5 ms·

I wonder what's going to happen to old Android devices that are no longer receiving security updates

walterbell 9y ago
If there are no global, industry-wide incentives to fix this particular, once-in-twenty-years issue, they become the world's largest botnet. Apple and Google should want old devices to be patched, to avoid teaching consumers that their devices cannot be trusted.
- workthrowaway27 9y ago
  There's no remote exploit though, right? So the only way an attacker could turn this into a botnet would be to somehow get Android apps to run attacker controlled code or exploit existing code that fits the pattern described in the attacks (seems not to exist in practice). These aren't super high bars, but they do make the exploit significantly harder.
  - jimmaswell 9y ago
    Couldn't old Android web browsers be targeted?
    - workthrowaway27 9y ago
      It seems like it (didn't see that there was a JS version of the exploit until after I posted), although they can only read from the address space of the process the JS code is running in. I think tabs get individual processes (in Chrome at least), not sure about Firefox or other browsers, so I'm not sure how bad this is in practice.
- jacksmith21006 9y ago
  Google will on their pixel phones. But the other OEMs tend to not be good about updates. A big plus for the Pixel in the Android world.
pjmlp 9y ago
Nothing. Until Google takes the stand and actually forces OEMs to update, nothing will ever change. Not for existing devices, nor for Treble certified ones. Updates are only for rich people able to pay 500€+ for flagship devices every three years.
- Mindwipe 9y ago
  Treble is counterproductive to this sort of problem anyway. But abstracting the OS to a layer sat above a quasi-HAL as it does, users will get OS updates with features but without updates to the underlying hardware interface blobs. The incentive for OEMs to update drivers for security goes down radically, not up, because the users crying out for OS feature x get it without having to update anything below the abstraction layer. Ultimately the problem with Android driver security is that Qualcomm has no interest in it, and won't until some form of legislation from a large territory such as the US, EU or China forces their hand on it.
  - pjmlp 9y ago
    No they won't, because Google keeps saying that even with Treble, OEMs are the ones responsible to push any kind of update not Google. So unless Google changes their mind, users will get the same amount of updates as they are getting now on non-Treble devices.
- danieldk 9y ago
  Updates are only for rich people able to pay 500€+ for flagship devices every three years. And only when you buy it on day one: Pixel phones get security updates for at least 3 years from when the device first became available on the Google Store, or at least 18 months from when the Google Store last sold the device, whichever is longer. After that, we can't guarantee more updates. Source: https://support.google.com/pixelphone/answer/4457705?hl=en https://support.google.com/pixelphone/answer/4457705?hl=en
- jacksmith21006 9y ago
  Google will for the Pixel and if the other OEMs drag their feet more will get the Pixel. That is on the OEMs.

If there are no global, industry-wide incentives to fix this particular, once-in-twenty-years issue, they become the world's largest botnet. Apple and Google should want old devices to be patched, to avoid teaching consumers that their devices cannot be trusted.

workthrowaway27 9y ago
There's no remote exploit though, right? So the only way an attacker could turn this into a botnet would be to somehow get Android apps to run attacker controlled code or exploit existing code that fits the pattern described in the attacks (seems not to exist in practice). These aren't super high bars, but they do make the exploit significantly harder.
- jimmaswell 9y ago
  Couldn't old Android web browsers be targeted?
  - workthrowaway27 9y ago
    It seems like it (didn't see that there was a JS version of the exploit until after I posted), although they can only read from the address space of the process the JS code is running in. I think tabs get individual processes (in Chrome at least), not sure about Firefox or other browsers, so I'm not sure how bad this is in practice.
jacksmith21006 9y ago
Google will on their pixel phones. But the other OEMs tend to not be good about updates. A big plus for the Pixel in the Android world.

pjmlp 9y ago

Nothing. Until Google takes the stand and actually forces OEMs to update, nothing will ever change. Not for existing devices, nor for Treble certified ones. Updates are only for rich people able to pay 500€+ for flagship devices every three years.

Mindwipe 9y ago
Treble is counterproductive to this sort of problem anyway. But abstracting the OS to a layer sat above a quasi-HAL as it does, users will get OS updates with features but without updates to the underlying hardware interface blobs. The incentive for OEMs to update drivers for security goes down radically, not up, because the users crying out for OS feature x get it without having to update anything below the abstraction layer. Ultimately the problem with Android driver security is that Qualcomm has no interest in it, and won't until some form of legislation from a large territory such as the US, EU or China forces their hand on it.
- pjmlp 9y ago
  No they won't, because Google keeps saying that even with Treble, OEMs are the ones responsible to push any kind of update not Google. So unless Google changes their mind, users will get the same amount of updates as they are getting now on non-Treble devices.
danieldk 9y ago
Updates are only for rich people able to pay 500€+ for flagship devices every three years. And only when you buy it on day one: Pixel phones get security updates for at least 3 years from when the device first became available on the Google Store, or at least 18 months from when the Google Store last sold the device, whichever is longer. After that, we can't guarantee more updates. Source: https://support.google.com/pixelphone/answer/4457705?hl=en https://support.google.com/pixelphone/answer/4457705?hl=en
jacksmith21006 9y ago
Google will for the Pixel and if the other OEMs drag their feet more will get the Pixel. That is on the OEMs.