5 ms·

Why Google won't fix a security bug in almost a billion Android phones

51 points by moe 12y ago

zues 12y ago
A more detailed response is here: https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF https://plus.google.com/117193854832907724231/posts/1md7ruEw...
- fidotron 12y ago
  That's no so much a response as a wall-of-text that attempts to deflect any responsibility from Google at all. Given that they are so keen on pointing out the weaknesses of others in exactly this area they really need to make sure their own shit is together much better.
- ryanhuff 12y ago
  Sheez. So when the broken code in question is over 2 years old, and is hard to fix, then Google just washed their hands of it? Google is a big company with substantial resources. How about they support their customers beyond the "new and shiny period" like many, many other companies do?
  - deleted 12y ago
    [deleted]
  - divegeek 12y ago
    Google could invest the resources to create patches. What Google can't do is get those patches delivered to end-user devices. Given the fact that if Google provided patches they'd never reach users anyway, why should Google bother? And we know that OEMs won't provide updates because they are already refusing to provide the one that has existed for some time now: Android 4.4. (Disclaimer: I'm a Google employee, and I work on Android security, but I'm not a spokesperson and these are only my own opinions.)
    - anon1385 12y ago
      >What Google can't do is get those patches delivered to end-user devices. Apple manage to do it. Google made a conscious decision to trade off allowing end users to keep up to date with achieving faster adoption of Android among OEMs and carriers. You can't now pretend that the results of those decisions are some kind of inevitability. It was Google's choice, and they are responsible for the result. >And we know that OEMs won't provide updates because they are already refusing to provide the one that has existed for some time now: Android 4.4. Yes, OEMs like Google themselves…
      - divegeek 12y ago
        Apple makes all of its devices and therefore controls them. Google can't dictate to Samsung, HTC, LG, etc. Google has updated the in-support Nexus devices. The Galaxy Nexus is something of a question mark, but the number of active Galaxy Nexus devices is tiny. It would make more sense for Google to offer GNex users a new device than to upgrade the few remaining GNex's to 4.4.
Zigurd 12y ago
Is it that PR people are pushing this story, or that the clickbait potential of the headline is irresistible? The fact is that Android 4.0+ can use Chrome, which doesn't have this bug. That's 85%+ of the installed base. This is an uncontroversial as any of the other bugs recently closed as NTBF.
- mccr8 12y ago
  That doesn't help with apps that use WebView to render web content.
- guelo 12y ago
  WebView is embedded in many apps so using Chrome, or Firefox, won't help.
  - divegeek 12y ago
    Correct. At present the only solution for pre-4.4 devices is to avoid using WebView to display untrusted content. If you're an app developer using WebView you should make sure it's only displaying trusted content which means either local content or remote content from trusted sites with non-broken SSL. I recommend using Google's recently-released nogotofail toolkit to test for SSL breakage (https://github.com/google/nogotofail https://github.com/google/nogotofail). The ideal fix for this problem is for OEMs to update devices to 4.4.
- ryanhuff 12y ago
  I suspect that your average Android user has no idea about the browser on their phone. These are the users who are most at risk. Also, correct me if I am wrong, but app-based webviews (or app actions that spawn a browser instance) would defer to the default browser, ignoring any installed 3rd party browser. So i believe that the "install chrome" solution does not actually resolve the problem.
  - irremediable 12y ago
    > Also, correct me if I am wrong, but app-based webviews (or app actions that spawn a browser instance) would defer to the default browser [...] I think that is wrong, based on my phone's behaviour. Still with you, though; neglecting to fix this leaves the most vulnerable users open to attack.
Yver 12y ago
Here's an excerpt from the article. The very first words of the article: > A day after Google publicized a flaw in Windows 8.1 before Microsoft could do anything about it, [...] I stopped reading after this, for obvious reasons.
- nhayden 12y ago
  That's some biased journalism there, shameful for engadget.
PhasmaFelis 12y ago
Given that the bug in Android 4.3 was fixed in Android 4.4, which AFAIK is available to all manufacturers, how much blame should accrue to the manufacturers for being chronically months or years late in pushing out version updates? I can see arguments both ways.
- nhayden 12y ago
  I don't think they're late, I think they choose to stop sending updates to devices. The obvious reason is they want people to buy new devices (i.e. renew 2 year contracts).
  - PhasmaFelis 12y ago
    It's both, really. They stop producing updates entirely after a year or two to deliberately cripple old machines, and when they do send updates they are often many months late.
krschultz 12y ago
The fact is that Google has fixed the bug. The fix is in Android 4.4. From Google's perspective, the onus is on manufacturers to then ship Android 4.4 to the end users. In retrospect it was a poor assumption on Google's part to think that these manufacturers were actually going to support their customers. That is why they have spend the last 2+ years re-architecting the system to shove a bunch of functionality into things that Google can update or libraries that developers can incorporate into their apps. I imagine when they started out, they did not intend to have a huge amount of the system in a support library that is packaged inside every single app. I bet they also didn't intend to have the bulk of new features be in the Google Play Services package. Yet here we are, largely because the manufacturers are much like PC makers in that they put their own interests far ahead of the ecosystem interests.
- ryanhuff 12y ago
  My immediate question is whether requiring an upgrade to 4.4 is substantially more difficult for the manufacturers and carriers to make it work with the affected hardware. That seems like a much messier job than just patching WebKit.
- ldng 12y ago
  Was it poor assumption on my part that what was once opensource in the baseline OS would stay open even after being extracted into "library" apks ? What I mean here is that Google's move here is far from being only a support matter.
- drewg123 12y ago
  The problem is that even GOOGLE does not support their customers on the Nexus line. I have, in my drawer, an otherwise perfectly good Galaxy Nexus that is stuck running 4.3 because Google cannot be bothered to update it to 4.4. If Google will not update its own Nexus hardware to 4.4, how can anybody reasonably blame other hardware vendors for behaving the same way?
  - achernya 12y ago
    I'm not sure it's reasonable to expect Google to update a device to the latest version when the hardware manufacturer has exited the market -- http://www.cnet.com/news/google-to-samsung-galaxy-nexus-owners-no-kitkat-for-you/ http://www.cnet.com/news/google-to-samsung-galaxy-nexus-owne.... While Google does control Android, that's not the only software that is present on the phone. Short of the Nexus series starting to have open source baseband and radio firmware, we'll be at the mercy of hardware manufacturers.
on_and_off 12y ago
I am not sure whether Google should develop a fix or not for these devices. Version 4.4 does not have this issue, so the obvious solution would be to update the system. In the real world, android updates are not .. ubiquitous though, not to mention that after some time, all OEMs stop updating their terminals (that also includes security patches though ...). Google has solved webview/browser bugs in 5.0 by having auto-updates during the activation and a chromium based webview which is update through the webstore but there are surely bugs that can't be solved that way or through Play Services. The absence of 'forced' upgrades was probably a very good idea in order to popularize Android among OEMs but it seems to me that Google should start thinking about a way to make Android easy to update. In that context, I would not be against reduced customization possibilities. Especially since the need for OEMs to differentiate themselves often lead to UIs with very discutable choices compared to stock Android (cough Samsung cough). Most skins brought large improvements over stock in the 1.x 2.x era, nowadays it is far more debatable.
- fidotron 12y ago
  The problem is Google are abusing their position once the customization capability is removed. For example, they were done for using Google Street View cars to slurp WiFi information, so now they just use Android devices to do it for them. Manufacturers have to have this enabled by default if they want Gmail and the Play Store on the device. (EDIT: and even worse, if you agree to that for one device you have to agree to not release any Android devices which do not have those things, thus removing the ability for the market to decide). When people, rightly, complain about the Facebook app having permission to do way more than it should they seem to be oblivious to the fact Google are doing things which are far worse.
  - Oletros 12y ago
    > For example, they were done for using Google Street View cars to slurp WiFi information, so now they just use Android devices to do it for them. What? Street View problems were not about slurping SSID, MAC and geolocaction from wifi's, but because of capturing snippets of broadcasted data. They still use Google Street cars to geolocate wifi's. > Manufacturers have to have this enabled by default if they want Gmail and the Play Store on the device. Source for that? > and even worse, if you agree to that for one device you have to agree to not release any Android devices which do not have those things, thus removing the ability for the market to decide Source for that?
deleted 12y ago
[deleted]
chisleu 12y ago
"Google statues on Google's Mountain View campus. A day after Google publicized a flaw in Windows 8.1 before Microsoft could do anything about it" Biased article from line 1. I want to like Microsoft. I really do. This kind of "journalism" isn't doing them any favors in that regard.

51 points by moe 12y ago

zues 12y ago

A more detailed response is here: https://plus.google.com/117193854832907724231/posts/1md7ruEwBLF https://plus.google.com/117193854832907724231/posts/1md7ruEw...

fidotron 12y ago
That's no so much a response as a wall-of-text that attempts to deflect any responsibility from Google at all. Given that they are so keen on pointing out the weaknesses of others in exactly this area they really need to make sure their own shit is together much better.
ryanhuff 12y ago
Sheez. So when the broken code in question is over 2 years old, and is hard to fix, then Google just washed their hands of it? Google is a big company with substantial resources. How about they support their customers beyond the "new and shiny period" like many, many other companies do?
- deleted 12y ago
  [deleted]
- divegeek 12y ago
  Google could invest the resources to create patches. What Google can't do is get those patches delivered to end-user devices. Given the fact that if Google provided patches they'd never reach users anyway, why should Google bother? And we know that OEMs won't provide updates because they are already refusing to provide the one that has existed for some time now: Android 4.4. (Disclaimer: I'm a Google employee, and I work on Android security, but I'm not a spokesperson and these are only my own opinions.)
  - anon1385 12y ago
    >What Google can't do is get those patches delivered to end-user devices. Apple manage to do it. Google made a conscious decision to trade off allowing end users to keep up to date with achieving faster adoption of Android among OEMs and carriers. You can't now pretend that the results of those decisions are some kind of inevitability. It was Google's choice, and they are responsible for the result. >And we know that OEMs won't provide updates because they are already refusing to provide the one that has existed for some time now: Android 4.4. Yes, OEMs like Google themselves…
    - divegeek 12y ago
      Apple makes all of its devices and therefore controls them. Google can't dictate to Samsung, HTC, LG, etc. Google has updated the in-support Nexus devices. The Galaxy Nexus is something of a question mark, but the number of active Galaxy Nexus devices is tiny. It would make more sense for Google to offer GNex users a new device than to upgrade the few remaining GNex's to 4.4.

Zigurd 12y ago

Is it that PR people are pushing this story, or that the clickbait potential of the headline is irresistible? The fact is that Android 4.0+ can use Chrome, which doesn't have this bug. That's 85%+ of the installed base. This is an uncontroversial as any of the other bugs recently closed as NTBF.

mccr8 12y ago
That doesn't help with apps that use WebView to render web content.
guelo 12y ago
WebView is embedded in many apps so using Chrome, or Firefox, won't help.
- divegeek 12y ago
  Correct. At present the only solution for pre-4.4 devices is to avoid using WebView to display untrusted content. If you're an app developer using WebView you should make sure it's only displaying trusted content which means either local content or remote content from trusted sites with non-broken SSL. I recommend using Google's recently-released nogotofail toolkit to test for SSL breakage (https://github.com/google/nogotofail https://github.com/google/nogotofail). The ideal fix for this problem is for OEMs to update devices to 4.4.
ryanhuff 12y ago
I suspect that your average Android user has no idea about the browser on their phone. These are the users who are most at risk. Also, correct me if I am wrong, but app-based webviews (or app actions that spawn a browser instance) would defer to the default browser, ignoring any installed 3rd party browser. So i believe that the "install chrome" solution does not actually resolve the problem.
- irremediable 12y ago
  > Also, correct me if I am wrong, but app-based webviews (or app actions that spawn a browser instance) would defer to the default browser [...] I think that is wrong, based on my phone's behaviour. Still with you, though; neglecting to fix this leaves the most vulnerable users open to attack.

Yver 12y ago

Here's an excerpt from the article. The very first words of the article: > A day after Google publicized a flaw in Windows 8.1 before Microsoft could do anything about it, [...] I stopped reading after this, for obvious reasons.

nhayden 12y ago
That's some biased journalism there, shameful for engadget.

PhasmaFelis 12y ago

Given that the bug in Android 4.3 was fixed in Android 4.4, which AFAIK is available to all manufacturers, how much blame should accrue to the manufacturers for being chronically months or years late in pushing out version updates? I can see arguments both ways.

nhayden 12y ago
I don't think they're late, I think they choose to stop sending updates to devices. The obvious reason is they want people to buy new devices (i.e. renew 2 year contracts).
- PhasmaFelis 12y ago
  It's both, really. They stop producing updates entirely after a year or two to deliberately cripple old machines, and when they do send updates they are often many months late.

krschultz 12y ago

The fact is that Google has fixed the bug. The fix is in Android 4.4. From Google's perspective, the onus is on manufacturers to then ship Android 4.4 to the end users. In retrospect it was a poor assumption on Google's part to think that these manufacturers were actually going to support their customers. That is why they have spend the last 2+ years re-architecting the system to shove a bunch of functionality into things that Google can update or libraries that developers can incorporate into their apps. I imagine when they started out, they did not intend to have a huge amount of the system in a support library that is packaged inside every single app. I bet they also didn't intend to have the bulk of new features be in the Google Play Services package. Yet here we are, largely because the manufacturers are much like PC makers in that they put their own interests far ahead of the ecosystem interests.

ryanhuff 12y ago
My immediate question is whether requiring an upgrade to 4.4 is substantially more difficult for the manufacturers and carriers to make it work with the affected hardware. That seems like a much messier job than just patching WebKit.
ldng 12y ago
Was it poor assumption on my part that what was once opensource in the baseline OS would stay open even after being extracted into "library" apks ? What I mean here is that Google's move here is far from being only a support matter.
drewg123 12y ago
The problem is that even GOOGLE does not support their customers on the Nexus line. I have, in my drawer, an otherwise perfectly good Galaxy Nexus that is stuck running 4.3 because Google cannot be bothered to update it to 4.4. If Google will not update its own Nexus hardware to 4.4, how can anybody reasonably blame other hardware vendors for behaving the same way?
- achernya 12y ago
  I'm not sure it's reasonable to expect Google to update a device to the latest version when the hardware manufacturer has exited the market -- http://www.cnet.com/news/google-to-samsung-galaxy-nexus-owners-no-kitkat-for-you/ http://www.cnet.com/news/google-to-samsung-galaxy-nexus-owne.... While Google does control Android, that's not the only software that is present on the phone. Short of the Nexus series starting to have open source baseband and radio firmware, we'll be at the mercy of hardware manufacturers.

on_and_off 12y ago

I am not sure whether Google should develop a fix or not for these devices. Version 4.4 does not have this issue, so the obvious solution would be to update the system. In the real world, android updates are not .. ubiquitous though, not to mention that after some time, all OEMs stop updating their terminals (that also includes security patches though ...). Google has solved webview/browser bugs in 5.0 by having auto-updates during the activation and a chromium based webview which is update through the webstore but there are surely bugs that can't be solved that way or through Play Services. The absence of 'forced' upgrades was probably a very good idea in order to popularize Android among OEMs but it seems to me that Google should start thinking about a way to make Android easy to update. In that context, I would not be against reduced customization possibilities. Especially since the need for OEMs to differentiate themselves often lead to UIs with very discutable choices compared to stock Android (cough Samsung cough). Most skins brought large improvements over stock in the 1.x 2.x era, nowadays it is far more debatable.

fidotron 12y ago
The problem is Google are abusing their position once the customization capability is removed. For example, they were done for using Google Street View cars to slurp WiFi information, so now they just use Android devices to do it for them. Manufacturers have to have this enabled by default if they want Gmail and the Play Store on the device. (EDIT: and even worse, if you agree to that for one device you have to agree to not release any Android devices which do not have those things, thus removing the ability for the market to decide). When people, rightly, complain about the Facebook app having permission to do way more than it should they seem to be oblivious to the fact Google are doing things which are far worse.
- Oletros 12y ago
  > For example, they were done for using Google Street View cars to slurp WiFi information, so now they just use Android devices to do it for them. What? Street View problems were not about slurping SSID, MAC and geolocaction from wifi's, but because of capturing snippets of broadcasted data. They still use Google Street cars to geolocate wifi's. > Manufacturers have to have this enabled by default if they want Gmail and the Play Store on the device. Source for that? > and even worse, if you agree to that for one device you have to agree to not release any Android devices which do not have those things, thus removing the ability for the market to decide Source for that?

deleted 12y ago

[deleted]

chisleu 12y ago

"Google statues on Google's Mountain View campus. A day after Google publicized a flaw in Windows 8.1 before Microsoft could do anything about it" Biased article from line 1. I want to like Microsoft. I really do. This kind of "journalism" isn't doing them any favors in that regard.