Fragmentation Leads To Android Insecurities 318
Rick Zeman writes "The Washington Post writes about how vendor fragmentation leads to security vulnerabilities and other exploits. This situation is '...making the world's most popular mobile operating system more vulnerable than its rivals to hackers, scam artists and a growing universe of malicious software' unlike Apple's iOS which they note has widely available updates several times a year. In light of many companies' Bring Your Own Device initiatives 'You have potentially millions of Androids making their way into the work space, accessing confidential documents,' said Christopher Soghoian, a former Federal Trade Commission technology expert who now works for the American Civil Liberties Union. 'It's like a really dry forest, and it's just waiting for a match.'"
Or... (Score:5, Insightful)
I remember... (Score:5, Insightful)
Not so long ago niche platforms and disparate architectures were slated to be good BECAUSE they were so diverse it wasn't worth the time to hack them individually...
I also remember a time not so long ago that Microsofties used to complain that the frequency and ease of attacks on public sites was due to their dominance and being a big target. I wonder what Linux admins say now, since they now dominate the data centre?
Not vendor fragmentation (Score:5, Insightful)
The problem isn't vendor fragmentation. The problem is vendor laziness. If you produce an Android device there is no legitimate why you can't provide regular updates.
I blame the SoC vendors and Google (Score:5, Insightful)
If there was either a common hardware platform, like on the PC, where every PC is essentially compatible with every other PC, you could easily update your operating system without the manufacturer of the hardware.
However SoC vendors don't want that, since it would mean that a device maker could easily switch from one SoC to another one. Plus they still use undocumented proprietary hardware in those SoCs, that's why you have binary device driver blobs which are hard to port.
The other problem lies within Google. They should have mandated some sort of "BIOS" which would have allowed any operating system to see what kind of hardware there is. This wouldn't have been more than a few hundred bytes in the flash containing the bootloader. That way you could have a generic operating system image, which would read out that ROM and execute routines found in it to use the hardware and then, perhaps at a later stage, use specialized drivers... just like it's done on the PC.
The sort of fragmentation we currently have in the Android market is simply bad, but a logical consequence from bundling hardware with the operating system. I just hope that one day the Chinese will wake up, and design a common hardware platform allowing the user to boot its own operating system from the SD-card, and even move it from device to device.
Re:I remember... (Score:5, Insightful)
Not so long ago niche platforms and disparate architectures were slated to be good BECAUSE they were so diverse it wasn't worth the time to hack them individually...
I also remember a time not so long ago that Microsofties used to complain that the frequency and ease of attacks on public sites was due to their dominance and being a big target. I wonder what Linux admins say now, since they now dominate the data centre?
But these are not niche platforms or disparate architectures. They are all compatible from the point of view of applications and malware. It is just the customization and vendor disinterest that prevents updates. It is as if Dell, Lenovo, HP, etc added their crapware so deeply into the Windows infrasture that Microsoft's security updates could not be applied and the vendors were not interested in creating or distributing adapted versions.
Fragmentation (Score:4, Insightful)
Trying to argue about fragmentation with people attacking Android is a losing battle. "Fragmentation" means there's too many different hardware form-factors. No, it means too many vendor-specific UIs. No, it means that we need to support multiple OS versions. No, it means that we can't guarantee what security patches have been applied.
Bah, from where I'm sitting, "fragmentation" means nothing more than "I don't like it" - a way of disparaging choice from those who don't want it.
Or... (Score:4, Insightful)
You get one exploit that works against Android Gingerbread, and you've got one that works for 2+ years against the still most popular version, by a large margin.
Fragmentation is not to blame (Score:5, Insightful)
Linux has huge diversity among its many distributions, and yet it doesn't suffer from the security problems described in the article. So-called "fragmentation" isn't really a valid technical reason for lack of security at all. If a system is designed for security then it will be secure, regardless of the number of its variations.
The real reason why Android is lacking in security is because Google hasn't focused on security. They decided not to include iptables/netfilter (the Linux firewall) as a standard facility in Android, which would have been very easy to do. And they haven't allowed users to block privileges demanded by apps after install. Instead you're offered only a package deal, either let the app do whatever it wants or don't install it, period. Android users are hence pressured into a corner, and the end result is often worse security than they would wish.
Don't blame fragmentation. Instead point a finger at Google designers who seem remarkably disinterested in supporting the Android user's security and privacy requirements.
Re:Or... (Score:5, Insightful)
It's funny.... when Apple or Microsoft comes up, all the highly rated comments are about how Android lets you escape the walled garden and get your apps wherever you want from whomever you want. But let the story be about malware and security problems with Android - and all of the sudden it's the users fault for going outside the walled garden.
Re:Or... (Score:5, Insightful)
nexus one user, here. cm7.2 is 2.3.7
likely, that will be all it ever runs.
shame and pity that google designed this. they farked it up. would you tolerate a linux distro that ended just a few years after it started?
that's how I feel. abandoned.
I run linux hardware (x86) that is recent and I also have 10 yr old systems that are just fine (thanks) and I continue to get linux updates for them.
but not android.
stupid google. seriously. why do people give google a pass on shit like this? we would not put up with this on regular desk/server linux.
Re:Fragmentation (Score:2, Insightful)
And dismissing it is the easiest way to avoid the problem and do nothing about it.
Fragmentation is a problem as it undeniably results in a subpar experience: apps that may or may not work, much more testing required for developers, slow update process (due to all those pesky vendor UIs), and apps contorted to fit resolutions it's not designed for.
But most importantly of all, it guarantees you a platform where finding an exploit is lucrative: because most people will still be vulnerable months after it is announced.
People point out that iOS is a nice, unified platform to target malware. True, but remember also that Apple doesn't have to wait at the whim of vendors to push updates. Your precious 0-day exploit will be patched long before an Android-equivalent is fixed.
From where I'm standing, competition is great, but fanboys from both sides are fiercely defending problems when their energies are better invested into pressurizing the developers to make something greater, which can they be proud of using.
Perhaps asking for carriers to take a completely hands-free approach to updates is too big a leap. Why not try pushing for a framework where critical system-level security updates can be distributed without carrier approval? Alternatively, just get everyone you know to stop buying devices with locked down bootloaders: I've recommended all of mine to get a Nexus, simply because they aren't as restricted. Every small effort counts.
Re:Or... (Score:5, Insightful)
It's funny.... when Apple or Microsoft comes up, all the highly rated comments are about how Android lets you escape the walled garden and get your apps wherever you want from whomever you want. But let the story be about malware and security problems with Android - and all of the sudden it's the users fault for going outside the walled garden.
When given responsibility, people are expected to be responsible for themselves.
Shock Horror.
Whenever there is a thread on viruses for Mac's, Mac Fanboys always blame the user as malware is only found in pirated programs. Whilst this is not strictly true in any modern OS (OS X, Windows or Linux) almost all malware these days is (knowingly or unknowingly) installed by the user.
The equivalent on relying on "walled gardens" for security is like trying to cut road accidents by mandating that people can only buy white Automatic Camry's with speed limiters. This ignores the fact that you can still crash a speed limited auto camry if you have no fecking clue how to drive.
Re:Or... (Score:5, Insightful)
iOS is a single target, get one sploit that works, you know it'll work on all of them.
The recent exnyos sploit only worked on some Samsung chips.
So.. hackers have more devices to attempt to hack!
Though all this is a waste of time if people use non-standard app stores and/or download warez, then what do they really expect?
To be fair, a couple of exploits have slipped into the Android Market over time, but by and large you are correct, it is the dodgy pirate black market where users hope they can avoid paying the 99 cents charged in the legitimate market where you are likely to get hacked.
Yet these stories, always couched in terms of "fragmentation" and "malware" always show up in the press whenever Apple needs a little diversion.
Fragmentation, because apple wants you to think that only a monolithic OS is safe. The variety of the Android world scares them to death.
Malware, because the they want to put the fear of alternative markets into the buying public. The emergence of alternative markets scares apple to death.
So every 3 or 4 months Apple plants these stories in the press. And every time, there is, predictable, absolutely ZERO outbreak of malware, except for the same patter of cheesy hacks found on Chinese websites by people looking to save a buck.
Re:Or... (Score:4, Insightful)
This does not change the fact that a lot of Android phones are running vastly outdated versions of their firmware with several known security holes - and the people owning these phones do not have the option of updating their phones.
Android is insecure, because of two factors - the manufacturers frequently simply don't give their users a way to update, and because the system requirements of the OS keep rising at an absurd pace, making many older phones incompatible with later releases of the OS.
Re:Or... (Score:5, Insightful)
Oh, I dunno. I kind of like having the choice of whether to stay in the walled garden or go outside every now and then at my discretion because I'd like to think that I know what I'm doing most of the time. Let's rephrase that a little: If someone decides to go outside the walled garden, well then, their security becomes their responsibility right? Perfectly reasonable thing if you asked me. Trouble is Apple doesn't like giving anyone this kind of choice, and that kinda makes you feel they're still trying to exercise ownership over your device even though you've paid them their ridiculous profit margins for it.
Re:Or... (Score:5, Insightful)
Mod parent up. iOS is a single platform, but new releases (major, point, all) are adopted relatively quickly, and support long lines on the hardware end. Android, however, is slow moving in upgrade adoption - while ICS or JB might have security fixes, most devices are stuck on Gingerbread with no apparent upgrade path from vendors. And, even when Google release major updates, and even if your phone is very capable, odds are you're locked out of doing anything yourself by the manufacturer (or in some cases by your carrier - gf's Xperia had "Untrusted Apps" disabled and locked from being enabled, that's an AT&T "feature").
Re:Or... (Score:5, Insightful)
There is no epidemic of exploits.
Most doors can be opened with a bump key. But that isn't happening either.
Re:Fragmentation is not to blame (Score:3, Insightful)
I guess you didn't read the article then.
Which implies that every earlier release has had insecurities which Google had to fix.
Desktop Linux doesn't install insecure apps from unknown 3rd parties as Android encourages. Because Android's approach to apps is vastly more dangerous, it requires a hugely more comprehensive approach to security instead of relying on trust in an app provider. It's tailor-made for abuse.
Instead we have almost nothing, just some requested permissions which are meaningless in practice. As many Android commentators have described, it's totally normal for app developers to request everything, and you can never tell what they are doing with that permission, nor block it. It's an insane package deal. Those permissions don't provide user security, they only deliver security theater. It's a sham.
Don't be ridiculous. Controlling which sites your app is allowed to talk to is the very first step in network security.
Re:Not vendor fragmentation (Score:4, Insightful)
Is your old engine susceptible to remote control security bugs that can be activated by a teenager in Russia?
Not everything is conducive to a car analogy.
Re:Fragmentation is not to blame (Score:4, Insightful)
Your missing the point. Users aren't failing to update, they're not provided with any updates at all.
Re:Fragmentation (Score:5, Insightful)
Whether to continue supporting a phone is not up to Google. Much of that decision is up to the carriers, then the vendors. Those same folks that want to roll out new devices every 6-12 months.
If a vendor takes Android 4.0 and mods the fuck out of it for their device, is Google responsible for patching all the security problems they introduced? Should Google take on writing new versions of Android for that hacked up version?
I like how you ultimately defend your post by suggesting anyone that disagrees is a clueless rube. Brilliant.
You're blaming Google for what is simply the mess that is the cellphone industry. At least in the U.S..
Re:Or... (Score:2, Insightful)
Re:Or... (Score:2, Insightful)
Re:Or... (Score:5, Insightful)
When given responsibility, people are expected to be responsible for themselves.
The corollary is that it is IRRESPONSIBLE to give the masses a technology where it is IMPOSSIBLE for them to be responsible.
If Android were just being marketed at technical users, that would be one thing. But to claim it's superior because it allows so much more freedom than most non-technical people can realistically control, and then pushing it on those same people. is borderline criminal.
The iOS model is far superior. Technical users able to properly manage an open system are also able to fully unlock the system. But the default shipping mode is safe for people with little technical aptitude.
Re:Or... (Score:2, Insightful)
Technical users hoping for Apple to miss an exploitable bug or two and, thanks to Copyright Office, in US being able to legally jailbreak iPhone, but not iPad [arstechnica.com].
Superior, right.
It's not "default mode". It's only intended mode.
I say, Internet's pretty unsafe for non-technical people, and we're just giving them more freedom than they can be responsible for with unfettered access. We should implement a country-wide whitelist, and technical people can always fully unlock it with an out of country VPS.
Updates are uneconomical (Score:5, Insightful)
It is just the customization and vendor disinterest that prevents updates. It is as if Dell, Lenovo, HP, etc added their crapware so deeply into the Windows infrasture that Microsoft's security updates could not be applied and the vendors were not interested in creating or distributing adapted versions.
On the contrary, it is vendor interest that prevents updates.
The first thing to know is that Google does not create Android releases. Google does continuous Android development, and any time after release N.M, but before N.(M+1), or (N+1).0, for new major releases, the code base is called after the current tree version number. When a vendor wants to release a new Android cell phone, there may be parts of the code base they've contributed back for specific chip and peripheral support, but what they do is take a cut of the code base and freeze it. Then they apply patches and finishing touches which don't get integrated back to the main Android code base as part of taking it from the raw, unproductized Android code base to a productized version which can be shipped to customers.
The dirty little secret here is that all productization is done by the device vendors, and not by Google, and that Google itself is basically incapable of productizing an operating system like Android. Instead, they rely on the device vendor to do this, and the device vendor, wanting product differentiation, willingly cooperates, or even insists, on this happening outside of Google.
What that means is that "Android version 4.1" is a meaningless way to compare Android devices with one another, since Samsung's version of 4.1 may not have identical bits with Sony's version of 4.1, since they were most likely cut from different development versions of the source tree, even if they were cut only hours apart.
The bottom line here is that, even with a working security fix back-ported to "Android 4.1" is most likely going to result in a product reintegration, since the patch(es) will have to be rolled forward from the Google release branch of 4.1 (which has no additional changes past the Google release date) to the vendor's version of 4.1, which is a set of patches and productization on top of some code branch somewhere between Google's 4.1 and their 4.2. This is nearly as much effort as developing a new "model 720" phone with COGS-reduced parts, and based on the original "model 710" phone from that same vendor. The team which works on this "improved Android 4.1 for the 710" is a set of people who isn't working on the "model 730". As far as a vendor is concerned, that's spending good money to update a product for previous customers who aren't paying them money for the new improved version of the product, because "the old version is good enough".
The second thing to know is that the carrier marketing model in the U.S. effectively discourages the carrier from updating the OS, even if the handset/tablet manufacturer were willing to integrate the bug fix and provide an update.
In the U.S., a carrier locks you into a 2 year contract, and then offers you a 6 month "early update" to lock you into that carrier again for another two years after 18 months. The upshot of this is that they get to keep the captive user as a subscriber, in trade for a new handset, which is subsidized by the carrier, and the old handset has been fully paid for (and then some) by the monthly bill portion which pays for the "free" handsets in the first place.
The net effect of this is that, if they update an old phone, unless they have a new phone with some compelling new feature(s), the customer is more likely to "ride out" the remaining six months on their contract, and then just switch carriers. The only real compelling features that differentiate one Android phone from another these days are the version of Android they are running. Sometimes there are minor changes in hardware, but frankly, there's usually no hardware change that's compelling enough to get someone to NOT
Or Even (Score:5, Insightful)
We know iOS insecure because its jail broken every other week. Ironically done to have similar functionality of Android.