71 Percent of Android Phones On Major US Carriers Have Out of Date Security Patches (betanews.com) 103
Ian Barker, writing for BetaNews: Slow patching of security flaws is leaving many US mobile users at risk of falling victim to data breaches according to the findings of a new report. The study from mobile defense specialist Skycure analyzed patch updates among the five leading wireless carriers in the US and finds that 71 percent of mobile devices still run on security patches more than two months old. This is despite Google releasing Android patches every month, indeed six percent of devices are running patches that are six or more months old. Without the most updated patches, these devices are susceptible to attacks, including rapidly rising network attacks and new malware, also detailed in the report.
Only 71%??? (Score:2, Insightful)
I find it hard to believe that 29% of android devices have ALL the available security patches installed and are running a current version.
Re: (Score:1)
Re: (Score:3)
Those are probably owned by iPhone users.
The 29% of Android devices with all security patches are iPhone users? Okay...
Re: (Score:2)
The 29% of Android devices with all security patches are iPhone users? Okay...
How else would you explain this discrepancy?
Some of my patches are years old (Score:1)
What, am I supposed to buy a new phone every year to keep up?
Re: (Score:2)
Re: (Score:2)
If I were cynical, I would say that's exactly why the phone manufacturers hardly ever release updates.
Am I cynical?
I'm in the 29% (Score:2)
My 3 year old android phone is fully up to date, software wise anyway.... I don't care if the other 71% want to go unprotected....
Re: (Score:2, Interesting)
I've never had bad guys or bad software infect my phone but I'm pretty sure that each "update" from google grabs more and more of my personal data and sells it to the highest bidder. Exactly who/what are these updates protecting us from?
Re:I'm in the 29% (Score:5, Insightful)
By "up to date", do you mean that you have the latest firmware installed, or that the firmware that is installed has all the security fixes to Android that Google has issued?
IOW, are you sure your phone hasn't been orphaned?
Re: I'm in the 29% (Score:3)
Re: (Score:2)
A while ago, both my son and I had the same model of Samsung phone. When the phones were about 4 years old, my phone got an OTA update, but my son's phone did not.
The difference? I had downloaded and installed an update that was only available via Kies. It was never pushed as an OTA update.
Re: (Score:1)
Like it or not, it's one of the better aspects of iPhones, so long as it's still supported/supportable apple will try to get you hooked up with an update. Now, that being said, not all updates fix more pr
I am very skeptical. (Score:2)
Re:I am very skeptical. (Score:4, Interesting)
I highly doubt that 29% of Androids are up to date.
This is just major carriers. Imagine how many unpatched Androids are out there on Boost, Cricket, Tracfone, etc. My wife has an Android on Tracfone and never had a security update notification.
Re:I am very skeptical. (Score:4, Interesting)
I highly doubt that 29% of Androids are up to date.
Keep in mind that the security patch level field was added in Android Marshmallow (IIRC), and I expect that's what they're using to determine patch date. If so, KitKat and Lollipop devices aren't counted, and this really says that 29% of Android devices that are new enough to have Marshmallow or Nougat are up to date. That's not surprising, though it's obviously still far too low.
Unless, of course, the report assumes that anything running Lollipop or older is not recently patched, which seems like a reasonable assumption.
Re: (Score:2)
Just the fact that you use those silly google names to indicate android version shows how far up the posterior of google you are. So sad. Just refer to android versions by number so we can understand.
You're crazy, basically no one knows the numbers. Look at all the discussions in the press, ask around to people (among people who even know that there are different versions of Android). Everyone who knows anything about Android releases knows the dessert names. The numbers are enthusiast-only trivia.
Re: (Score:2)
Unless, of course, the report assumes that anything running Lollipop or older is not recently patched, which seems like a reasonable assumption.
According to Google [android.com], 65.9% of users are on Lollipop or older. That means 29% of up-to-date Androids would have to come from 34.1% of users, or that 85% of Marshmallow and Nougat users are fully patched. I'm skeptical.
Also, nearly half of Android users are using an OS at least 2.5 years old. :-/ Compare with 79% of iOS users on a 6 month old OS [apple.com], and 95% of iOS users on an OS less than 1.5 years old.
Re: (Score:1)
Re: (Score:2)
That means 29% of up-to-date Androids would have to come from 34.1% of users, or that 85% of Marshmallow and Nougat users are fully patched. I'm skeptical.
You're assuming that the statistics don't simply exclude phones without the field.
Re: (Score:2)
Android security, iPhone security, whatever... (Score:2)
A strange game. The only winning move is not to play. How about a nice game of chess?
I get no updates from my carrier (Score:5, Informative)
I have a Galaxy S4 on AT&T. I just checked, and it's at Lollipop 5.01 and says its "Android security patch level" is 2015-11-01. Nevertheless, when I push the software update button, AT&T assures me that my current software is up to date. Apparently, 5.01 is the latest version available for an S4, but what about security patches? Are they just done making them? Was AT&T planning on telling me that?
I guess I'm a bad consumer, using a four year old phone.
Re: I get no updates from my carrier (Score:2, Insightful)
Who the fuck should supply the updates then? Apple did it right, you either let us update the phones or fuck off. Too bad google and all the other android creators don't have a god damn spine.
Re: (Score:2)
The phone companies obviously have no reason to do this, since if you're truly concerned about having a newer version, your only recourse is to buy a new phone. And Company X may hope that you buy it from Company X again.
In the PC world, it's Microsoft who releases the updates, and those updates by and large work on everyone's PC regardless of who made its components. (Yes, there are occasional driver issues, although in my decades of owning a PC, I personally don't think I've ever had a Microsoft update
Re: (Score:1)
Regardless of who is responsible for making that functionality work, in the end it DOES go back to the carrier who is selling the POS, because the OS is tweaked to their specifications to be on their network, often times including how it is patched/updated.
Re: (Score:2)
It would be just like that if the electric company edited the microwave manual so that the Microwave Repair Hotline rang up the electric company. The telecommunication companies inserted themselves in the middle of the update process, so they need to either issue/approve updates or remove themselves from that role.
Re: (Score:2)
Re: (Score:2)
I'm still using my original battery for this one. It will last about 2.5 days of low usage, or 1 day of heavy usage. This is my paradox for buying a new phone... I like having a battery I can swap, but in practice I haven't actually swapped it (at least on this one). Also, you have to figure out where you can buy a battery that isn't a counterfeit that craps out almost immediately. My girlfriend's battery got old and we swapped that one, and then her whole phone failed six months later, so that was poin
Re: (Score:2)
Did your brother-in-law run the phone down to 0% a lot?
Li-ion batteries can only fully discharge and recharge a limited number of times, and their lifetimes are hugely affected by how much you run them down before charging. So they might only advertise 1000 charge cycles, but that's for a full (or mostly full) discharge. But if you recharge every time it hits 50%, you could get an order of magnitude more cycles out of it.
Bottom line: don't run your phone's battery down.
Also, it's good to get a phone with
Re: (Score:2)
Which of course is the opposite of what people used to be told to do with NiCd batteries. I wonder how many people are still in that mindset (it was a revelation to me when I first heard this about Li batteries).
Re: (Score:1)
If you were on T-Mobile you would still be running S4 on v.4.x. (personal experience).
Re: No Shit (Score:2)
Why is it the carrier's responsibility to patch someone else's handset? The device manufacturers should be making the patches and distributing them via the fucking internet. Let the carrier's be a dumb pipe - it's what they are best at. And if the device manufacturers don't patch their shit, don't buy their shit and go with someone who does.
I've never understood why people think that AT&T or Verizon should be writing and distributing patches for the thousands of shitty phones they sell - Best Buy doe
Re: (Score:1)
Ha! My current cell phone is 7yrs old (Score:1)
It's running android version 2.2.1! I feel as though I wont be the only one
Flaw of the Android Ecosystem (Score:5, Insightful)
Re: (Score:2)
Re:Flaw of the Android Ecosystem (Score:4, Insightful)
There is a lot of blame to go around.
For Google's part, they need to put more pressure on the carriers. Same with the handset manufacturers.
Apple has managed to exert enough pressure on the carriers to be allowed to issue updates directly without the carrier as middleman.
Obviously there are some political issues at play - carriers would rather have more control, but I think a company like Samsung or Google has enough leverage at this point. It seems they don't want to make waves.
Re: (Score:2)
Hardly. Even if an OEM allows you to unlock the bootloader on a non-carrier-specific phone, and you apply a non-OEM blessed ROM - you will be lucky if the phone still boots without issue. Let alone having WIFI, Cell Radios or the Camera still work normally.
Which would not be the case if the AOSP part of the Android OS was separate from OEM hack-job customizations, as you could then apply most any Android security update which would primarily only need to revise existing AOSP files within major Android revis
Re: (Score:2)
Only because the ARM platform sucks and most of them are not officially supported in the kernel.
Google could simply say to them: If you want to have your ARM SOC used in an android phone? Well work with the linux kernel devs for get it in there.
Re: (Score:2)
I suppose you would blame the road you were on for your car falling apart around you?
Lousy carriers are as common as lousy roads, which is why products should take them into account and deal with the problems they cause. If they fail to do so, then sure, the bad road/carrier shares some of the blame, but the product's design owns the lion's share of the blame.
P.S. This is NOT a backhanded way of saying iOS has it right. This is about tradeoffs. Google suffers in this area of their design to gain in other ar
Re: (Score:2)
If you can't see that Apple has a superior update model [...]
You must've stopped reading my post, because I said they were ahead in this area. The reason I said neither was necessarily right was because they both comes with tradeoffs. There's no doubt that Apple's updates are far better, but what about their prices? Variety of hardware? Features that cater to niches? By maintaining such tight control, they sacrifice benefits in those other areas.
And, just so you know, if I've drunk any Kool-Aid, it's Apple's. I own zero Android devices. I own dozens of Apple devices,
Re:Flaw of the Android Ecosystem (Score:4, Insightful)
If it were entirely a carrier issue, than unbranded GSM/UMTS/LTE phones would have been patched more often and longer, as would have Wi-Fi-only tablets.
No Incentive (Score:1)
Or rather, every incentive NOT to push security updates to phones. Just as they had every incentive to allow the act called Slamming, where you would get charged for a service you never agreed to, and the phone company got their cut of the transaction. In this case, their answer to securing your phone is that you should buy a new phone, up to date, with all the bells and whistles, a flagship model even! And they get their profit off adding on services to take full advantage of that new shiny plus profit fro
Blackberry (Score:1)
This is why I love Blackberry. While its Android phones have their quirks, Blackberry is ACTUALLY delivering routine security updates, almost as fast as Google itself does.
I still mourn the death of BB OS10 which was a great phone operating system. They lost the "app store" wars, but it was a great OS.
I chose to continue with Blackberry when I made the switch to Android for exactly this reason.
Re: (Score:2)
Because Manufacturers Suck (Score:5, Insightful)
Re: (Score:1)
Blackberry cares... at least as a business model.
My PRIV has had *monthly* updates. That's the best I've heard of.
My phone is basically ASOP, with some added security and Blackberry calender, etc.
Overall.. not bad. Lots will badmouth BB, but they've come far now that they're pure android.
Re:Because Manufacturers Suck (Score:5, Insightful)
Microsoft, Apple and Linux distros, that is, the majority of the the OS vendors, manage to provide a mechanism to keep your system up to date independently of the hardware vendors and other "third parties". This support even extends to multiple architectures in some cases: x86 is the most common, but ARM is also becoming common (on Linux, you have even more: POWER, MIPS, etc).
Can you imagine having to wait for, say, Dell to OK to every package for your next "apt-get update"? Or for Toshiba to give Microsoft the OK for them to make an OS update available to you?
No, you can't. But this is the situation we have with Google. And people accept this for some reason. They even excuse it in Google's behalf, because they are so great (despite not being able to do what a bunch of "freeloading" "amateurs" can do on a shoe-string budget).
There is no reason why operating system and user space upgrades need to be tied to the manufacturer. None.
This situation is Google's fault and no one else's.
Re: (Score:3, Informative)
There is no reason why operating system and user space upgrades need to be tied to the manufacturer. None.
This situation is Google's fault and no one else's.
You have no idea how Android, the Linux kernel, or open source software works. I guess that's why you're hiding behind AC.
Each manufacturer is akin to a different distro of Linux. You in fact do have to wait for Fedora or Ubuntu to update their packages before you can apt-get them. You don't get them immediately. Nobody can force them to hurry up. Not Google, not you. They control the keys to apt-get.
This is because Fedora/Ubuntu/etc can modify the kernel source and the source of any package that goes into
Re: (Score:2, Insightful)
Then it shouldn't be allowed to be called Android. It should be Moto Mobile Linux or Samsung Lazerbeam Linux some shit. If google allows them to call their distro Android, it's googles fault.
Re: (Score:2)
That is not the same at all, Google make Android they can set their demands. ...
I can use Fedora or Ubuntu and will have to wait when the distro makes an update available, BUT i will get it when it has been made available NOT depending if it runs on a pc from HP, DELL, ASUS, ACER,
Re: (Score:2)
Can you imagine having to wait for, say, Dell to OK to every package for your next "apt-get update"?
Except Dell will do just this if the update has anything to do with hardware, and in most server environments a lot of it does. I've done the dosey doe with Dell on their server platforms with drivers, debating whether my problems are due to the vendor-supplied drivers sucking or whether the Dell-provided drivers six months behind the OEM vendor are at fault.
I think the problem carriers worry about is unapproved software that effects their networks. My guess is this is pretty remote in reality. but shikat
Re: (Score:2)
I think the problem carriers worry about is unapproved software that effects their networks.
WE HAVE A WINNER!!
Re: (Score:2)
Re: (Score:2)
I've got a Motorola Droid Turbo (came out October, 2014).
Android 6 released in October, 2015.
Update available: January 5, 2016.
Thanks, Verizon. Never again.
Re: (Score:2)
Correction. Update available Jauary 5th, 2017.
Dammit!
Too much hassle (Score:1)
I used to own an Android phone and when i had it my carrier did provide updates. The problem was, there weren't just security updates, I had to upgrade to new versions of Android. There was no 4.4.1, it was jump from 4.4 to 5.0 or nothing. Since each version of Android moves things around, some new versions break old apps and there were battery/performance regressions when I tested 5.0 on another phone, I just decided to keep my main phone running the older version of Android. Getting hacked was less of a c
Not the only problem unfortunately (Score:5, Interesting)
Android has a lot more problems [altervista.org] than you think and Google does nothing to solve it.
We need a standard ARM platform, just like we've had the x86 platform since roughly 1981. And Google has all the resources to create and enforce it. And since they don't I wonder if they are malicious or negligent or it's just part of their business plan which is called "planned obsolesce". Too bad, in Google's case this obsolesce involves even original Google devices like Nexus 5 (stopped receiving any updates since October 2016) and it will soon be joined by Nexus 6.
That's just horrible.
Android apps will soon be supported on Chrome OS (Score:1)
Android is the real problem. (Score:1)
Android devices are the worse, as much as I like them... Carriers lock them down, refuse to work/pay for the upgrades with the manufacturer (Sony/T-Mobile Z3+ was the prime example).
Don't blame the users (Score:4, Interesting)
I mostly blame carriers (Score:5, Insightful)
Too many crap apps (Score:1)
If I could remove all the crap apps they make me have (yes you too Google, not just V*******), I'd have an up to date phone.
Mine is one of them (Score:4, Informative)
Mine is one of them, but it sure as shit isn't my fault.
If my carrier would provide updates I'd install them. If I could get patches I'd install them.
Don't blame me for not buying a new phone every 3 months.
Conflict of Interest (Score:2)
Kids Panic for the Next New Phone Each Year (Score:1)
Obligatory: Windows Movile (Score:2)
Sure the app situation sucks - if you want them. But the Tiled UI is far superior to the mess that is Android and it is actively updated. If you just want a secure phone with a great camera and text/mail/web and some basic apps, Windows Mobile is the way to go.
Developing for it is pretty easy to.
Maybe if I could still root my phone... (Score:2)
Since Google and the carriers record everything I do and are willing to sell it to anyone with a big enough pocketbook, it's hard to say I'm "protected" by having an up to date phone. My only real hope is to never patch and hope to root it some day so that I can actually protect it myself.