10 ms·

Google has 57,000 employees. There is always going to be some good, some bad, in an organization that size. The Project Zero team is excellent and we should al

Google has 57,000 employees. There is always going to be some good, some bad, in an organization that size. The Project Zero team is excellent and we should all be grateful for their work. But we should also continue to hold Google's feet to the fire on the state of Android security, since it is truly a mess, and they are probably the only player to have the power and ability to fix it.

mrb 10y ago
Android is open source and has a permissive license. Fundamentally this means Google cannot prevent manufacturers like Samsung from shipping insecure phones receiving infrequent software updates. I am curious as to what you think Google "should" do? Make Android closed source like iOS and ship it as binary blobs and a license forcing manufacturers to ship sw updates exactly when Google says to do so? You think phone manufacturers would agree to that? They would promptly fork off the last open source Android and rarely take Google's subsequent updates. If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates.
- wtallis 10y ago
  Google has substantial leverage with the Android trademarks and the Play store ecosystem.
  - tastythrowaway2 10y ago
    This. Parent post doesn't realize this basic architectural advantage that should be leveraged.
  - srcmap 10y ago
    In windows 10, I use procexp (from sysinternals) with totalvirus check enable. Basically, it allows all the running .exe programs signatures be checked at once with 56+ virus checking websites and results shows up in the GUI of procexp. No wasting of CPU cycles to scan every files in the system, typical < 3 seconds to check all the running programs - Light up green/red in GUI. https://www.youtube.com/watch?v=RnPtuTbqzd4&t=3s https://www.youtube.com/watch?v=RnPtuTbqzd4&t=3s Love to see google do something similar to this in Android. It is very trivial for Google to dev, deploy these kind of tools/REST API/website. If this is deploy in billions + Android phones, Google should be able to detected/collected/analyze new/potential malwares instantly. Known good programs with valid signatures - do nothing. Unknown programs sig - setup special container and monitors app behavior - collect the binaries if needed. Also, I think google should be able to separate the Google control portions of AOSP from the 3rd party vendors systems drivers/utilities and allow them to be upgrade separately. I used to work on porting the AOSP on cell/tablet SOC before. It is doable.
    - adrianN 10y ago
      I don't think that, in the grand scheme of things, anti virus programs are really helping. Once you have the machine compromised, hiding from a scan isn't terribly difficult.
    - GrinningFool 10y ago
      > No wasting of CPU cycles to scan every files in the system, typical < 3 seconds to check all the running programs - Light up green/red in GUI. THis sounds good, but it can take much less than 3 seconds to compromise user-space data and ship it off.
    - collinmanderson 10y ago
      totalvirus -> VirusTotal
- pcwalton 10y ago
  > They would promptly fork off the last open source Android and rarely take Google's subsequent updates. And thereby lose access to the Play Store?
  - tonyztan 10y ago
    Amazon Kindle fires don't have Play Store. Manufacturers could set up their own app stores like Amazon did.
    - ReverseCold 10y ago
      Amazon is the only one who could possibly pull that off. Everyone else needs the play store. Amazon would probably let them use their store though...
      - kbenson 10y ago
        > Amazon is the only one who could possibly pull that off. Everyone else needs the play store. Samsung alone has more market share (by device) than Apple.[1] Samsung could probably do it, but it would be bumpy. > Amazon would probably let them use their store though... Maybe not without major concessions. Amazon subsidizes a lot of apps in their store because of their add serving architecture. 1: http://www.idc.com/promo/smartphone-market-share/vendor http://www.idc.com/promo/smartphone-market-share/vendor
      - escap 10y ago
        There is no Google Play store in China. It might come though http://www.androidpolice.com/2017/02/06/no-really-this-time-a-censored-google-play-store-for-china-is-coming-at-some-point-maybe/ http://www.androidpolice.com/2017/02/06/no-really-this-time-...
- joelthelion 10y ago
  > If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates. I find it amazing that supporting a $1000 phone for 3 years is considered excellent. It's not very sustainable to make several billion new smartphones every 3 years...
  - mrb 10y ago
    Pixel starts at $650 not $1000. But I agree that $500+ phones (Google AND Apple) should IMHO be security-supported for 5 years. It would be better for all of us.
    - kuschku 10y ago
      Pixel starts at over $900 in Europe.
      - vinay427 10y ago
        This includes a significant VAT that varies by country, so the price isn't comparable to the listed US price which excludes any applicable sales taxes. That being said, the consumer is still paying nearly $1000 USD for their device with the hidden tax.
    - eggnet 10y ago
      The OP didn't say that the Pixel starts at $1000. A 128GB Pixel XL with device protection is $968 US before tax and still has the same 3 year support as the entry level Pixel. The fact is Google sells a $1000 phone with 3 years of support. They also sell less expensive variants with 3 years of support.
    - akoster 10y ago
      $500+ iPhone 5 (2012) user checking in here, currently into the 5th year of updating to the latest (most patched) OS version. I wish android had something like this.
      - 10y ago
- pasbesoin 10y ago
  Some of us tried that, right after Google's Motorola acquisition. Didn't work out so well for us. (It was the only "Google" option at the time for those of us who needed to be on Verizon for their network specifics.) Right now, I'm on a Nexus 5x that works on Verizon while not officially supported. Verizon network, without the Verizon crapware and retarded (as in, delayed or never delivered) security updates. I might move to the Pixel 2, when it comes out. Even then, I'll buy it directly from Google and forego the Verizon crapware-and-delay leash. Samsung seems to have a renewed commitment to timely updates, and the moxie to pressure U.S. carriers to pass them on -- somewhat. Other than that, I'd advise most of my friends to stay away from Android on U.S. carriers. It continues to be a shitstorm. My friends with Apple remain mostly simply happy and unstressed. I'm not particularly fond of "walled gardens." But for a lot of people, it's "just a phone" and they want it to "just work." My point regarding Google itself: They bought Motorola and had Motorola thence promising timely updates for a reasonable period of time. Didn't happen. I trust Google to do what it perceives to be in its best interest. Including updating its own phones for PR reasons. Beyond that, just like the newer products they launch or buy and then often kill a year later, it's a crapshoot. P.S. Like others are expressing, Google's a big place with many pieces. As to the topic of the OP, I'm glad Project Zero continues to have support and is doing what it's doing. And that it has the muscle and inertia of Google behind it, to weather the political and legal shitstorm attendant with the mess that is is IS/IT security, these days.
- peterwwillis 10y ago
  If Microsoft had required Dell, HP, Lenovo, Samsung, Toshiba, Acer, Asus, etc all to provide free operating system upgrades on your PC every time there was a Microsoft security hole, Windows would have been deader than dirt years ago. Google gets away with this because it is "free", so the refrain is "you can't complain if it's free". Google could go the same route Microsoft did, but it chooses not to. Phone manufacturers would be happy to have binary blob updates for free - but it would never happen. Google would have to custom-build, test, and certify every binary blob for every piece of hardware, which is an unjustifiable cost. If you want a phone with top-notch security, buy an Apple phone. They're supported longer, they fix their security bugs promptly, and they honestly have a better model for their OS anyway. (disclaimer: I hate Apple)
  - mrb 10y ago
    "They're supported longer" In general yes, but not always. Security updates may stop as soon as 2 years after purchase: the iPhone 4S was discontinued on September 9, 2014, and the last iOS for it is 9.3.5 released on August 25, 2016.
    - peterwwillis 10y ago
      The Galaxy Nexus was released at the same time as the 4S, and its last supported OS was Jelly Bean (4.3). The last update for this OS, 4.3.1, was released in October 2013. It was not supported after this. So the iPhone 4S, which you use as an example of a lack of support, was supported for three years longer than the comparable Android.
      - mrb 10y ago
        Yes the Galaxy Nexus was terrible in that respect. But it doesn't change my main point which is that: Apple security updates may stop as soon as 2 years after purchase. And the last example of this was 8 months ago when 4S support ended. By contrast the Galaxy Nexus support ended 3.5 years ago and is no longer representative of Google support's policy which is now longer.
      - 10y ago
- kartickv 10y ago
  Maybe change the license to one that requires manufacturers provide security patches for three years, except for non-profits? Entities that release only software, like a modding community, would be exempt. Yes, this won't be "open-source", but it will be open enough, in that you can still read the source code, modify it, ship a phone without Google's permission, and so on. The free for all model we have isn't working.
- kalleboo 10y ago
  What they should do is what Microsoft did - make hardware drivers independent from the OS version. I don't need Dell to recompile the NT Kernel for me every patch Tuesday.
  - mrmondo 10y ago
    Because the Microsoft driver ecosystem is in a good state...
sigmar 10y ago
>feet to the fire on the state of Android security, since it is truly a mess Specifically, by what metric are you calling it a mess? Certainly Apple devices are a little more secure depending on your threat model (except for physical security, where Apple is a leader), but Android seems pretty secure if you stick to the play store. ASLR, ART runtime, sandboxing, safetynet, good tls stack, and a solid bug bounty program have lead to an pretty safe OS imo. Web browsers on the other hand...
- berberous 10y ago
  I was referring to the post that the parent linked to, which criticizes Google for letting the various Android partners get away with never shipping security updates. The latest Android on a Pixel phone may have good security, but not the majority of phones out there that are way out of date.

mrb 10y ago

Android is open source and has a permissive license. Fundamentally this means Google cannot prevent manufacturers like Samsung from shipping insecure phones receiving infrequent software updates. I am curious as to what you think Google "should" do? Make Android closed source like iOS and ship it as binary blobs and a license forcing manufacturers to ship sw updates exactly when Google says to do so? You think phone manufacturers would agree to that? They would promptly fork off the last open source Android and rarely take Google's subsequent updates. If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates.

wtallis 10y ago
Google has substantial leverage with the Android trademarks and the Play store ecosystem.
- tastythrowaway2 10y ago
  This. Parent post doesn't realize this basic architectural advantage that should be leveraged.
- srcmap 10y ago
  In windows 10, I use procexp (from sysinternals) with totalvirus check enable. Basically, it allows all the running .exe programs signatures be checked at once with 56+ virus checking websites and results shows up in the GUI of procexp. No wasting of CPU cycles to scan every files in the system, typical < 3 seconds to check all the running programs - Light up green/red in GUI. https://www.youtube.com/watch?v=RnPtuTbqzd4&t=3s https://www.youtube.com/watch?v=RnPtuTbqzd4&t=3s Love to see google do something similar to this in Android. It is very trivial for Google to dev, deploy these kind of tools/REST API/website. If this is deploy in billions + Android phones, Google should be able to detected/collected/analyze new/potential malwares instantly. Known good programs with valid signatures - do nothing. Unknown programs sig - setup special container and monitors app behavior - collect the binaries if needed. Also, I think google should be able to separate the Google control portions of AOSP from the 3rd party vendors systems drivers/utilities and allow them to be upgrade separately. I used to work on porting the AOSP on cell/tablet SOC before. It is doable.
  - adrianN 10y ago
    I don't think that, in the grand scheme of things, anti virus programs are really helping. Once you have the machine compromised, hiding from a scan isn't terribly difficult.
  - GrinningFool 10y ago
    > No wasting of CPU cycles to scan every files in the system, typical < 3 seconds to check all the running programs - Light up green/red in GUI. THis sounds good, but it can take much less than 3 seconds to compromise user-space data and ship it off.
  - collinmanderson 10y ago
    totalvirus -> VirusTotal
pcwalton 10y ago
> They would promptly fork off the last open source Android and rarely take Google's subsequent updates. And thereby lose access to the Play Store?
- tonyztan 10y ago
  Amazon Kindle fires don't have Play Store. Manufacturers could set up their own app stores like Amazon did.
  - ReverseCold 10y ago
    Amazon is the only one who could possibly pull that off. Everyone else needs the play store. Amazon would probably let them use their store though...
    - kbenson 10y ago
      > Amazon is the only one who could possibly pull that off. Everyone else needs the play store. Samsung alone has more market share (by device) than Apple.[1] Samsung could probably do it, but it would be bumpy. > Amazon would probably let them use their store though... Maybe not without major concessions. Amazon subsidizes a lot of apps in their store because of their add serving architecture. 1: http://www.idc.com/promo/smartphone-market-share/vendor http://www.idc.com/promo/smartphone-market-share/vendor
    - escap 10y ago
      There is no Google Play store in China. It might come though http://www.androidpolice.com/2017/02/06/no-really-this-time-a-censored-google-play-store-for-china-is-coming-at-some-point-maybe/ http://www.androidpolice.com/2017/02/06/no-really-this-time-...
joelthelion 10y ago
> If you want a phone with top-notch security, buy a Google phone which is guaranteed, by Google, to come with 3 years of monthly security updates. I find it amazing that supporting a $1000 phone for 3 years is considered excellent. It's not very sustainable to make several billion new smartphones every 3 years...
- mrb 10y ago
  Pixel starts at $650 not $1000. But I agree that $500+ phones (Google AND Apple) should IMHO be security-supported for 5 years. It would be better for all of us.
  - kuschku 10y ago
    Pixel starts at over $900 in Europe.
    - vinay427 10y ago
      This includes a significant VAT that varies by country, so the price isn't comparable to the listed US price which excludes any applicable sales taxes. That being said, the consumer is still paying nearly $1000 USD for their device with the hidden tax.
  - eggnet 10y ago
    The OP didn't say that the Pixel starts at $1000. A 128GB Pixel XL with device protection is $968 US before tax and still has the same 3 year support as the entry level Pixel. The fact is Google sells a $1000 phone with 3 years of support. They also sell less expensive variants with 3 years of support.
  - akoster 10y ago
    $500+ iPhone 5 (2012) user checking in here, currently into the 5th year of updating to the latest (most patched) OS version. I wish android had something like this.
    - 10y ago
pasbesoin 10y ago
Some of us tried that, right after Google's Motorola acquisition. Didn't work out so well for us. (It was the only "Google" option at the time for those of us who needed to be on Verizon for their network specifics.) Right now, I'm on a Nexus 5x that works on Verizon while not officially supported. Verizon network, without the Verizon crapware and retarded (as in, delayed or never delivered) security updates. I might move to the Pixel 2, when it comes out. Even then, I'll buy it directly from Google and forego the Verizon crapware-and-delay leash. Samsung seems to have a renewed commitment to timely updates, and the moxie to pressure U.S. carriers to pass them on -- somewhat. Other than that, I'd advise most of my friends to stay away from Android on U.S. carriers. It continues to be a shitstorm. My friends with Apple remain mostly simply happy and unstressed. I'm not particularly fond of "walled gardens." But for a lot of people, it's "just a phone" and they want it to "just work." My point regarding Google itself: They bought Motorola and had Motorola thence promising timely updates for a reasonable period of time. Didn't happen. I trust Google to do what it perceives to be in its best interest. Including updating its own phones for PR reasons. Beyond that, just like the newer products they launch or buy and then often kill a year later, it's a crapshoot. P.S. Like others are expressing, Google's a big place with many pieces. As to the topic of the OP, I'm glad Project Zero continues to have support and is doing what it's doing. And that it has the muscle and inertia of Google behind it, to weather the political and legal shitstorm attendant with the mess that is is IS/IT security, these days.
peterwwillis 10y ago
If Microsoft had required Dell, HP, Lenovo, Samsung, Toshiba, Acer, Asus, etc all to provide free operating system upgrades on your PC every time there was a Microsoft security hole, Windows would have been deader than dirt years ago. Google gets away with this because it is "free", so the refrain is "you can't complain if it's free". Google could go the same route Microsoft did, but it chooses not to. Phone manufacturers would be happy to have binary blob updates for free - but it would never happen. Google would have to custom-build, test, and certify every binary blob for every piece of hardware, which is an unjustifiable cost. If you want a phone with top-notch security, buy an Apple phone. They're supported longer, they fix their security bugs promptly, and they honestly have a better model for their OS anyway. (disclaimer: I hate Apple)
- mrb 10y ago
  "They're supported longer" In general yes, but not always. Security updates may stop as soon as 2 years after purchase: the iPhone 4S was discontinued on September 9, 2014, and the last iOS for it is 9.3.5 released on August 25, 2016.
  - peterwwillis 10y ago
    The Galaxy Nexus was released at the same time as the 4S, and its last supported OS was Jelly Bean (4.3). The last update for this OS, 4.3.1, was released in October 2013. It was not supported after this. So the iPhone 4S, which you use as an example of a lack of support, was supported for three years longer than the comparable Android.
    - mrb 10y ago
      Yes the Galaxy Nexus was terrible in that respect. But it doesn't change my main point which is that: Apple security updates may stop as soon as 2 years after purchase. And the last example of this was 8 months ago when 4S support ended. By contrast the Galaxy Nexus support ended 3.5 years ago and is no longer representative of Google support's policy which is now longer.
    - 10y ago
kartickv 10y ago
Maybe change the license to one that requires manufacturers provide security patches for three years, except for non-profits? Entities that release only software, like a modding community, would be exempt. Yes, this won't be "open-source", but it will be open enough, in that you can still read the source code, modify it, ship a phone without Google's permission, and so on. The free for all model we have isn't working.
kalleboo 10y ago
What they should do is what Microsoft did - make hardware drivers independent from the OS version. I don't need Dell to recompile the NT Kernel for me every patch Tuesday.
- mrmondo 10y ago
  Because the Microsoft driver ecosystem is in a good state...

sigmar 10y ago

>feet to the fire on the state of Android security, since it is truly a mess Specifically, by what metric are you calling it a mess? Certainly Apple devices are a little more secure depending on your threat model (except for physical security, where Apple is a leader), but Android seems pretty secure if you stick to the play store. ASLR, ART runtime, sandboxing, safetynet, good tls stack, and a solid bug bounty program have lead to an pretty safe OS imo. Web browsers on the other hand...

berberous 10y ago
I was referring to the post that the parent linked to, which criticizes Google for letting the various Android partners get away with never shipping security updates. The latest Android on a Pixel phone may have good security, but not the majority of phones out there that are way out of date.