It's August 2017 and your Android gear can be pwned by, oh look, just patch the things

Android users should be expecting a security update to land for the mobile operating system in short order, as Google has issued fixes for 99 CVE-listed programming cockups. This month's update has been released for the Pixel and Nexus lines and kicked out to other manufacturers and carriers, which will post their own updates …

[Mage]

which will post their own updates in time, hopefully.

I've never got an update for any Android phone or tablet. Ever.

Allegedly the phone had a downloadable "upgrade" but you needed to install a Sony Windows Application, which wouldn't install on XP or Windows 7.

What about simply "Mass Storage" mode (any OS) and then a utility to update on the phone? Works for Kindle eReader (which is really a customised Android, unlike Kobo who use an actual Linux).

[SteveCarr]

Re: which will post their own updates in time, hopefully.

Just had yet another security update for my Galaxy S7 Edge, they roll out regularly. Maybe you run old kit, or don't pick premium kit?

[Anonymous Coward]

Re: which will post their own updates in time, hopefully.

or maybe just not a sucker? How much did that shiny cost you?

I run a S4, CM13 and I install f*ck all on it as I have all I need now and don't use the browser.

Why don't I get official updates? Why didn't I get official updates while they were still being sold?

Apple or Android it's a fools game trying to keep up.

[Timmy B]

Re: which will post their own updates in time, hopefully.

You don't need premium kit that costs a mint to get good regular updates. OnePlus are doing a sterling job with updates for my OP3. Best android phone I've had.

[sabroni]

Re: Best android phone I've had.

Like the least painful kick in the bollocks I've had. Yes it was better than the other bollock kickings but it's not a glowing endorsement....

[Uffish]

Re: which will post their own updates in time, hopefully.

" Maybe you run old kit, or don't pick premium kit?" I run old kit, it still has the specs to do what I want to do and I don't need to impress anyone so it seems a logical choice. My quite old android tablet gets an astonishing number of updates for the aps on it but never a murmur about the ancient version of Android. It does seem a bit odd but if it gets pwned it will get blended (or more likely a mortar and pestle job using a club hammer and a concrete path). But buy a premium tablet, you must be joking.

[jgarbo]

Re: which will post their own updates in time, hopefully.

Same here. Monthly, bi-monthly at most, security & app upgrades to my Note 4. Does expensive kit get "premium" service?

[Lysenko]

...or don't pick premium kit?

My WileyFox (not exactly "Premium") downloaded this patch set this morning and it also addresses another class of security threats that "Premium" units do not: for the same money I can have one real phone and an identical clean copy for dealing with data thieves (like the US immigration service).

[nijam]

Re: which will post their own updates in time, hopefully.

> Just had yet another security update for my Galaxy S7 Edge

Same with my Nokia 3.

[fuzzie]

Re: which will post their own updates in time, hopefully.

I used the PC Companion on Windows 7. It's more recent/modern version, Xperia Companion, I've used on Windows 8.1 (and it claims to support Windows 7). I think you only need the PC app for major updates, e.g. Kit Kat -> Lollipop or Lollipop -> Marshmallow or Marshmallow -> Nougat. Other updates I've all done OTA.

If you still don't have joy, consider XDA's XperiFirm flash tool and/or xpericheck.com

Mass Storage mode has been killed off by Google'd licensing. Sony used to include it, but Google stopped that, insisting on MTP.

[Anonymous Coward]

Re: which will post their own updates in time, hopefully.

What pile of poo is Android built on-top of such that it alone needs twice as many patches this month as every single Microsoft product added together?!

[Charles 9]

Re: which will post their own updates in time, hopefully.

Manufacturer's cruft, without which they would never have sold the phones in the first place, which in turn would've meant Apple would've become the lone player in the smartphone market. IOW, necessary evil.

[Wisteela]

Hmm

But how many are real world threats?

[Anonymous Coward]

Re: Hmm

Awwww don't spoil the party with your sensible square talk of real world, before you killed the party, apple fanboys were getting their monthly boners over regular android patch notes.

[diodesign]

Re: Hmm

Key thing is to patch before they turn into threats. Apps from dodgy marketplaces tend to love priv escl bugs.

C.

[Anonymous Coward]

Re: Hmm

All the remotely exploitable ones are real world threats once the source code fixes are out there so every black hat in the world can weaponize an exploit.

Whether they remain threats only, or become actively exploited problems depends on whether someone has a strategy to profit somehow from exploiting a lot of Android phones, or wants to risk having Interpol come after him for just making a hack to be a bastard. Since the fixes will never arrive on 90% of the Android phones in use at this moment, they have plenty of time to come up with a profit scenario.

Delivery is actually the easiest part of all this. People hack major websites all the time, compromise ad networks, and so forth. No need for complicated scenarios to trick people into downloading apps from a third party store if you can merely embed a "specifically crafted video file" on cnn.com, doubleclick.net, or other location that millions will hit each day.

Sticking your head in the sand and saying that because there hasn't been a mass Android exploit yet it isn't worth worrying about is not a solution. A lot of Microsoft employees and Windows fanboys thought Microsoft had licked the malware problem with Windows XP, which finally abandoned the old DOS based Windows and went to the "secure" NT kernel. When you had Code Red, I.Love.You and others back to back, spreading at internet speed now that everyone was connected, they were forced to rethink that and Microsoft finally had to start taking security seriously. I'm sure Google already realizes this, but the OEMs won't until they have a similar come to Jesus moment.

[Anonymous Coward]

Re: Hmm

You pulled 90% number out of your backside, and you expect us not to just laugh off anything else you say??

[Anonymous Coward]

Re: Hmm

https://duo.com/about/press/releases/duo-security-finds-over-90-percent-of-android-devices-run-outdated-operating-systems

Remember when Windows security wasn't a problem because there weren't any really nasty exploits out there? No? Bloody kids, making the same mistakes we already made 20 years ago.....

[TheVogon]

Re: Hmm

"But how many are real world threats?"

All of them now that they are published....

[OttoOtts]

Shameful!

I bought a Google Nexus 5 in October 2014, but my last security (not even system) update was October 2016. So Google only granted me security updates for two years! That's disgraceful and makes me wonder why Google thinks anyone would want to buy one of their phones. I certainly won't!

[Version 1.0]

Re: Shameful!

Two phone years = 15 dog years.

[Anonymous Coward]

Re: Shameful!

Nexus 5 was released 31 October 2013 with a promise of 3 years updates (2 years OS, 3 years security patches) - not ideal obviously, but better than pretty much every other Android handset manufacturer out there.

[Korev]

Re: Shameful!

Wouldn't it be a better idea to start the clock once the device has stopped being sold?

[Nick Ryan]

Re: Shameful!

Wouldn't it be a better idea to start the clock once the device has stopped being sold?

A very good point, and it would be a lot more honest as well. However thinking about it I can't think of a single supplier of mobile devices (or much else) that states it this way.

[Anonymous Coward]

Re: 2 years OS, 3 years security patches

See, this is why MS are shit and Google are cool. Imagine if Windows versions were supported for that long!

[Anonymous Coward]

Why I love Apple

Timely software updates, even for old devices (I mean the phones not me).

[Anonymous Coward]

Re: Why I love Apple

to be fair 3 years is good compared to everyone else.

How does that effect total cost of ownership though?

[Anonymous Coward]

Re: Why I love Apple

Remove your rose tinted glasses, Updates on old apple devices turn working phones into worthless dog shit.

Pretty much every iOS update the interwebs are full of complaints from owners of anything older than 2 years

[Lord Elpuss]

Re: Why I love Apple

"Remove your rose tinted glasses, Updates on old apple devices turn working phones into worthless dog shit.

Pretty much every iOS update the interwebs are full of complaints from owners of anything older than 2 years"

Wow. That statement's almost Trumpian in its delusion.

[Nick Ryan]

Re: Why I love Apple

It is a bit broad and possibly a bit of a sweeping statement but in essence is true. While Apple's software updates often appear to focus on efficiency (battery life) this efficiency often doesn't appear to translate into faster operating older kit and instead seems to result in older kit running slower than it did before the update.

Whether this is an unfortunate case of coding for newer processors and systems with more resources or is a deliberate deploy to "obsolete" older kit and thereby forcing device churn is the subject of many a conspiracy theory and fanboi/flame war.

[Anonymous Coward]

Re: Why I love Apple

Sorry, the claim that iPhone performance goes to shit in only two years is utter bullshit. I used an iPhone 5 for three years and it was at least as fast the day I sold it to a friend for her daughter to use as the day I got it. And her daughter is still using it (I see them regularly)

Maybe the early products like the 3gs that didn't have enough memory were pushed too far by the updates, but that's no longer true. With iOS 11 the oldest supported phone is the 5S which has 1GB RAM.

[Version 1.0]

Who is writing all this crud?

Every month there are new vulnerabilities discovered and "patched" ... I'm starting to think that all modern code is crap. The higher the language level, the more low level crap slips through ... OK, so I'm old but when I started coding you had to define the inputs and the outputs of each module and code so that anything that was not allowed was dropped like a hot potato.

Sure, we had bugs then, but finding a bug meant explained just how the hell you'd missed it in the first place and checking that nothing else was affected by the same error. Seems like these days you just "patch" it and move on.

[Don Dumb]

Re: Who is writing all this crud?

@Version 1.0 - "so I'm old but when I started coding"

I suspect modern systems are much more complex than anything you were ever working on.

The code might well be crap, but then your code probably wasn't subject to anywhere near as much vulnerability 'attention' as Android is.

[Solarflare]

Re: Who is writing all this crud?

Everything uses frameworks now. Everything chases the latest and greatest system/language. Most of the people who do the work taught themselves to code, so don't necessarily have an idea of how it should be done properly. That's why day in and day out there are breaches, hacks and vulnerabilities galore.

[Planty]

Re: Who is writing all this crud?

The open source nature of android means Google cant hide patch issues behind closed doors like apple can. We will never know how many critical vulrabilities that apple discovered themselves and quietly fix without telling the world....

Google and android does have this luxury, and thus provides clickbait fuel for blogs like this.

[Charlie Clark]

Re: Who is writing all this crud?

Fella, we can all bang on about how much better code was then but did you write operating systems for multimedia phones? Fact is that these devices are very sophisticated but also convenient. That some of the bugs are hardware-specific gives an inkling as to the complexity. Yes, there will be poor code in there but a lot of these bugs are turning up simply because of the improved scrutiny with techniques picking up new

Google's Android strategy isn't without its problems but I'm personally very impressed with the way they handle vulnerabilities and provide regular updates. Apple is always much, much quieter about the security stuff, some of which can be sitting around for months before a fix is pushed.

The real problem is the lack of enforcement of consumer protection legislation. This allows vendors to drop support for devices from which they're no longer making money without any kind of comeback. That it doesn't have to be that way is evinced by distros like LineagesOS (formerly CyanogenMod) and companies like OnePlus and WileyFox getting adopting them instead of trying to manage their own forks. My S5 got its weekly build with the patches.

[Anonymous Coward]

Re: Who is writing all this crud?

Indians.

[Tubz]

Manufacturers should be forced to support equipment for 5 years with quarterly updates of face massive fines, using the EU sliding scale of 4th of global turnover. I bet we all suddenly get updates !

[Charles 9]

Or you'll see no more phones (or support) as manufacturers drop out of the market (and the EU, to avoid the fines by way of sovereign immunity).

[redpawn]

That would be an improvement. It would save boat loads of money in missed fraud.

[Korev]

Which would mean that there are many fewer vulnerable devices in Europe. I suspect that a few hundred million relatively wealthy people would be a too big market to ignore.

[MiguelC]

Re: "manufacturers drop out of the market"

I.e., "don't enforce consumer protection or else companies will pull out of the market".

That's just a typical savage capitalist argument, and it's bullshit. Companies might make their kit more expensive to cover extra costs (if their main competitors did the same), but they wouldn't pull out as it just leaves free space for their competition to move into.

[Charles 9]

Re: "manufacturers drop out of the market"

"That's just a typical savage capitalist argument, and it's bullshit. Companies might make their kit more expensive to cover extra costs (if their main competitors did the same), but they wouldn't pull out as it just leaves free space for their competition to move into."

Not if the cost of compliance bleeds out any chance for profit. Economics 101: if you can't make a profit, pull out of the market. And there is such a phrase as "strangled by red tape".

[sabroni]

Re: there is such a phrase as "strangled by red tape"

Yeah, it's in the Daily Mail every day.

Phrases aside, do you have any examples of this red tape strangling or did you just think it was a nifty turn of phrase?

[Charlie Clark]

If the cost of compliance is too high then you won't get any product.

I'm all for manufacturers doing their bit but I'm also keen on educating consumers enough so they understand the value of suppliers that do provide support beyond the statutory 2 years and perhaps being prepared to pay for it.

[Barry Rueger]

"Hopefully?"

I can count on one hand the number of software upgrades I've seen on a series of phones since Honeycomb.

Google blames the manufacturer, who blames the wireless company, who honestly don't give a sweet God damn.

As irritating as Windows' endless stream of updates might be, and even though they often as not break things, at least I have the option of installing them.

Which is more than I have been able to say about any (non-CM) Android device.

[Pascal Monett]

Damn right

I've had a Galaxy S2 since 2012. I've seen, all told, ONE single OS update in that time.

Oh, I've had plenty of app updates - to the point I had to reset a bunch of the non-uninstallable crap and force them to NOT update because space was getting thin, but I have not seen ANY OS patch of any kind.

Thank God I have no apps installed. I use a phone, not an entertainment platform. For my entertainment, I prefer a desk, a widescreen and a proper keyboard/mouse combo.

[Anonymous Coward]

You know the drill

Send the patches straight to landfill along with the cheap Android mobis.

[Nick Ryan]

Re: You know the drill

Along with the mountain of Windows phones that Microsoft practically had to give away because nobody sane wanted them*. Oh, and all of the older iPhone models, anything prior to a 6, or even a 5, is considered landfill these days.

/right back at you, MS-Fanboi-bot :)

* OK, they weren't bad for the price/specs and were (initially at least) quite stable. Battery life was variable depending on the patch. Unfortunately due to the total absence of applications in the MS app store and a really horrible user interface they bombed (front screen was almost usable, everything else past that was appalling and disjointed - although better than the earlier phones which some replicated all the usability of Win 3 on a mobile device). I'd prefer more competition in the phone market, but MS are not it.

[Anonymous Coward]

Eh?

Android users should be expecting a security update to land for the mobile operating system in short order, as Google has issued fixes for 99 CVE-listed programming cockups.

Some lucky Android might just possibly get a security update to land for the mobile operating system in the next year or so as Google has issued fixes for 99 CVE-listed programming cockups.

There fixed it for you.

Google really does need to kick a lot of companies that make android branded kit get their support act together. Perhaps they could threaten to stop them from using the 'Android' brand in future if they don't.

But Google, it is really not good enough anymore to just lob an update out and say 'hey people, here is and update'. Why not set an example by supporting your own kit for as long as your Fruity Competitor?

[Anonymous Coward]

Re: Eh?

You buy trash, you get trash service. Your choice... However you wanted to buy cheap and get premium, that doesnt work anywhere in life. Your life is no doubt constant disappointment.

Don't think all android devices don't get updates. Sony are pretty good, lagging by about a month, essentially you get both months patches every 2 months. Samsung arent too bad, again, they tend to batch these up and different phones get them in stages. Seems Nokia might be trying to release same day as Google...

http://www.androidpolice.com/2017/08/08/nokia-5-6-start-receiving-august-security-patch-day-nexuspixel-devices/

[jgarbo]

Same here. Monthly, bi-monthly at most, security & app upgrades to my Note 4. Does expensive kit get "premium" service?

[Stephen Wilkinson]

my update is downloading right now. :)

[Anonymous Coward]

Stop the world I want to get off

Is there anybody else out there who looks at the wonderful feature set on some pricey mobile then thinks "crap it has Android" but at the same realises there is bugger-all real choice.

I recently gave out some OnePlus 5's and for today it's great but give it short while and I doubt it will be supported. Cost of a fair laptop, great bugging and tracking device that will leach your personal data if not funds from purchase to disposal yet we seem addicted to them.

I want a simple secure phone that doesn't sell me down the river, just can't buy them nowadays.

[Charlie Clark]

Re: Stop the world I want to get off

I want a simple secure phone that doesn't sell me down the river, just can't buy them nowadays.

I still see the odd feature phone for sale SIM-free for around € 40.

[Charles 9]

Re: Stop the world I want to get off

Won't they just pwn you via the radio chips, which are universal to ALL phones, smart and feature?

[raygdunn]

"you may have fallen out of support"

I'm retired, so watching the pennies (this expression really does need an update to allow for inflation)

I really like my Nexus 10 of about 3.5 years old. Into it's second battery (less charging). Brown glue stains on screen, which neither Google or Samsung are interested in (Designed in obsolescence maybe?)

Last system update: Nov 2015.

Security Patched: 2016-04-01 (interesting date)

So would I be more up-to-date with a hacked system, like CyanogenMod ROM, I wonder. (My guess is that system updates were just enough to disable the required root hacking loopholes)

"Google Pixel C - The freshest Android, all the time". One envisions the fresh smell of roses turning to that of manure... over time.

[Norman Nescio]

Security vulnerabilities might be useful...

I have an Android tablet running Android 5.1 (Lollipop) that is no longer sold, or supported by its manufacturer. The bootloader is locked.

The only prospect of using the hardware I bought in a safer manner is for some enterprising soul to use an elevation of privilege vulnerability to get root and allow downloading a new image produced by open-source enthusiasts. The fact that this is more likely than the manufacturer doing anything speaks volumes. Landfill tablet is apt.

I'm beginning to wonder if sale-of-goods regulations need to start mandating security updates for a reasonable period after sale of a 'smart' device. Perhaps for the same duration as copyright? After all, the copyright term is apparently a reasonable duration for someone to profit from intellectual property, so it makes sense that a system using someone's intellectual property should be supported for at least as long as the copyright term of the IP incorporated into the product. That would be fair, wouldn't it?