4 ms·

What security issues am I facing by using a Note 5?

AnonC 6y ago
All the issues unpatched since Android 7 (which Wikipedia says is the latest version for Note 5). Your phone is about four major software releases behind from the current one. If your question is what harm you have suffered or would suffer, that’s like asking what’s happen if you didn’t wear seat belts for just one week or a month and still drive at high speeds. One can also make up other analogies related to safety.
- pavel_lishin 6y ago
  If we're going with the seatbelt analogy, the most recent update now requires me to use my car key to lock and unlock the seatbelt, and prevents me from using the radio when the seatbelt is engaged. And given that the dangers aren't comparable, I would love to just opt out and continue using my old, possibly less safe, seatbelts.
  - carschno 6y ago
    Note that your "seatbelts" are no longer safe to use after two years. If you refuse to buy a new car then, it's your fault if someone gets hurt!
    - pavel_lishin 6y ago
      I surely wish I could buy new seatbelts without also having that update break how my radio works, and prevent my windows from rolling down.
  - _jal 6y ago
    I hear you. There are systemic negative incentives. Bug fixes don't generate revenue, except in very indirect ways; making old hand sets annoying coerces hardware purchases. If you're a low-margin handset maker, that's a combination that suggests an obvious course of action.
spiffytech 6y ago
Android has had many kinds of security issues over the years leading to RCEs. The scariest issues are ones like the "Stagefright" vulnerability that let an attacker take over your device just by sending a malicious MMS, with no user interaction. That specific vulnerability is old and patched nearly everywhere, but there's zero reason to believe vulnerabilities just as disastrous and easy to exploit won't happen again, or that they won't affect a broad range of phone vintages, such as a range from before the Note 5 all the way to the Pixel 5, simultaneously. E.g., as best I can tell the Galaxy Note 5 stopped receiving updates around 2017, at Android v7. But in late 2019 a vulnerability was discovered allowing remote code execution of Android v7-v9 devices if an attacker can just get them to play a malicious video file. And since the Note 5 isn't receiving security patches, that'll be a threat every day forever until you upgrade. Think how many video files you see on social media, or video ads inside cheap apps you downloaded, or autoplaying videos online. Threat vectors are everywhere, and there's not a lot that classic "sensible online behavior" can do to protect you from this vulnerability. Living with a phone that no longer receives security patches is taking the non-negligible risk that someday your phone will start transmitting your sensitive keystrokes and screen content and you won't even know it until the bad guy uses them. It's tragic that Android phones are considered "good" when they provide three whole years of updates. Having spoken to an Android engineer about this I somewhat understand the legitimate technical/business drivers for that reality. But still, it's tragic that perfectly-good phones become a danger to users and incentivize otherwise-unnecessary upgrades because of their short update policies.
- BrianOnHN 6y ago
  > Think how many video files you see on social media, or video ads inside cheap apps you downloaded, or autoplaying videos online. There's not much I do outside the Chrome browser—no social media apps. I can count my downloaded apps on two hands.
  - spiffytech 6y ago
    Sure, but the video vulnerability is just the quickest RCE vuln I could find for the Galaxy Note 5. I'll bet if I go back to the Android CVE database I could find more vulnerabilities of various kinds that the Note 5 is susceptible to, and that we'll uncover more in the future. And looking at Stagefright, the way you use your phone is no guarantee that you can dodge vulnerabilities. It's up to you whether you are comfortable with the risk of running as unpatched phone. But a risk is very much present, and only using a couple of apps doesn't protect you from getting hacked and keylogged at the very least.

All the issues unpatched since Android 7 (which Wikipedia says is the latest version for Note 5). Your phone is about four major software releases behind from the current one. If your question is what harm you have suffered or would suffer, that’s like asking what’s happen if you didn’t wear seat belts for just one week or a month and still drive at high speeds. One can also make up other analogies related to safety.

pavel_lishin 6y ago
If we're going with the seatbelt analogy, the most recent update now requires me to use my car key to lock and unlock the seatbelt, and prevents me from using the radio when the seatbelt is engaged. And given that the dangers aren't comparable, I would love to just opt out and continue using my old, possibly less safe, seatbelts.
- carschno 6y ago
  Note that your "seatbelts" are no longer safe to use after two years. If you refuse to buy a new car then, it's your fault if someone gets hurt!
  - pavel_lishin 6y ago
    I surely wish I could buy new seatbelts without also having that update break how my radio works, and prevent my windows from rolling down.
- _jal 6y ago
  I hear you. There are systemic negative incentives. Bug fixes don't generate revenue, except in very indirect ways; making old hand sets annoying coerces hardware purchases. If you're a low-margin handset maker, that's a combination that suggests an obvious course of action.

spiffytech 6y ago

Android has had many kinds of security issues over the years leading to RCEs. The scariest issues are ones like the "Stagefright" vulnerability that let an attacker take over your device just by sending a malicious MMS, with no user interaction. That specific vulnerability is old and patched nearly everywhere, but there's zero reason to believe vulnerabilities just as disastrous and easy to exploit won't happen again, or that they won't affect a broad range of phone vintages, such as a range from before the Note 5 all the way to the Pixel 5, simultaneously. E.g., as best I can tell the Galaxy Note 5 stopped receiving updates around 2017, at Android v7. But in late 2019 a vulnerability was discovered allowing remote code execution of Android v7-v9 devices if an attacker can just get them to play a malicious video file. And since the Note 5 isn't receiving security patches, that'll be a threat every day forever until you upgrade. Think how many video files you see on social media, or video ads inside cheap apps you downloaded, or autoplaying videos online. Threat vectors are everywhere, and there's not a lot that classic "sensible online behavior" can do to protect you from this vulnerability. Living with a phone that no longer receives security patches is taking the non-negligible risk that someday your phone will start transmitting your sensitive keystrokes and screen content and you won't even know it until the bad guy uses them. It's tragic that Android phones are considered "good" when they provide three whole years of updates. Having spoken to an Android engineer about this I somewhat understand the legitimate technical/business drivers for that reality. But still, it's tragic that perfectly-good phones become a danger to users and incentivize otherwise-unnecessary upgrades because of their short update policies.

BrianOnHN 6y ago
> Think how many video files you see on social media, or video ads inside cheap apps you downloaded, or autoplaying videos online. There's not much I do outside the Chrome browser—no social media apps. I can count my downloaded apps on two hands.
- spiffytech 6y ago
  Sure, but the video vulnerability is just the quickest RCE vuln I could find for the Galaxy Note 5. I'll bet if I go back to the Android CVE database I could find more vulnerabilities of various kinds that the Note 5 is susceptible to, and that we'll uncover more in the future. And looking at Stagefright, the way you use your phone is no guarantee that you can dodge vulnerabilities. It's up to you whether you are comfortable with the risk of running as unpatched phone. But a risk is very much present, and only using a couple of apps doesn't protect you from getting hacked and keylogged at the very least.