20 ms·

I guess this means we can officially stop hating on Microsoft for having such a lax attitude towards security, considering their last OS to suffer from that att

by _wmd 10y ago

I guess this means we can officially stop hating on Microsoft for having such a lax attitude towards security, considering their last OS to suffer from that attitude was released 16 years ago, and it accounts for less than 3% of present day traffic according to statcounter.com Meanwhile according to the same stats, Android sits around 37.9%, and I have to wonder just how many of those devices are still impacted by for example the 2015 libstagefright vulnerability. Given Google's guiltless ongoing "throw code over the wall" approach to security and passing the buck on to vendors who almost never ship firmware updates for old handsets, perhaps now is the time for us to begin holding Google to the same standard we applied to Microsoft a decade ago. Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Microsoft. You've got an even bigger and more complicated mess to clean up, you dug the hole yourself, it's going to take you longer, and you should have started on it years ago edit: If it weren't clear, the tragedy here is that instead of most devices being governed by a well-tested security process owned by a single responsible vendor, they're at the mercy of a plethora of downstream vendors who do nothing, with the ultimate upstream washing its hands and paying little more than immature lip service to the issue, never mind having anything that even remotely resembles a solid process.

problems 10y ago
> perhaps now is the time for us to begin holding Google to the same standard we applied to Microsoft a decade ago. The triggering factor for this was the worms though. No such similar thing exists in the Android space.
- _wmd 10y ago
  Stagefright is trivially weaponizable as an MMS worm, in fact it may already have happened
  - najati83 10y ago
    Sending an MMS is very expensive and many people don't even bother to configure their mobiles to send them because they've never used them.
    - j_s 10y ago
      Interesting perspective. Where is this coming from, geographically? It doesn't match my experience here in North America.
      - najati83 10y ago
        Spain.
        ferongr 10y ago
        If your GSM network is anything like Greece's (and I don't doubt it is, grey market devices from Spain sold here work without issue), Android automatically sets up the network settings for MMS and wireless networking. You don't have to do anything.
      - deleted 10y ago
        [deleted]
      - apexalpha 10y ago
        Yeah I recently learned from a Candadian friend that people in the US and Canada still text a lot? Outside of the US & Canada my estimate would be that 99% of people has switched to WeChat, Whatsapp and FB Messenger. The only texts I ever recieve nowadays are automated (2FA etc...). Even though unlimited texts come with every SIM.
        72deluxe 10y ago
        I am a rarity here in the U.K. as I still text, having got fed up of constantly switching IM apps. I mean, I remember when MSN Messenger was all the rage. Then Yahoo, ICQ, GTalk, Hangouts, various Jabber protocols, FaceAche, errr I mean FaceTime and Messenger, WhatsApp etc etc ad nauseum, Skype SMS has remained the great constant throughout all these games. Turns out people don't get in touch if you don't use WhatsApp but shows how much they care eh!
  - problems 10y ago
    So... where is it? There clearly hasn't been any major deployment of this - especially at the scale of Blaster or Conficker. It's "trivial" perhaps for a single device but every device is different and it'd require its own exploit code, exploit mitigation features cause it to be difficult to actually exploit too - making it quite problematic to deploy in practice.
    - _wmd 10y ago
      Are we really so moronic that we need to wait for something to explode before we're ready to acknowledge the fire hazard that caused the explosion in the first place?
      - problems 10y ago
        If it were so trivial it probably would have already happened. There's tons of cash to be made in SMS and MMS spam. It's not trivial - there's a lot of devices and exploiting mitigation techniques to deal with, there's not even a reliable PoC that works on real-world devices with ASLR enabled. These exploit mitigation techniques and differences in builds have basically saved it from becoming the disaster it sounds like at first glance. I guess to answer your question, yes, yes we are that moronic. Not many people will care unless it's proven rapidly and readily exploitable.
      - bitmapbrother 10y ago
        You just stated that Stagefright was "trivially weaponizable". So why don't you answer their question and provide proof? Surely a "trivially weaponizable" exploit on over 1.4 billion devices would be a very attractive target to nefarious organizations and hackers. It's been about 2 years since Stagefright was disclosed. Are we still waiting for it to explode? And if so, can you give a timeline for when this explosion will occur?
  - bitmapbrother 10y ago
    >Stagefright is trivially weaponizable as an MMS worm, in fact it may already have happened No it's not. Where are all of the Stagefright exploits? This was supposed to be Android's security armageddon according to the scaremongering bloggers. And yet nothing happened. According to Google's telemetry of over 1.4 billion phones there has not been 1 case of a Stagefright exploit in the wild. So your assumption that Stagefright is "trivially weaponizable" is inconsistent with your knowledge of Android security and mitigations.
JoshTriplett 10y ago
The difference being that you can install or upgrade Windows on a system without buying a new laptop or requiring support from the vendor; the vendor doesn't lock down laptops to prevent upgrades and force people to buy a new device instead.
- _wmd 10y ago
  Is that our problem or Google's? You can point fingers at 50 different companies in the ecosystem, or you can collectively point the finger at the root cause. By the topic of this article, they're no longer the underdog when it comes to dictating terms to device vendors, they're the biggest shop in town and there's no reason the vulns-frozen-for-life-of-device model should continue to be adhered to.
  - pjmlp 10y ago
    If they cared one second about it, they would have changed the terms of access to the Google services. The sad part is that the 2016 security report just came out and they brag how the whole security improved, without mentioning the elephant in the room. Google IO is around the corner and I bet they will keep talking as if everyone could upgrade right away to Android O, with N now having barely 2%.
    - dublinben 10y ago
      Everyone (who buys Google phones) can upgrade right away. It's not Google's fault that the other manufacturers refuse to update their products in a timely manner. The responsibility for these devices lies solely with the manufacturer.
      - enzanki_ars 10y ago
        It kind of is Google's fault. Most people associate any version of Android with Google. Manufactures that don't update their phones causes harm to both the manufacture's image and Google image. Personally, I place all the blame on Google for not making the upgrades possible from their side. It should be easy to upgrade the core operating system as easy as updating Windows, OSX, and Linux.
Someone1234 10y ago
The sad part is that these are issues with Android that Linux already solved. Google uses Linux within Android but instead of allowing the underlying parts to be updated via package management-like functionality, the kernel level stuff is only distributable as images in one "big bang" go. You could have a bug in a single binary at the kernel level, but instead of a tiny 1Kb diff patch you wait a year for a giant 1.2 GB vendor update that also contains a lot of other changes you have no interest in.
- barrkel 10y ago
  Well, if you have control over which patches you accept, you've created an exponential explosion in the testing state space. That may be even worse for security, never mind reliability.
  - marcosdumay 10y ago
    Still, somehow Linux distros are reasonably safe but Android is broken.
    - pwnna 10y ago
      Not sure about the linux distro being safe part. Linux desktop distros are also riddled with vulnerabilities that no one bothered to look. This is along with the bad design of the desktop in the first place as there're no isolation between apps and so forth. Example: https://arstechnica.com/security/2016/12/fedora-and-ubuntu-0days-show-that-hacking-desktop-linux-is-now-a-thing/ https://arstechnica.com/security/2016/12/fedora-and-ubuntu-0... Android on the other hand, has isolation mechanism built in as the central thesis of its apps system. Additionally, it also has some additional layers on top. Unfortunately since nothing gets updated it maybe all moot, but I don't think somehow Linux distros are more secure.
      - temac 10y ago
        Well, GNU/Linux distro are usually patched. Main ones for pretty much all known vulns. Tons of Android systems are not patched. I don't think any of those is secure against anybody motivated enough (and I'm not even thinking about a 3-letter agency, but any hacker competent enough!) Arguably the security model of main desktop OSes is bad enough so that they are also easy to penetrate. That should not make us dismiss the problem of the way too many unmaintained Android systems!
lawnchair_larry 10y ago
Google doesn't have 1 security team. Project Zero has nothing to do with Android whatsoever. Totally different parts of the business.
- _wmd 10y ago
  Then I wonder what team the CSO heads up
- pjmlp 10y ago
  But they surely have an Android Security one, which tends to ignore the issue with updates on their reports. https://android-developers.googleblog.com/2017/03/android-security-2016-year-in-review.html https://android-developers.googleblog.com/2017/03/android-se... Apparently now all OEMs are playing nice with updates and everyone that bought a phone in 2016 got their updates.
  - lawnchair_larry 10y ago
    Sure, perhaps you could make a case for calling out the Android security team. GP didn't do that though, he called out Project Zero for not leaving Microsoft alone and instead fixing Android. I'm just saying, that isn't how things work.
cmurf 10y ago
The gist is that Google wanted to grow Android into something other than a niche player, and made a deal with the devils: hardware vendors. In effect, hardware vendors said they wanted to take a dump on their customers just like they always have, with bloatware baked in and planned obsolescence and Google said OK. And they don't control the hardware. On the manufacturing side, a huge team is assembled with piles of money and resources to design and build a complete product out of hardware, firmware (blobs), and software, test it, document it, and then hand it off to marketing. That entire team is disbanded into a pool from which a whole new team will be created for a whole new product. Maybe less than a dozen people remain on a product team following release, and that's just to cover major bugs found once it's in the field. After about 6 months, it might be a team of two people. If it's a small market product, it might be a team of handful that cover multiple similar products. Anyway, after 18-24 months there's essentially no one around from the manufacturer to support the product. It's not at all the same business model as say, Apple, where it's a giant team supporting a dozen handsets post-release, with coordinated roll outs for bug fixes. If you want a newer OS on the Android phone, it's a do it yourself proposition. Lineage OS. Hopefully your phone has a relatively easy to unlock bootloader. And while Lineage OS will have a much newer kernel than the stock OS, the code to support, e.g. the NFC, may not be upstream because it's got some patent encumbered code, or maybe something new in the kernel breaks some driver and no one is around who knows enough about it to get it fixed. The exact sequence to put components into low power state, if not correct can cause battery life to suck. There are all sorts of ways this can not work out well, but at least it's an option. What Google has done since Android 5 is emphasize library stability and security through Google Play updates. New features and bug fixes happen via Google Play itself being updated; it appears to be just an app update but it's actually what the bulk of 3rd party apps use. The low level stuff including the kernel isn't user space, and while your handset gets stuck for life, in effect, with an old kernel, Google are pushing out a chunk of bug and security fixes this way.
- floatboth 10y ago
  > the code to support, e.g. the NFC On Google devices starting with the Nexus 5X/6P, there's a separate /vendor partition for blobs, and Google publishes monthly updates for that. I'm not sure if other vendors do this…
plandis 10y ago
You sound like someone that either works at Microsoft or has a large financial interest in them.
- fulafel 10y ago
  I think he sounds like every person with security awareness who ever looked at the Android situation in the field.
narrator 10y ago
Just to play devil's advocate: Windows became the dominant platform when it had terrible security. Android became the dominant platform when it had terrible security. Maybe people don't care that much about security vs other features. At it's low point, Windows security was a lot worse than Android security. At one point, a fresh Windows XP machine plugged into the Internet would be compromised within a couple of minutes max.
- Shank 10y ago
  I don't really understand this metric at all. I've heard it colloquially, but I highly doubt anyone was scanning IP address ranges so often that you could be passively attacked on the internet without any interaction by two minutes in. Even more so, people are often behind NAT, which acts as a good firewall on its own. Maybe it's related to browsing habits? IE? I mean, you aren't going to get hit by a drive-by attack on any major websites -- even in the heyday of malicious advertisements. So, what I'm really asking is: where did this metric come from, and why does it get spread so often?
  - 0xCMP 10y ago
    It may sound crazy, but I've heard of honey pots getting attacked in minutes many times. Two minutes is probably too short, but an hour? Maybe not.
  - Retric 10y ago
    Dial up and early high speed internet both gave you a public IP address. The expectation you will have multiple internet devices is more recent behind a nat is more recent. And yes I dealt with an XP box that would get compromised before you could download the update. Windows even included a utility to let people use it as a router on home networks to "share internet connections". https://support.microsoft.com/en-us/help/310563/description-of-internet-connection-sharing-in-windows-xp https://support.microsoft.com/en-us/help/310563/description-...
    - tyfon 10y ago
      They still give you public IPs no? I get that at least on my fiber connection. It's even permanent.
bubblethink 10y ago
Android's fragmentation and shitty vendor blobs are nothing new. What's more disappointing is that Google, despite all its might, didn't do anything significantly different for its own phones. The cost of owning a google phone used to be ~$100 a year given the price of Nexus used to be around the ~$300 mark and a 3 year support cycle. With Pixel, that cost has become more than 2x for the same support cycle. If google with its current stake can't strong arm Qualcomm and other h/w vendors, I doubt if it'll ever happen. Microkernels may make it better, but that's just shifting the perception. What's really needed is more competition in the h/w space.
- temac 10y ago
  I don't see how microkernels have anything to do with all of that? Userspace drivers exists in all systems and arguably they are not more backward compatible or anything than kernel-space drivers, just the incompatibilities appears against other system-frameworks in other address spaces, instead of the (micro)-kernel. Ex: when windows switched to 64-bits, 32-bits userspace printer drivers where incompatible (it could and IMO it should have been done otherwise, but what happen is that they were broken!) And more competition in the h/w space? Common, you already have an insane amount of competition for Android phones, and even some of the biggest multinational don't give a shit about maintaining SW for their product beyond a few months, even for security purposes. The only think we can do is prescription to every people we know: ex. tell all your non technical friends to never buy e.g. a Samsung phone. It's ridiculous, because Android is the worse ecosystem for security purposes. If you want to be somehow protected, you can stick to iPhones, or, in a funny way, Windows 10 Mobile.
  - bubblethink 10y ago
    >And more competition in the h/w space? Common, you already have an insane amount of competition for Android phones That competition is only on the surface. For SoC, GPU, baseband, radios etc., you are stuck with Qualcomm. Or maybe Samsung's exynos, which isn't necessarily better.
    - temac 10y ago
kyrra 10y ago
Not sure you consider this equivalent, but the Project Zero team has opened a number of issues against Android and phones that run android[0]. I'm wondering what blog posts on the Project Zero blog you consider to be "cheap muck"? There are a lot of posts on the Project Zero blog about Android as well. [0] https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=android https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...
chickenbane 10y ago
> you should have started on it years ago As somebody who has been following Android for a while, this statement is incredibly unfair. The Android ecosystem is huge and remarkably safe. For those actually interested in the details, the Android security team releases annual security reviews, and the report for 2016 was just released: https://security.googleblog.com/2017/03/diverse-protections-for-diverse.html https://security.googleblog.com/2017/03/diverse-protections-... The tldr: the number of devices with a harmful app is 0.05%, and for 1.5B devices extremely impressive. Basically, if you only install apps from Google Play and never enable unknown sources (the default and the vast majority of users) you are safe. While the argument that most devices aren't running the latest security patch is certainly valid, it's important to note that there are many services running on device and in the cloud provided by Google which are doing most of the heavy lifting. If anything, the example of Stagefright actually shows the safety of Android - many many devices have never received any security patch to address Stagefright and yet most users aren't affected.
- oefrha 10y ago
  Citing Google's blog post for Android security is not very convincing. If Android is so secure, why are we seeing (often more frequently than) weekly headlines on Android security woes, often containing something like "millions of devices affected" (and often enough, no fix in sight)? Also, quote from linked blog post: > only 0.05 percent of devices that downloaded apps exclusively from Play contained a PHA. 1. What percentage of Android devices download apps exclusively from Play? They don't say. I, for one, have quite a few not so technical friends who sideload stuff. Also, pretty much all Android devices in Mainland China don't qualify for this criterion, and that's a huge number. 2. Given the track record of malware in Play Store, the number of devices containing a PHA is probably much larger than that of ones containing a known PHA. > many many devices have never received any security patch to address Stagefright and yet most users aren't affected. Not sure how you even know that. Not all exploits are visible.
  - pillowkusis 10y ago
    >weekly headlines on Android security woes stagefright is the last major Android vulnerability I'm aware of. Do you have sources for these? In my experience it's far less than weekly. Maybe yearly at most.
mrb 10y ago
"Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Microsoft. You've got an even bigger and more complicated mess to clean up, you dug the hole yourself, it's going to take you longer, and you should have started on it years ago" Is Linus Torvalds criticized as strongly as this, when many of the hundreds of Linux distro maintainers fail to ship kernel security patches speedily? No? Google puts a lot of effort into securing Android and patching vulns quickly, but ultimately it is the fault of the MANUFACTURERS and OPERATORS for failing to update their commercial works derived from Android OS.
bitmapbrother 10y ago
>Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Microsoft. Yes, because it's better to let hackers continue to exploit Windows than inform users and MS that their OS is at risk. >You've got an even bigger and more complicated mess to clean up, you dug the hole yourself, it's going to take you longer, and you should have started on it years ago. Security patches are given to OEM's 1 month before they are publicly released. Google patches their devices promptly. Unless I'm mistaken, I'm not aware of technology that allows Google to take an OEM's source code, apply patches, build it, sign it and then release it to all of the OEM's customers.
throwaway91111 10y ago
Is that really google's problem, though? Why do you think they have a responsibility to ensure their OEM clients update regularly? It doesn't reflect poorly on them; it reflects poorly on samsung, sony, etc etc, who fill their phones with crap ware and are slow with patches and upgrades.
partycoder 10y ago
Let's see... Taking over a machine thanks to autorun.inf, crashing machines with ping, unsecured shared folders, worms spreading everywhere, rendering fonts on kernel code, and a long list of other stupid defects... No. Android has never included this level of idiocy therefore it is not fair to hold it to the same standard. Installing Windows was once the same as installing a rootkit in your computer. Android might have issues but never as bad as Windows. Windows holds all the incompetency records. Then, "the operating system released 16 years ago" (Windows XP) is the 3rd most used operating system. It is still causing problems today.
bitJericho 10y ago
And here I am on the Nokia 930 windows phone running Windows 10, and still expecting more updates :)
ebbv 10y ago
> I guess this means we can officially stop hating on Microsoft for having such a lax attitude towards security, considering their last OS to suffer from that attitude was released 16 years ago What? That is complete nonsense. Yes Windows security has improved over time but it's still pretty abysmal compared to macOS, iOS, Android and any mainstream Linux distro. Windows still defaults to your main user being an administrator with administrator privileges at all times. Not to mention the fact that Windows now comes baked in with malware and not only defaults you into turning it on without giving you the option to turn it all off easily during setup, but the major patches that have come out since will re-enable a lot of Microsoft's tracking code and make you jump through hoops to disable it.
sametmax 10y ago
Except mobile OS never suffered even 10% of the problems Windows had. You don't have 1000 toolbar crippling your mama's android browser. I never had to reformat my mobile to "make a clean" install, and certainly not every 6 month like I used to do with windows. We never had any large scale infection on Android like confiker. Reports of anything bad, virus, worms, rootkits... happening on Android are incredibly rare and never happened with my relatives. Clearly we can't hold Google to the same standard as MS, because they are not even on the same level.
belorn 10y ago
If we are comparing 2017 android with 2001 Windows we also need to compare the exploits. During times of 2001 windows we saw things like worms that permanent destroyed hardware (or forced owners to replace them), worms that shutdown whole city networks, computers that got infected in less than a second when connecting to the Internet, and botnets that were bigger than the biggest super computers of the time. The harm were big and scary on a global scale, and specific malware were often calculated to cause billions in damages. On the "lower" end there were bank account hijackings and credit card theft. What are the worst 2017 android malware doing to the world?

by _wmd 10y ago

problems 10y ago

> perhaps now is the time for us to begin holding Google to the same standard we applied to Microsoft a decade ago. The triggering factor for this was the worms though. No such similar thing exists in the Android space.

_wmd 10y ago
Stagefright is trivially weaponizable as an MMS worm, in fact it may already have happened
- najati83 10y ago
  Sending an MMS is very expensive and many people don't even bother to configure their mobiles to send them because they've never used them.
  - j_s 10y ago
    Interesting perspective. Where is this coming from, geographically? It doesn't match my experience here in North America.
    - najati83 10y ago
      Spain.
      - ferongr 10y ago
        If your GSM network is anything like Greece's (and I don't doubt it is, grey market devices from Spain sold here work without issue), Android automatically sets up the network settings for MMS and wireless networking. You don't have to do anything.
    - deleted 10y ago
      [deleted]
    - apexalpha 10y ago
      Yeah I recently learned from a Candadian friend that people in the US and Canada still text a lot? Outside of the US & Canada my estimate would be that 99% of people has switched to WeChat, Whatsapp and FB Messenger. The only texts I ever recieve nowadays are automated (2FA etc...). Even though unlimited texts come with every SIM.
      - 72deluxe 10y ago
        I am a rarity here in the U.K. as I still text, having got fed up of constantly switching IM apps. I mean, I remember when MSN Messenger was all the rage. Then Yahoo, ICQ, GTalk, Hangouts, various Jabber protocols, FaceAche, errr I mean FaceTime and Messenger, WhatsApp etc etc ad nauseum, Skype SMS has remained the great constant throughout all these games. Turns out people don't get in touch if you don't use WhatsApp but shows how much they care eh!
- problems 10y ago
  So... where is it? There clearly hasn't been any major deployment of this - especially at the scale of Blaster or Conficker. It's "trivial" perhaps for a single device but every device is different and it'd require its own exploit code, exploit mitigation features cause it to be difficult to actually exploit too - making it quite problematic to deploy in practice.
  - _wmd 10y ago
    Are we really so moronic that we need to wait for something to explode before we're ready to acknowledge the fire hazard that caused the explosion in the first place?
    - problems 10y ago
      If it were so trivial it probably would have already happened. There's tons of cash to be made in SMS and MMS spam. It's not trivial - there's a lot of devices and exploiting mitigation techniques to deal with, there's not even a reliable PoC that works on real-world devices with ASLR enabled. These exploit mitigation techniques and differences in builds have basically saved it from becoming the disaster it sounds like at first glance. I guess to answer your question, yes, yes we are that moronic. Not many people will care unless it's proven rapidly and readily exploitable.
    - bitmapbrother 10y ago
      You just stated that Stagefright was "trivially weaponizable". So why don't you answer their question and provide proof? Surely a "trivially weaponizable" exploit on over 1.4 billion devices would be a very attractive target to nefarious organizations and hackers. It's been about 2 years since Stagefright was disclosed. Are we still waiting for it to explode? And if so, can you give a timeline for when this explosion will occur?
- bitmapbrother 10y ago
  >Stagefright is trivially weaponizable as an MMS worm, in fact it may already have happened No it's not. Where are all of the Stagefright exploits? This was supposed to be Android's security armageddon according to the scaremongering bloggers. And yet nothing happened. According to Google's telemetry of over 1.4 billion phones there has not been 1 case of a Stagefright exploit in the wild. So your assumption that Stagefright is "trivially weaponizable" is inconsistent with your knowledge of Android security and mitigations.

JoshTriplett 10y ago

The difference being that you can install or upgrade Windows on a system without buying a new laptop or requiring support from the vendor; the vendor doesn't lock down laptops to prevent upgrades and force people to buy a new device instead.

_wmd 10y ago
Is that our problem or Google's? You can point fingers at 50 different companies in the ecosystem, or you can collectively point the finger at the root cause. By the topic of this article, they're no longer the underdog when it comes to dictating terms to device vendors, they're the biggest shop in town and there's no reason the vulns-frozen-for-life-of-device model should continue to be adhered to.
- pjmlp 10y ago
  If they cared one second about it, they would have changed the terms of access to the Google services. The sad part is that the 2016 security report just came out and they brag how the whole security improved, without mentioning the elephant in the room. Google IO is around the corner and I bet they will keep talking as if everyone could upgrade right away to Android O, with N now having barely 2%.
  - dublinben 10y ago
    Everyone (who buys Google phones) can upgrade right away. It's not Google's fault that the other manufacturers refuse to update their products in a timely manner. The responsibility for these devices lies solely with the manufacturer.
    - enzanki_ars 10y ago
      It kind of is Google's fault. Most people associate any version of Android with Google. Manufactures that don't update their phones causes harm to both the manufacture's image and Google image. Personally, I place all the blame on Google for not making the upgrades possible from their side. It should be easy to upgrade the core operating system as easy as updating Windows, OSX, and Linux.

Someone1234 10y ago

The sad part is that these are issues with Android that Linux already solved. Google uses Linux within Android but instead of allowing the underlying parts to be updated via package management-like functionality, the kernel level stuff is only distributable as images in one "big bang" go. You could have a bug in a single binary at the kernel level, but instead of a tiny 1Kb diff patch you wait a year for a giant 1.2 GB vendor update that also contains a lot of other changes you have no interest in.

barrkel 10y ago
Well, if you have control over which patches you accept, you've created an exponential explosion in the testing state space. That may be even worse for security, never mind reliability.
- marcosdumay 10y ago
  Still, somehow Linux distros are reasonably safe but Android is broken.
  - pwnna 10y ago
    Not sure about the linux distro being safe part. Linux desktop distros are also riddled with vulnerabilities that no one bothered to look. This is along with the bad design of the desktop in the first place as there're no isolation between apps and so forth. Example: https://arstechnica.com/security/2016/12/fedora-and-ubuntu-0days-show-that-hacking-desktop-linux-is-now-a-thing/ https://arstechnica.com/security/2016/12/fedora-and-ubuntu-0... Android on the other hand, has isolation mechanism built in as the central thesis of its apps system. Additionally, it also has some additional layers on top. Unfortunately since nothing gets updated it maybe all moot, but I don't think somehow Linux distros are more secure.
    - temac 10y ago
      Well, GNU/Linux distro are usually patched. Main ones for pretty much all known vulns. Tons of Android systems are not patched. I don't think any of those is secure against anybody motivated enough (and I'm not even thinking about a 3-letter agency, but any hacker competent enough!) Arguably the security model of main desktop OSes is bad enough so that they are also easy to penetrate. That should not make us dismiss the problem of the way too many unmaintained Android systems!

lawnchair_larry 10y ago

Google doesn't have 1 security team. Project Zero has nothing to do with Android whatsoever. Totally different parts of the business.

_wmd 10y ago
Then I wonder what team the CSO heads up
pjmlp 10y ago
But they surely have an Android Security one, which tends to ignore the issue with updates on their reports. https://android-developers.googleblog.com/2017/03/android-security-2016-year-in-review.html https://android-developers.googleblog.com/2017/03/android-se... Apparently now all OEMs are playing nice with updates and everyone that bought a phone in 2016 got their updates.
- lawnchair_larry 10y ago
  Sure, perhaps you could make a case for calling out the Android security team. GP didn't do that though, he called out Project Zero for not leaving Microsoft alone and instead fixing Android. I'm just saying, that isn't how things work.

cmurf 10y ago

The gist is that Google wanted to grow Android into something other than a niche player, and made a deal with the devils: hardware vendors. In effect, hardware vendors said they wanted to take a dump on their customers just like they always have, with bloatware baked in and planned obsolescence and Google said OK. And they don't control the hardware. On the manufacturing side, a huge team is assembled with piles of money and resources to design and build a complete product out of hardware, firmware (blobs), and software, test it, document it, and then hand it off to marketing. That entire team is disbanded into a pool from which a whole new team will be created for a whole new product. Maybe less than a dozen people remain on a product team following release, and that's just to cover major bugs found once it's in the field. After about 6 months, it might be a team of two people. If it's a small market product, it might be a team of handful that cover multiple similar products. Anyway, after 18-24 months there's essentially no one around from the manufacturer to support the product. It's not at all the same business model as say, Apple, where it's a giant team supporting a dozen handsets post-release, with coordinated roll outs for bug fixes. If you want a newer OS on the Android phone, it's a do it yourself proposition. Lineage OS. Hopefully your phone has a relatively easy to unlock bootloader. And while Lineage OS will have a much newer kernel than the stock OS, the code to support, e.g. the NFC, may not be upstream because it's got some patent encumbered code, or maybe something new in the kernel breaks some driver and no one is around who knows enough about it to get it fixed. The exact sequence to put components into low power state, if not correct can cause battery life to suck. There are all sorts of ways this can not work out well, but at least it's an option. What Google has done since Android 5 is emphasize library stability and security through Google Play updates. New features and bug fixes happen via Google Play itself being updated; it appears to be just an app update but it's actually what the bulk of 3rd party apps use. The low level stuff including the kernel isn't user space, and while your handset gets stuck for life, in effect, with an old kernel, Google are pushing out a chunk of bug and security fixes this way.

floatboth 10y ago
> the code to support, e.g. the NFC On Google devices starting with the Nexus 5X/6P, there's a separate /vendor partition for blobs, and Google publishes monthly updates for that. I'm not sure if other vendors do this…

plandis 10y ago

You sound like someone that either works at Microsoft or has a large financial interest in them.

fulafel 10y ago
I think he sounds like every person with security awareness who ever looked at the Android situation in the field.

narrator 10y ago

Just to play devil's advocate: Windows became the dominant platform when it had terrible security. Android became the dominant platform when it had terrible security. Maybe people don't care that much about security vs other features. At it's low point, Windows security was a lot worse than Android security. At one point, a fresh Windows XP machine plugged into the Internet would be compromised within a couple of minutes max.

Shank 10y ago
I don't really understand this metric at all. I've heard it colloquially, but I highly doubt anyone was scanning IP address ranges so often that you could be passively attacked on the internet without any interaction by two minutes in. Even more so, people are often behind NAT, which acts as a good firewall on its own. Maybe it's related to browsing habits? IE? I mean, you aren't going to get hit by a drive-by attack on any major websites -- even in the heyday of malicious advertisements. So, what I'm really asking is: where did this metric come from, and why does it get spread so often?
- 0xCMP 10y ago
  It may sound crazy, but I've heard of honey pots getting attacked in minutes many times. Two minutes is probably too short, but an hour? Maybe not.
- Retric 10y ago
  Dial up and early high speed internet both gave you a public IP address. The expectation you will have multiple internet devices is more recent behind a nat is more recent. And yes I dealt with an XP box that would get compromised before you could download the update. Windows even included a utility to let people use it as a router on home networks to "share internet connections". https://support.microsoft.com/en-us/help/310563/description-of-internet-connection-sharing-in-windows-xp https://support.microsoft.com/en-us/help/310563/description-...
  - tyfon 10y ago
    They still give you public IPs no? I get that at least on my fiber connection. It's even permanent.

bubblethink 10y ago

Android's fragmentation and shitty vendor blobs are nothing new. What's more disappointing is that Google, despite all its might, didn't do anything significantly different for its own phones. The cost of owning a google phone used to be ~$100 a year given the price of Nexus used to be around the ~$300 mark and a 3 year support cycle. With Pixel, that cost has become more than 2x for the same support cycle. If google with its current stake can't strong arm Qualcomm and other h/w vendors, I doubt if it'll ever happen. Microkernels may make it better, but that's just shifting the perception. What's really needed is more competition in the h/w space.

temac 10y ago
I don't see how microkernels have anything to do with all of that? Userspace drivers exists in all systems and arguably they are not more backward compatible or anything than kernel-space drivers, just the incompatibilities appears against other system-frameworks in other address spaces, instead of the (micro)-kernel. Ex: when windows switched to 64-bits, 32-bits userspace printer drivers where incompatible (it could and IMO it should have been done otherwise, but what happen is that they were broken!) And more competition in the h/w space? Common, you already have an insane amount of competition for Android phones, and even some of the biggest multinational don't give a shit about maintaining SW for their product beyond a few months, even for security purposes. The only think we can do is prescription to every people we know: ex. tell all your non technical friends to never buy e.g. a Samsung phone. It's ridiculous, because Android is the worse ecosystem for security purposes. If you want to be somehow protected, you can stick to iPhones, or, in a funny way, Windows 10 Mobile.
- bubblethink 10y ago
  >And more competition in the h/w space? Common, you already have an insane amount of competition for Android phones That competition is only on the surface. For SoC, GPU, baseband, radios etc., you are stuck with Qualcomm. Or maybe Samsung's exynos, which isn't necessarily better.
  - temac 10y ago

kyrra 10y ago

Not sure you consider this equivalent, but the Project Zero team has opened a number of issues against Android and phones that run android[0]. I'm wondering what blog posts on the Project Zero blog you consider to be "cheap muck"? There are a lot of posts on the Project Zero blog about Android as well. [0] https://bugs.chromium.org/p/project-zero/issues/list?can=1&q=android https://bugs.chromium.org/p/project-zero/issues/list?can=1&q...

chickenbane 10y ago

> you should have started on it years ago As somebody who has been following Android for a while, this statement is incredibly unfair. The Android ecosystem is huge and remarkably safe. For those actually interested in the details, the Android security team releases annual security reviews, and the report for 2016 was just released: https://security.googleblog.com/2017/03/diverse-protections-for-diverse.html https://security.googleblog.com/2017/03/diverse-protections-... The tldr: the number of devices with a harmful app is 0.05%, and for 1.5B devices extremely impressive. Basically, if you only install apps from Google Play and never enable unknown sources (the default and the vast majority of users) you are safe. While the argument that most devices aren't running the latest security patch is certainly valid, it's important to note that there are many services running on device and in the cloud provided by Google which are doing most of the heavy lifting. If anything, the example of Stagefright actually shows the safety of Android - many many devices have never received any security patch to address Stagefright and yet most users aren't affected.

oefrha 10y ago
Citing Google's blog post for Android security is not very convincing. If Android is so secure, why are we seeing (often more frequently than) weekly headlines on Android security woes, often containing something like "millions of devices affected" (and often enough, no fix in sight)? Also, quote from linked blog post: > only 0.05 percent of devices that downloaded apps exclusively from Play contained a PHA. 1. What percentage of Android devices download apps exclusively from Play? They don't say. I, for one, have quite a few not so technical friends who sideload stuff. Also, pretty much all Android devices in Mainland China don't qualify for this criterion, and that's a huge number. 2. Given the track record of malware in Play Store, the number of devices containing a PHA is probably much larger than that of ones containing a known PHA. > many many devices have never received any security patch to address Stagefright and yet most users aren't affected. Not sure how you even know that. Not all exploits are visible.
- pillowkusis 10y ago
  >weekly headlines on Android security woes stagefright is the last major Android vulnerability I'm aware of. Do you have sources for these? In my experience it's far less than weekly. Maybe yearly at most.

mrb 10y ago

"Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Microsoft. You've got an even bigger and more complicated mess to clean up, you dug the hole yourself, it's going to take you longer, and you should have started on it years ago" Is Linus Torvalds criticized as strongly as this, when many of the hundreds of Linux distro maintainers fail to ship kernel security patches speedily? No? Google puts a lot of effort into securing Android and patching vulns quickly, but ultimately it is the fault of the MANUFACTURERS and OPERATORS for failing to update their commercial works derived from Android OS.

bitmapbrother 10y ago

>Google Security Team, here's your call to stop pontificating on the Project Zero blog and throwing cheap muck at Microsoft. Yes, because it's better to let hackers continue to exploit Windows than inform users and MS that their OS is at risk. >You've got an even bigger and more complicated mess to clean up, you dug the hole yourself, it's going to take you longer, and you should have started on it years ago. Security patches are given to OEM's 1 month before they are publicly released. Google patches their devices promptly. Unless I'm mistaken, I'm not aware of technology that allows Google to take an OEM's source code, apply patches, build it, sign it and then release it to all of the OEM's customers.

throwaway91111 10y ago

Is that really google's problem, though? Why do you think they have a responsibility to ensure their OEM clients update regularly? It doesn't reflect poorly on them; it reflects poorly on samsung, sony, etc etc, who fill their phones with crap ware and are slow with patches and upgrades.

partycoder 10y ago

Let's see... Taking over a machine thanks to autorun.inf, crashing machines with ping, unsecured shared folders, worms spreading everywhere, rendering fonts on kernel code, and a long list of other stupid defects... No. Android has never included this level of idiocy therefore it is not fair to hold it to the same standard. Installing Windows was once the same as installing a rootkit in your computer. Android might have issues but never as bad as Windows. Windows holds all the incompetency records. Then, "the operating system released 16 years ago" (Windows XP) is the 3rd most used operating system. It is still causing problems today.

bitJericho 10y ago

And here I am on the Nokia 930 windows phone running Windows 10, and still expecting more updates :)

ebbv 10y ago

> I guess this means we can officially stop hating on Microsoft for having such a lax attitude towards security, considering their last OS to suffer from that attitude was released 16 years ago What? That is complete nonsense. Yes Windows security has improved over time but it's still pretty abysmal compared to macOS, iOS, Android and any mainstream Linux distro. Windows still defaults to your main user being an administrator with administrator privileges at all times. Not to mention the fact that Windows now comes baked in with malware and not only defaults you into turning it on without giving you the option to turn it all off easily during setup, but the major patches that have come out since will re-enable a lot of Microsoft's tracking code and make you jump through hoops to disable it.

sametmax 10y ago

Except mobile OS never suffered even 10% of the problems Windows had. You don't have 1000 toolbar crippling your mama's android browser. I never had to reformat my mobile to "make a clean" install, and certainly not every 6 month like I used to do with windows. We never had any large scale infection on Android like confiker. Reports of anything bad, virus, worms, rootkits... happening on Android are incredibly rare and never happened with my relatives. Clearly we can't hold Google to the same standard as MS, because they are not even on the same level.

belorn 10y ago

If we are comparing 2017 android with 2001 Windows we also need to compare the exploits. During times of 2001 windows we saw things like worms that permanent destroyed hardware (or forced owners to replace them), worms that shutdown whole city networks, computers that got infected in less than a second when connecting to the Internet, and botnets that were bigger than the biggest super computers of the time. The harm were big and scary on a global scale, and specific malware were often calculated to cause billions in damages. On the "lower" end there were bank account hijackings and credit card theft. What are the worst 2017 android malware doing to the world?