14 ms·

> Google already fixed at least one of the Android exploits used by "Agent Smith," nicknamed Janus, in 2017 but the fix hasn't made its way onto every Android p

> Google already fixed at least one of the Android exploits used by "Agent Smith," nicknamed Janus, in 2017 but the fix hasn't made its way onto every Android phone. It's a potent reminder that millions of phones around the world are being used without the latest security measures. Because Samsung (or similar) or even more weirdly, Sprint (or similar) just doesn't fucking update our Android versions for months, or ever.

Angostura 7y ago
I bought a new Android table from Samsung 3 years ago for more daughter - when bought it had a 2 year old version of Android on and enquiries from Samsung UK said it would not be updated. My daughter is still using it today, unupdated from 5 years ago. We tend to be an Apple household Edit - the Device, bought in September 2016 was a Samsung Galaxy TAB E 9.6 SM-T560 WI-FI - I will check the software level tonight.
- jimmaswell 7y ago
  better than ios updates making the phone unusable. happened to me on old ipod touch models, not even the battery thing.
  - thanatos_dem 7y ago
    > Not even the battery thing. That was an attempt at graceful degradation that wasn’t communicated well. The general belief was that having a phone that runs a bit more slowly, but consistently used it’s battery as the battery life naturally degrades is better than a phone suddenly dying with 40% battery remaining if the peak power draw exceeds what a several year old lithium ion battery can produce. I much prefer the former personally, but I get where the misunderstanding and public outcry came from. Beyond that, what made your phone unusable? The last 4 or 5 iOS versions have improved performance across the board, even for phones several years old.
    - JasonFruit 7y ago
      It's probably true that this was more an image problem than an actual misdeed, but the outcry was symptomatic of consumers' deep mistrust of tech companies' intentions. Some of that is because, to most people, a computing device is a black box, but some of it is because they've been burned before.
    - jimmaswell 7y ago
      I had a first or second gen iPod Touch and it became unusably slow right after updating it some time later.
    - yyyk 7y ago
      > That was an attempt at graceful degradation that wasn’t communicated well. That was nearly outright fraud which went swimmingly well. The big issue wasn't so much the unannouced throttling. It was that Apple knew that a lot of customers had battery issues but misled them (by denying the entire issue) so that they'll buy a new device. Instead, the debate turned on slightly more defencible for Apple. Slightly more defencible, because while Apple _says_ that was done to counteract the battery issues, nobody knows whether iOS really checked battery state and didn't just throttle all older models indiscriminately. The latter would be rather convenient for the bottom line.
      - donarb 7y ago
        Apple has had a battery replacement option for quite a few years. Apple Store employees don't work on commission, so a customer coming in with a battery problem would most likely be offered the battery replacement option before being sold a new phone.
        yyyk 7y ago
        Employees can only give answers they know about, and a general battery issue was denied by Apple. That they didn't tell their own employees does not clear Apple from misleading their customers. Aside, I'm pretty sure that Apple Stores do care about margin, and so do employees that identify with their business or are encouraged by their managers, but I am not accusing them (the employees) of anything.
- enceladus_ice 7y ago
  I've had luck with official Google phones the past couple years, and in the past the Moto line of Android phones stayed up to date to a point.
  - ubercow13 7y ago
    My Moto phone hasn't had a security update in a year, and sale of the model was stopped 2 years ago, so that's 1 year support. Luckily it was cheap. I'll be ditching Android I think
- ajross 7y ago
  Which device? That doesn't sound right. We're in a more or less identical situation, with Galaxy Tab S2's for the kids that we bought three years ago. And indeed, they're running comparatively ancient Android 7.0 images and will never see a version bump again. They do, however, continue to see security updates. And in particular they've been patched against the vulnerability in the linked article. I'd be very surprised if yours was any different.
  - nolok 7y ago
    He's probably wrong, but inadvertently so. Most people seem to confuse android version update with security update, which is compounded by the fact that security updates on android are very "discreet" all things considered, and you don't notice it much.
  - Angostura 7y ago
    I'll have a check in a couple of hours and and report back. The Device, bought in September 2016 was a Samsung Galaxy TAB E 9.6 SM-T560 WI-FI
  - pmlnr 7y ago
    > comparatively ancient Android 7.0 7.0 is ancient? 5.1, or rather 4.4 is ancient.
    - TeMPOraL 7y ago
      Android with a version number is ancient; current Androids have single letters in their name.
      - deleted 7y ago
        [deleted]
    - Santosh83 7y ago
      The Android ver on my phone is 4.1. Still runs just fine, but then again all I use it for are calls/SMS, so there's little scope to be exploited.
- WrtCdEvrydy 7y ago
  Yeah, I'm doubting that. Go into settings, about device and check the Security Patch Level.
scarface74 7y ago
That’s the problem. Why should your carrier have any say so in updating your operating system? If I buy a computer from Best Buy, I don’t have to wait for them to push an update to Windows.
- JustSomeNobody 7y ago
  Because carriers have a tremendous fear of being simple data pipes.
  - benburleson 7y ago
    Is there really some expectation for a carrier to be more than that? I just want a fast, reliable service that connects my phone to the internet. Is there actually profit in providing more than that?
    - jethro_tell 7y ago
      well there's usually a bundle of shit in a carrier OS, it's just not profit from you.
    - wyldfire 7y ago
      From the carrier: yes. The phone subsidies (in the US at least) are very reminiscent of the old leased phones of yore. But if you look at the actions of mobile phone carriers and ISPs they're desperate not to become dumb pipes. They design all kinds of clever mechanisms and marketing strategies to distinguish themselves. > Is there actually profit in providing more than that? Well, in a free market, competition is intense. So if they can find ways to distort that, then yes: they will make more money. Many of us don't have much allegiance to particular gas station brands. But they create rewards programs to try and get some of that loyalty. Otherwise you just compete on price.
      - bongobongo 7y ago
        Let's not be silly, there is no market in this case. It's an oligopoly and occasional cartel.
pbhjpbhj 7y ago
I've never understood this as a design decision -- why does Google allow companies to block updating of Android? Presumably the idea is 'block updates to force hardware sales'? I can't update my Honor, I think it's the service provider (the phone was on contract) who block the update, but it was easy to update (both Android and EMUI) using an app in the Google Play store to a full version higher, but whoever created that update hasn't done further ones. It is a hack though, there should be a way to do it officially.
- tialaramex 7y ago
  It hasn't made any sense to buy phones from the company that provides your mobile phone service for years, especially now that a "phone" isn't in any meaningful sense a phone at all with many people never making or receiving any calls. They shouldn't be any more involved in what phone you use than your ISP gets to pick whether you use a Mac or PC. Sure if you want to use a 15 year old phone you're going to need to find somebody who allows that (my guess: no-one) just like you won't find so many ISPs who offer 1200/75 dial-up mode for your original Apple Macintosh with acoustic coupler. But anybody with normal needs shouldn't need to care, just sell me "phone" (ie mobile Internet) service.
  - vetinari 7y ago
    A cellular phone is also a network terminal. A misbehaving device can cause unreasonable load on the network, a disruption to other users, or at least interruption of the service on your device. When Apple does screw up and iOS update will leave you with no data, the operators will attempt to make it work; they won't do that for every random manufacturer though.
  - pbhjpbhj 7y ago
    Crunching the numbers, it was much much cheaper for me getting this phone on contract then any other route. I did look at buying a phone separately and having SIM-only or PAYGo. (UK, about 3 years ago, low-mid range). With 18 month contract I basically got a 'free' phone with 13MP camera. I actually use a SIM only by swapping sims with my wife whose phone we bought outright (but it's low end - camera and screen are poor).
paulcarroty 7y ago
> Google already fixed at least one of the Android exploits used by "Agent Smith, Google can't fix it due to Android fragmentation. Millions of devices will never get this update.
jammygit 7y ago
Question: my brother just got a used pixel 1 phone. Will it stop getting security updates soon/already?
- elbrian 7y ago
  I took 10 seconds to Google your question and found this link: https://support.google.com/nexus/answer/4457705?hl=en#pixel_phones https://support.google.com/nexus/answer/4457705?hl=en#pixel_...
- cure 7y ago
  Yes, looks like October 2019 is the end: https://support.google.com/nexus/answer/4457705?hl=en#pixel_phones https://support.google.com/nexus/answer/4457705?hl=en#pixel_...
  - jammygit 7y ago
    What should he do if he finds out about a vulnerability then? Does he need a new phone?
    - brlewis 7y ago
      Yes, but not necessarily Oct 2019. My Nexus 5X is running Android 8.1.0 with security patch level: December 5, 2018, so it's likely Pixel will also get updates after the guaranteed dates.
    - Jonnax 7y ago
      He needs to weigh the risk versus the cost of a new phone. There is a custom firmware card LineageOS but it's a community effort. It may get up to date security updates merged in but it could be vulnerable in other ways.
- _underfl0w_ 7y ago
  FWIW, LineageOS has official nightlies for that phone now (typing this from one of those builds now, actually)
dan-0 7y ago
This seems to be getting a lot of attention, so as an Android Engineer with some security and framework experience let me try to explain. This is a side effect of Android's initial approach to it's open nature. Android allows a manufacturer to modify its framework for their own use case. Then the manufacturer can allow a specific carrier to input their own system applications and firmware on to the devices well (your bloatware etc). This can lead to multiple firmware variants for a specific device. It's not uncommon to see over 20 variants of a firmware for a specific Samsung device for example. This can be broken down by carrier, by region, by OS, etc.. for a number of different reasons. This becomes a problem when Android needs to post an update. That update has to be pushed first to the Android framework, then to the manufacturer who decides if they are going to make modifications for the update, and if the manufacturer decides to make an update, they push it to the carrier who then has to make an update themselves. This leads to a web with many broken ends, where a specific phone on one carrier may never see an OS upgrade after purchase, but on another carrier, the same phone might get them regularly. Additionally some manufacturers take a greater degree of liberty in modifying the Android framework, making updates significantly more expensive to implement, so they don't. The good news is Google over the past couple of years has been making a great effort under Project Trebel to simplify some of the APIs in the Android framework. What this is leading to is less friction when it comes to implementing core updates. Unfortunately not all manufacturers have opted in to adhering to the standards and Project Trebel yet. This is all in stark contrast to iOS, which doesn't have the restriction of dealing with multiple manufacturers, and makes it harder for carriers to customize the device for their own business cases. This makes security and updates easier to push, but on the cost to the user of being an expensive single stream walled garden. Nothing against iOS in the statement, as a flagship device they're very nice. However, they don't have the adaptability that Android allows, making them prohibitive in some markets. Sorry for any grammar issues, I'm on my phone (a regularly updated Pixel 3).
- cstejerean 7y ago
  This is what I love about Apple. They gave the carriers a big middle finger when it comes to the usual bullshit of bloatware, sticking their logos on things or getting in the middle of updates. That’s because they cared about the end user experience. Google was happy to just grab market share at the expense of the users by allowing carriers to continue with their usual shenanigans. For this reason Apple will have my eternal gratitude, because I remember what a shitshow smartphones (and deploying apps for them) was before Apple flexed their muscles on this.
GeekyBear 7y ago
From the start, Google cared enough about device makers potentially shipping a device running a fork of Android that they forbade doing so in their contracts with device makers. When it came to making sure consumers got timely software updates, Google sided with the device makers and carriers. Device makers wanted you to buy new hardware every couple of years, and carriers wanted to lock you into an additional two year contract. Google could have contractually required device makers and carriers to support end user devices after the sale, it just wasn't something they cared enough about.
- ApolloFortyNine 7y ago
  Google never forbid updating phones... They forbid forking Android.
  - cma 7y ago
    That's what he said. They didn't forbid it, but they also didn't mandate it be allowed.
    - GeekyBear 7y ago
      In contrast, Apple did forbid carriers to block software updates in it's contracts with them. It's a matter of who you think your customers are. Google sides with advertisers, device makers, and carriers and not it's end users.
    - ApolloFortyNine 7y ago
      I fail to see the relevance of Samsung not updating their phones to Google not wanting Android to be forked. If Samsung had forked Android, they still wouldn't update old phones.
yeahitslikethat 7y ago
I'm still on android 5.0.1 because at&t won't allow me to update my phone unless I'm on their network as a customer. But they don't have service where I live so I can't.
pier25 7y ago
Which is why Pixel or Android One devices are the way to go.
wildduck 7y ago
Time to put some effort into this https://www.replicant.us https://www.replicant.us

Angostura 7y ago

I bought a new Android table from Samsung 3 years ago for more daughter - when bought it had a 2 year old version of Android on and enquiries from Samsung UK said it would not be updated. My daughter is still using it today, unupdated from 5 years ago. We tend to be an Apple household Edit - the Device, bought in September 2016 was a Samsung Galaxy TAB E 9.6 SM-T560 WI-FI - I will check the software level tonight.

jimmaswell 7y ago
better than ios updates making the phone unusable. happened to me on old ipod touch models, not even the battery thing.
- thanatos_dem 7y ago
  > Not even the battery thing. That was an attempt at graceful degradation that wasn’t communicated well. The general belief was that having a phone that runs a bit more slowly, but consistently used it’s battery as the battery life naturally degrades is better than a phone suddenly dying with 40% battery remaining if the peak power draw exceeds what a several year old lithium ion battery can produce. I much prefer the former personally, but I get where the misunderstanding and public outcry came from. Beyond that, what made your phone unusable? The last 4 or 5 iOS versions have improved performance across the board, even for phones several years old.
  - JasonFruit 7y ago
    It's probably true that this was more an image problem than an actual misdeed, but the outcry was symptomatic of consumers' deep mistrust of tech companies' intentions. Some of that is because, to most people, a computing device is a black box, but some of it is because they've been burned before.
  - jimmaswell 7y ago
    I had a first or second gen iPod Touch and it became unusably slow right after updating it some time later.
  - yyyk 7y ago
    > That was an attempt at graceful degradation that wasn’t communicated well. That was nearly outright fraud which went swimmingly well. The big issue wasn't so much the unannouced throttling. It was that Apple knew that a lot of customers had battery issues but misled them (by denying the entire issue) so that they'll buy a new device. Instead, the debate turned on slightly more defencible for Apple. Slightly more defencible, because while Apple _says_ that was done to counteract the battery issues, nobody knows whether iOS really checked battery state and didn't just throttle all older models indiscriminately. The latter would be rather convenient for the bottom line.
    - donarb 7y ago
      Apple has had a battery replacement option for quite a few years. Apple Store employees don't work on commission, so a customer coming in with a battery problem would most likely be offered the battery replacement option before being sold a new phone.
      - yyyk 7y ago
        Employees can only give answers they know about, and a general battery issue was denied by Apple. That they didn't tell their own employees does not clear Apple from misleading their customers. Aside, I'm pretty sure that Apple Stores do care about margin, and so do employees that identify with their business or are encouraged by their managers, but I am not accusing them (the employees) of anything.
enceladus_ice 7y ago
I've had luck with official Google phones the past couple years, and in the past the Moto line of Android phones stayed up to date to a point.
- ubercow13 7y ago
  My Moto phone hasn't had a security update in a year, and sale of the model was stopped 2 years ago, so that's 1 year support. Luckily it was cheap. I'll be ditching Android I think
ajross 7y ago
Which device? That doesn't sound right. We're in a more or less identical situation, with Galaxy Tab S2's for the kids that we bought three years ago. And indeed, they're running comparatively ancient Android 7.0 images and will never see a version bump again. They do, however, continue to see security updates. And in particular they've been patched against the vulnerability in the linked article. I'd be very surprised if yours was any different.
- nolok 7y ago
  He's probably wrong, but inadvertently so. Most people seem to confuse android version update with security update, which is compounded by the fact that security updates on android are very "discreet" all things considered, and you don't notice it much.
- Angostura 7y ago
  I'll have a check in a couple of hours and and report back. The Device, bought in September 2016 was a Samsung Galaxy TAB E 9.6 SM-T560 WI-FI
- pmlnr 7y ago
  > comparatively ancient Android 7.0 7.0 is ancient? 5.1, or rather 4.4 is ancient.
  - TeMPOraL 7y ago
    Android with a version number is ancient; current Androids have single letters in their name.
    - deleted 7y ago
      [deleted]
  - Santosh83 7y ago
    The Android ver on my phone is 4.1. Still runs just fine, but then again all I use it for are calls/SMS, so there's little scope to be exploited.
WrtCdEvrydy 7y ago
Yeah, I'm doubting that. Go into settings, about device and check the Security Patch Level.

scarface74 7y ago

That’s the problem. Why should your carrier have any say so in updating your operating system? If I buy a computer from Best Buy, I don’t have to wait for them to push an update to Windows.

JustSomeNobody 7y ago
Because carriers have a tremendous fear of being simple data pipes.
- benburleson 7y ago
  Is there really some expectation for a carrier to be more than that? I just want a fast, reliable service that connects my phone to the internet. Is there actually profit in providing more than that?
  - jethro_tell 7y ago
    well there's usually a bundle of shit in a carrier OS, it's just not profit from you.
  - wyldfire 7y ago
    From the carrier: yes. The phone subsidies (in the US at least) are very reminiscent of the old leased phones of yore. But if you look at the actions of mobile phone carriers and ISPs they're desperate not to become dumb pipes. They design all kinds of clever mechanisms and marketing strategies to distinguish themselves. > Is there actually profit in providing more than that? Well, in a free market, competition is intense. So if they can find ways to distort that, then yes: they will make more money. Many of us don't have much allegiance to particular gas station brands. But they create rewards programs to try and get some of that loyalty. Otherwise you just compete on price.
    - bongobongo 7y ago
      Let's not be silly, there is no market in this case. It's an oligopoly and occasional cartel.

pbhjpbhj 7y ago

I've never understood this as a design decision -- why does Google allow companies to block updating of Android? Presumably the idea is 'block updates to force hardware sales'? I can't update my Honor, I think it's the service provider (the phone was on contract) who block the update, but it was easy to update (both Android and EMUI) using an app in the Google Play store to a full version higher, but whoever created that update hasn't done further ones. It is a hack though, there should be a way to do it officially.

tialaramex 7y ago
It hasn't made any sense to buy phones from the company that provides your mobile phone service for years, especially now that a "phone" isn't in any meaningful sense a phone at all with many people never making or receiving any calls. They shouldn't be any more involved in what phone you use than your ISP gets to pick whether you use a Mac or PC. Sure if you want to use a 15 year old phone you're going to need to find somebody who allows that (my guess: no-one) just like you won't find so many ISPs who offer 1200/75 dial-up mode for your original Apple Macintosh with acoustic coupler. But anybody with normal needs shouldn't need to care, just sell me "phone" (ie mobile Internet) service.
- vetinari 7y ago
  A cellular phone is also a network terminal. A misbehaving device can cause unreasonable load on the network, a disruption to other users, or at least interruption of the service on your device. When Apple does screw up and iOS update will leave you with no data, the operators will attempt to make it work; they won't do that for every random manufacturer though.
- pbhjpbhj 7y ago
  Crunching the numbers, it was much much cheaper for me getting this phone on contract then any other route. I did look at buying a phone separately and having SIM-only or PAYGo. (UK, about 3 years ago, low-mid range). With 18 month contract I basically got a 'free' phone with 13MP camera. I actually use a SIM only by swapping sims with my wife whose phone we bought outright (but it's low end - camera and screen are poor).

paulcarroty 7y ago

> Google already fixed at least one of the Android exploits used by "Agent Smith, Google can't fix it due to Android fragmentation. Millions of devices will never get this update.

jammygit 7y ago

Question: my brother just got a used pixel 1 phone. Will it stop getting security updates soon/already?

elbrian 7y ago
I took 10 seconds to Google your question and found this link: https://support.google.com/nexus/answer/4457705?hl=en#pixel_phones https://support.google.com/nexus/answer/4457705?hl=en#pixel_...
cure 7y ago
Yes, looks like October 2019 is the end: https://support.google.com/nexus/answer/4457705?hl=en#pixel_phones https://support.google.com/nexus/answer/4457705?hl=en#pixel_...
- jammygit 7y ago
  What should he do if he finds out about a vulnerability then? Does he need a new phone?
  - brlewis 7y ago
    Yes, but not necessarily Oct 2019. My Nexus 5X is running Android 8.1.0 with security patch level: December 5, 2018, so it's likely Pixel will also get updates after the guaranteed dates.
  - Jonnax 7y ago
    He needs to weigh the risk versus the cost of a new phone. There is a custom firmware card LineageOS but it's a community effort. It may get up to date security updates merged in but it could be vulnerable in other ways.
_underfl0w_ 7y ago
FWIW, LineageOS has official nightlies for that phone now (typing this from one of those builds now, actually)

dan-0 7y ago

This seems to be getting a lot of attention, so as an Android Engineer with some security and framework experience let me try to explain. This is a side effect of Android's initial approach to it's open nature. Android allows a manufacturer to modify its framework for their own use case. Then the manufacturer can allow a specific carrier to input their own system applications and firmware on to the devices well (your bloatware etc). This can lead to multiple firmware variants for a specific device. It's not uncommon to see over 20 variants of a firmware for a specific Samsung device for example. This can be broken down by carrier, by region, by OS, etc.. for a number of different reasons. This becomes a problem when Android needs to post an update. That update has to be pushed first to the Android framework, then to the manufacturer who decides if they are going to make modifications for the update, and if the manufacturer decides to make an update, they push it to the carrier who then has to make an update themselves. This leads to a web with many broken ends, where a specific phone on one carrier may never see an OS upgrade after purchase, but on another carrier, the same phone might get them regularly. Additionally some manufacturers take a greater degree of liberty in modifying the Android framework, making updates significantly more expensive to implement, so they don't. The good news is Google over the past couple of years has been making a great effort under Project Trebel to simplify some of the APIs in the Android framework. What this is leading to is less friction when it comes to implementing core updates. Unfortunately not all manufacturers have opted in to adhering to the standards and Project Trebel yet. This is all in stark contrast to iOS, which doesn't have the restriction of dealing with multiple manufacturers, and makes it harder for carriers to customize the device for their own business cases. This makes security and updates easier to push, but on the cost to the user of being an expensive single stream walled garden. Nothing against iOS in the statement, as a flagship device they're very nice. However, they don't have the adaptability that Android allows, making them prohibitive in some markets. Sorry for any grammar issues, I'm on my phone (a regularly updated Pixel 3).

cstejerean 7y ago
This is what I love about Apple. They gave the carriers a big middle finger when it comes to the usual bullshit of bloatware, sticking their logos on things or getting in the middle of updates. That’s because they cared about the end user experience. Google was happy to just grab market share at the expense of the users by allowing carriers to continue with their usual shenanigans. For this reason Apple will have my eternal gratitude, because I remember what a shitshow smartphones (and deploying apps for them) was before Apple flexed their muscles on this.

GeekyBear 7y ago

From the start, Google cared enough about device makers potentially shipping a device running a fork of Android that they forbade doing so in their contracts with device makers. When it came to making sure consumers got timely software updates, Google sided with the device makers and carriers. Device makers wanted you to buy new hardware every couple of years, and carriers wanted to lock you into an additional two year contract. Google could have contractually required device makers and carriers to support end user devices after the sale, it just wasn't something they cared enough about.

ApolloFortyNine 7y ago
Google never forbid updating phones... They forbid forking Android.
- cma 7y ago
  That's what he said. They didn't forbid it, but they also didn't mandate it be allowed.
  - GeekyBear 7y ago
    In contrast, Apple did forbid carriers to block software updates in it's contracts with them. It's a matter of who you think your customers are. Google sides with advertisers, device makers, and carriers and not it's end users.
  - ApolloFortyNine 7y ago
    I fail to see the relevance of Samsung not updating their phones to Google not wanting Android to be forked. If Samsung had forked Android, they still wouldn't update old phones.

yeahitslikethat 7y ago

I'm still on android 5.0.1 because at&t won't allow me to update my phone unless I'm on their network as a customer. But they don't have service where I live so I can't.

pier25 7y ago

Which is why Pixel or Android One devices are the way to go.

wildduck 7y ago

Time to put some effort into this https://www.replicant.us https://www.replicant.us