers, all of whom customize their operating system to different degrees — meaning they might have to tweak the updates as well, before finally distributing them to phone users. The users, of course, then have to install them.

Figures released by Google’s Android last week suggest that more users are getting regular updates than ever before — but still show only half of the 1.4 billion Android devices in circulation got an update of any kind during 2016.

Updates are crucial because researchers are constantly discovering bugs, flaws and security holes in software packages and operating systems. The Stagefright vulnerability helped highlight security problems for the Android ecosystem in 2015. Since then, Android has been providing security updates every month and for Google’s own Nexus and Pixel phones, they are sent out as soon as they become available. A number of other handset manufacturers, including Samsung and LG “regularly deliver security updates to flagship devices on the same day as Google’s updates to Nexus and Pixel devices,” according to Android’s head of security Adrian Ludwig.

But other manufacturers, especially at the low cost end of the spectrum, often aren’t so quick to push out updates, and users sometimes don’t bother to install them.

“The delivery of software updates to Android devices that aren’t directly controlled by Google is a major issue,”Nathalie Maréchal, senior fellow with Ranking Digital Rights, told Consumer Reports.

Ranking Digital Rights last week published its 2017 Corporate Accountability Index, evaluating 22 of “the world’s most powerful telecommunications, internet, and mobile companies on their public commitments and disclosed policies affecting users’ freedom of expression and privacy.”

Marechal added that the update issue was especially important because it helped underpin inequality in security. “Low-income, minority and other marginalized users are most likely to use cheaper, older devices that no longer get security updates, or only do so with a significant delay,” she said.

Worldwide, almost 15 percent of Android devices are using a version of the OS that is no longer updated at all. Android offers security updates for all versions 4.4 and up — i.e. for phones released in June 2014 and since. That covers more than 86 percent of all devices running the OS, according to Android.

And of the three wireless manufacturers evaluated by Ranking Digital Rights — Apple, Google, and Samsung — only Google provides a guaranteed timeline for continued updates to its device software. In the case of Pixel and Nexus devices, users will get updates and patches for at least three years from when the device first became available, or at least 18 months from when the Google Store last sold the device, whichever is longer.

And, in the Android ecosystem, even those devices for which updates are made regularly available are dependent on the manufacturers to customize the updates and the telecom carriers to make them available over the network.

But of course, even once the update is available, the users still have to install it. Samsung says about 15 percent of its users don’t bother. Survey data collected last year by the Pew Center found that a large majority of American smartphone users, 75 percent, fall into a middle range when it comes to mobile security. “This group includes smartphone owners who … users, only update their phone’s apps and operating system when it’s convenient for them to do so,” Pew states.

Google and Amnesty International teamed up to make it harder for spyware vendors to hide

Intrusion Logging marks the first feature from a major device vendor to aid with forensic detection of sophisticated threats, Amnesty International said.

Google addresses actively exploited Qualcomm zero-day in fresh batch of 129 Android vulnerabilities

Google addresses 107 Android vulnerabilities, including two zero-days

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Technology

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

• The Collective Cyber Defense letter wrote your next vendor questionnaire

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Russian national extradited to US for alleged involvement in bank-account takeover scheme

• Attackers exploit zero-days in consistently besieged SonicWall product

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure