Forgot your password?
typodupeerror
Android Security

Fragmentation Leads To Android Insecurities 318

Posted by samzenpus
from the united-we-stand dept.
Rick Zeman writes "The Washington Post writes about how vendor fragmentation leads to security vulnerabilities and other exploits. This situation is '...making the world's most popular mobile operating system more vulnerable than its rivals to hackers, scam artists and a growing universe of malicious software' unlike Apple's iOS which they note has widely available updates several times a year. In light of many companies' Bring Your Own Device initiatives 'You have potentially millions of Androids making their way into the work space, accessing confidential documents,' said Christopher Soghoian, a former Federal Trade Commission technology expert who now works for the American Civil Liberties Union. 'It's like a really dry forest, and it's just waiting for a match.'"
This discussion has been archived. No new comments can be posted.

Fragmentation Leads To Android Insecurities

Comments Filter:
  • Or... (Score:5, Insightful)

    by MrDoh! (71235) on Friday February 08, 2013 @01:33AM (#42829169) Homepage Journal
    iOS is a single target, get one sploit that works, you know it'll work on all of them. The recent exnyos sploit only worked on some Samsung chips. So.. hackers have more devices to attempt to hack! Though all this is a waste of time if people use non-standard app stores and/or download warez, then what do they really expect?
    • Or... (Score:4, Insightful)

      by Anonymous Coward on Friday February 08, 2013 @01:59AM (#42829293)

      You get one exploit that works against Android Gingerbread, and you've got one that works for 2+ years against the still most popular version, by a large margin.

      • Re:Or... (Score:5, Insightful)

        by denmarkw00t (892627) on Friday February 08, 2013 @02:36AM (#42829483) Homepage Journal

        Mod parent up. iOS is a single platform, but new releases (major, point, all) are adopted relatively quickly, and support long lines on the hardware end. Android, however, is slow moving in upgrade adoption - while ICS or JB might have security fixes, most devices are stuck on Gingerbread with no apparent upgrade path from vendors. And, even when Google release major updates, and even if your phone is very capable, odds are you're locked out of doing anything yourself by the manufacturer (or in some cases by your carrier - gf's Xperia had "Untrusted Apps" disabled and locked from being enabled, that's an AT&T "feature").

        • Re:Or... (Score:5, Informative)

          by semi-extrinsic (1997002) <asmunder@stud.CU ... minus physicist> on Friday February 08, 2013 @04:45AM (#42829985)
          You should be aware of a new feature of Android that hasn't really gotten a lot of press, but is the solution to this problem: the latest upgrade of the "Play store" (market) includes something called "Google Play Services". This new app takes care of upgrading and patching all Google-produced apps (system apps, YouTube, browser, camera, etc.). It is back-ported both to Gingerbread and Froyo. It applies security patches and upgrades without needing user intervention, as I understand it.

          TL;DR: You may not be able to upgrade your Gingerbread phone to ICS, but Google still patches known vulns on your system.
          • by kthreadd (1558445)
            Interesting. Does that include system components as well, like the kernel?
            • Interesting. Does that include system components as well, like the kernel?

              That depends more on the device maker/carrier than Google.

        • most devices are stuck on Gingerbread with no apparent upgrade path from vendors.

          Highlighting the part that I find most relevant. The problem isn't Android per se, it's vendors that lock you out of getting the most recent (security) updates to the OS. The play store has services that will keep even Gingerbread patched against known vulnerabilities (see comment 42829985 [slashdot.org]). If your vendor blocks you from using that... time to pick a new vendor.

      • by Andy Prough (2730467) on Friday February 08, 2013 @04:03AM (#42829811)
        from the Google Play store. It's free and quite powerful. Works on older versions of Android too. It's like the Swiss Army Knife of mobile security - Scans apps and SD card for malware; has an excellent privacy dashboard; and has real-time shielding of apps, web links, and messages to protect from malware. It has a firewall that can be set up on rooted devices; can block calls and SMS messages based on filtering rules; has a network meter; and has several anti-theft functions. Really a brilliant app, from a trusted security company. They also have an iPhone app, although that one seems to have some slightly different functions. I think anyone with a modern smartphone should have some malware protection on board, and this is an outstanding suite with the right price - free.
        • Have their been any improvements since the scathing November 2011 report [PDF] [av-test.org] stating that mobile AV is next to useless?
        • by bartron (772079) on Friday February 08, 2013 @08:06AM (#42830747)

          What the hell?

          How can anyone say, with a straight face, that you need to run AV software on a goddamn phone? A PHONE! What manner of circumstances lead to this being considered something that is perfectly normal?

          If anything it just shows what a logistical clusterfuck Google created with the first few editions of Android and letting all and sundry create hardware without at least enforcing some form of automatic patching regime. Don't get me wrong, I think ICS is a wonderful OS for a phone, but to birthed straight into the world expecting to have to run AV software??? Look at yourself in the mirror and tell yourself that's a perfectly normal and rational thing.

          • How can anyone say, with a straight face, that you need to run AV software on a goddamn phone? A PHONE! What manner of circumstances lead to this being considered something that is perfectly normal?

            The circumstances of these phones effectively being general purpose computers.

    • Re:Or... (Score:4, Informative)

      by ahabswhale (1189519) on Friday February 08, 2013 @02:00AM (#42829303)

      Android phones rarely get updated. About half of all Android users are still running 2.3 or earlier and the uptake for new versions is glacially slow. This makes android extremely vulnerable. If someone discovers an attack for 2.x, it's game over for millions of phones. Android also has a leaky walled garden that allows users to easily bypass the Google Play store and go to any market place they may choose. Hell, it's not even unusual to find infected apps in the official Google Play store.

      • Re:Or... (Score:5, Insightful)

        by TheGratefulNet (143330) on Friday February 08, 2013 @02:09AM (#42829355)

        nexus one user, here. cm7.2 is 2.3.7

        likely, that will be all it ever runs.

        shame and pity that google designed this. they farked it up. would you tolerate a linux distro that ended just a few years after it started?

        that's how I feel. abandoned.

        I run linux hardware (x86) that is recent and I also have 10 yr old systems that are just fine (thanks) and I continue to get linux updates for them.

        but not android.

        stupid google. seriously. why do people give google a pass on shit like this? we would not put up with this on regular desk/server linux.

        • by crutchy (1949900)

          can you imagine the security epidemic faced by routers and set top boxes that never get updated... omg its the end of linux!

        • Re: (Score:2, Insightful)

          Some of us didn't give the poor experience a pass and moved away from Android. More people need to do that and let google know we think it's shit.
          • by tuppe666 (904118)

            Some of us didn't give the poor experience a pass and moved away from Android. More people need to do that and let google know we think it's shit.

            Some of us didn't like being treated like a criminal, and locked out of its hardware, forced to use proprietary [and I locked to ituned] software, and hardware, with it being stuck in incremental versions of both, found the loving arms of Android with offered arguably better hardware; software; standards and value.

            Want to buy my broken iPhone :)

      • by thegarbz (1787294) on Friday February 08, 2013 @03:29AM (#42829669)

        Hell, it's not even unusual to find infected apps in the official Google Play store.

        Citation Needed.

        Not a one off either. You said it's not unusual so please link us to the this supposed endemic problem in Google's Play Store.

      • by DrXym (126579)
        It's only really vulnerable if the person operating the phone is filling it with warez. If they just get their apps from the official store their exposure is fairly minimal.
    • Re:Or... (Score:5, Insightful)

      by DerekLyons (302214) <(moc.liamg) (ta) (retawriaf)> on Friday February 08, 2013 @02:07AM (#42829345) Homepage

      Though all this is a waste of time if people use non-standard app stores and/or download warez, then what do they really expect?

      It's funny.... when Apple or Microsoft comes up, all the highly rated comments are about how Android lets you escape the walled garden and get your apps wherever you want from whomever you want. But let the story be about malware and security problems with Android - and all of the sudden it's the users fault for going outside the walled garden.

      • Re:Or... (Score:5, Insightful)

        by mjwx (966435) on Friday February 08, 2013 @02:23AM (#42829421)

        Though all this is a waste of time if people use non-standard app stores and/or download warez, then what do they really expect?

        It's funny.... when Apple or Microsoft comes up, all the highly rated comments are about how Android lets you escape the walled garden and get your apps wherever you want from whomever you want. But let the story be about malware and security problems with Android - and all of the sudden it's the users fault for going outside the walled garden.

        When given responsibility, people are expected to be responsible for themselves.

        Shock Horror.

        Whenever there is a thread on viruses for Mac's, Mac Fanboys always blame the user as malware is only found in pirated programs. Whilst this is not strictly true in any modern OS (OS X, Windows or Linux) almost all malware these days is (knowingly or unknowingly) installed by the user.

        The equivalent on relying on "walled gardens" for security is like trying to cut road accidents by mandating that people can only buy white Automatic Camry's with speed limiters. This ignores the fact that you can still crash a speed limited auto camry if you have no fecking clue how to drive.

        • Re:Or... (Score:5, Insightful)

          by SuperKendall (25149) on Friday February 08, 2013 @04:51AM (#42830015)

          When given responsibility, people are expected to be responsible for themselves.

          The corollary is that it is IRRESPONSIBLE to give the masses a technology where it is IMPOSSIBLE for them to be responsible.

          If Android were just being marketed at technical users, that would be one thing. But to claim it's superior because it allows so much more freedom than most non-technical people can realistically control, and then pushing it on those same people. is borderline criminal.

          The iOS model is far superior. Technical users able to properly manage an open system are also able to fully unlock the system. But the default shipping mode is safe for people with little technical aptitude.

          • It is quite possible for the masses to be responsible. The number of android phones is going up and well and most people are quite happy with them. Seem to me that this malware doom is severely overblown.
          • by dwpro (520418)

            I think superiority is in the eye of the beholder. You value security over freedom. Not everyone shares your views.

      • Re:Or... (Score:5, Insightful)

        by dido (9125) <dido@@@imperium...ph> on Friday February 08, 2013 @02:36AM (#42829481)

        Oh, I dunno. I kind of like having the choice of whether to stay in the walled garden or go outside every now and then at my discretion because I'd like to think that I know what I'm doing most of the time. Let's rephrase that a little: If someone decides to go outside the walled garden, well then, their security becomes their responsibility right? Perfectly reasonable thing if you asked me. Trouble is Apple doesn't like giving anyone this kind of choice, and that kinda makes you feel they're still trying to exercise ownership over your device even though you've paid them their ridiculous profit margins for it.

        • by H0p313ss (811249)

          Oh, I dunno. I kind of like having the choice of whether to stay in the walled garden or go outside every now and then at my discretion because I'd like to think that I know what I'm doing most of the time.

          Absolutely, kind of like Amsterdam, it's always there if I want it. Similarly I know the Android garden of infinite delight is always there. And if I ever feel like bending over and getting reamed I'll leave the walled garden. Just knowing its possible makes me feel so much better.

          (Tongue firmly in cheek)

    • Re:Or... (Score:5, Insightful)

      by icebike (68054) on Friday February 08, 2013 @02:24AM (#42829427)

      iOS is a single target, get one sploit that works, you know it'll work on all of them.

      The recent exnyos sploit only worked on some Samsung chips.

      So.. hackers have more devices to attempt to hack!

      Though all this is a waste of time if people use non-standard app stores and/or download warez, then what do they really expect?

      To be fair, a couple of exploits have slipped into the Android Market over time, but by and large you are correct, it is the dodgy pirate black market where users hope they can avoid paying the 99 cents charged in the legitimate market where you are likely to get hacked.

      Yet these stories, always couched in terms of "fragmentation" and "malware" always show up in the press whenever Apple needs a little diversion.

      Fragmentation, because apple wants you to think that only a monolithic OS is safe. The variety of the Android world scares them to death.

      Malware, because the they want to put the fear of alternative markets into the buying public. The emergence of alternative markets scares apple to death.

      So every 3 or 4 months Apple plants these stories in the press. And every time, there is, predictable, absolutely ZERO outbreak of malware, except for the same patter of cheesy hacks found on Chinese websites by people looking to save a buck.

      • by Swampash (1131503)

        To be fair, a couple of exploits have slipped into the Android Market over time

        Yes, in the sense that Apple is not on the verge of bankruptcy.

      • Re:Or... (Score:4, Insightful)

        by an unsound mind (1419599) on Friday February 08, 2013 @02:34AM (#42829477)

        This does not change the fact that a lot of Android phones are running vastly outdated versions of their firmware with several known security holes - and the people owning these phones do not have the option of updating their phones.

        Android is insecure, because of two factors - the manufacturers frequently simply don't give their users a way to update, and because the system requirements of the OS keep rising at an absurd pace, making many older phones incompatible with later releases of the OS.

      • I take it you have proof that Apple plants these stories. Otherwise you'd look like a tit.
    • iOS is also an easy platform to fix. All those android users stuck on gingerbread will be on that for the life if the device. You can hit them over and over.
  • I remember... (Score:5, Insightful)

    by webmistressrachel (903577) on Friday February 08, 2013 @01:39AM (#42829189) Journal

    Not so long ago niche platforms and disparate architectures were slated to be good BECAUSE they were so diverse it wasn't worth the time to hack them individually...

    I also remember a time not so long ago that Microsofties used to complain that the frequency and ease of attacks on public sites was due to their dominance and being a big target. I wonder what Linux admins say now, since they now dominate the data centre?

    • Re:I remember... (Score:5, Insightful)

      by erice (13380) on Friday February 08, 2013 @01:47AM (#42829225) Homepage

      Not so long ago niche platforms and disparate architectures were slated to be good BECAUSE they were so diverse it wasn't worth the time to hack them individually...

      I also remember a time not so long ago that Microsofties used to complain that the frequency and ease of attacks on public sites was due to their dominance and being a big target. I wonder what Linux admins say now, since they now dominate the data centre?

      But these are not niche platforms or disparate architectures. They are all compatible from the point of view of applications and malware. It is just the customization and vendor disinterest that prevents updates. It is as if Dell, Lenovo, HP, etc added their crapware so deeply into the Windows infrasture that Microsoft's security updates could not be applied and the vendors were not interested in creating or distributing adapted versions.

      • by tlambert (566799) on Friday February 08, 2013 @06:34AM (#42830387)

        It is just the customization and vendor disinterest that prevents updates. It is as if Dell, Lenovo, HP, etc added their crapware so deeply into the Windows infrasture that Microsoft's security updates could not be applied and the vendors were not interested in creating or distributing adapted versions.

        On the contrary, it is vendor interest that prevents updates.

        The first thing to know is that Google does not create Android releases. Google does continuous Android development, and any time after release N.M, but before N.(M+1), or (N+1).0, for new major releases, the code base is called after the current tree version number. When a vendor wants to release a new Android cell phone, there may be parts of the code base they've contributed back for specific chip and peripheral support, but what they do is take a cut of the code base and freeze it. Then they apply patches and finishing touches which don't get integrated back to the main Android code base as part of taking it from the raw, unproductized Android code base to a productized version which can be shipped to customers.

        The dirty little secret here is that all productization is done by the device vendors, and not by Google, and that Google itself is basically incapable of productizing an operating system like Android. Instead, they rely on the device vendor to do this, and the device vendor, wanting product differentiation, willingly cooperates, or even insists, on this happening outside of Google.

        What that means is that "Android version 4.1" is a meaningless way to compare Android devices with one another, since Samsung's version of 4.1 may not have identical bits with Sony's version of 4.1, since they were most likely cut from different development versions of the source tree, even if they were cut only hours apart.

        The bottom line here is that, even with a working security fix back-ported to "Android 4.1" is most likely going to result in a product reintegration, since the patch(es) will have to be rolled forward from the Google release branch of 4.1 (which has no additional changes past the Google release date) to the vendor's version of 4.1, which is a set of patches and productization on top of some code branch somewhere between Google's 4.1 and their 4.2. This is nearly as much effort as developing a new "model 720" phone with COGS-reduced parts, and based on the original "model 710" phone from that same vendor. The team which works on this "improved Android 4.1 for the 710" is a set of people who isn't working on the "model 730". As far as a vendor is concerned, that's spending good money to update a product for previous customers who aren't paying them money for the new improved version of the product, because "the old version is good enough".

        The second thing to know is that the carrier marketing model in the U.S. effectively discourages the carrier from updating the OS, even if the handset/tablet manufacturer were willing to integrate the bug fix and provide an update.

        In the U.S., a carrier locks you into a 2 year contract, and then offers you a 6 month "early update" to lock you into that carrier again for another two years after 18 months. The upshot of this is that they get to keep the captive user as a subscriber, in trade for a new handset, which is subsidized by the carrier, and the old handset has been fully paid for (and then some) by the monthly bill portion which pays for the "free" handsets in the first place.

        The net effect of this is that, if they update an old phone, unless they have a new phone with some compelling new feature(s), the customer is more likely to "ride out" the remaining six months on their contract, and then just switch carriers. The only real compelling features that differentiate one Android phone from another these days are the version of Android they are running. Sometimes there are minor changes in hardware, but frankly, there's usually no hardware change that's compelling enough to get someone to NOT

    • by Telvin_3d (855514)

      Not that long ago an exploit that only targeted 5% of smart phones would have a return so small it would not possibly be worth it. Now an exploit that targets 5% of smart phones represents millions of phones.

  • by rudy_wayne (414635) on Friday February 08, 2013 @01:42AM (#42829203)

    The problem isn't vendor fragmentation. The problem is vendor laziness. If you produce an Android device there is no legitimate why you can't provide regular updates.

    • by TheGratefulNet (143330) on Friday February 08, 2013 @02:11AM (#42829371)

      bullshit!

      google abandoned the 'bad old hardware' (gfx chips were 'too old').

      and so they stopped ALL updates of importance.

      its not the vendors. don't blame them. its the creator of android. those guys messed up the design (split of gfx and non-gfx) and so we get 'end of lifed' systems that are FAR too young to be put to pasture.

      sigh. really, deep sigh.

      • by thegarbz (1787294) on Friday February 08, 2013 @03:58AM (#42829789)

        I call bullshit to your bullshit.

        Go have a look at the list of supported devices by Cyanogenmod and look up how many of those devices actually offer vendor upgrades to Jellybean. Hint: very few. My device stopped being supported at Gingerbread because the vendor says "it was too slow". I am now running Jellybean and thanks to Google's tweaks it's runs faster and smoother than it ever did.

        But hey let's not dwell on old hardware shall we? Jellybean was released in early July 2012. Just under 4 months later Samsung were still saying US customers will get their SIII update in "the coming months". You know when Cyanogenmod 10.1 supported the Galaxy S III? Within 3 weeks of release.

        The problem IS vendor lazyness.

        • by detain (687995)
          This isn't the case, each device supported officially or unofficially by cyanogenmod took alot of developers working on each individual phones hardware. Most phones all required their own set of patchs and tweaks to get things working in the kernel. Cyanogenmod supported hardware was painfully done 1 phone/tablet at a time. The problem is a mix of both vendors and google.
        • The problem is vendors insisting on only a vendor-flavored OS on your phone. Imagine if Dell laptops only worked with Dell's specific version of Windows. Then you would have had to wait half a year after the release of Win7 to upgrade your Dell Vista laptop to Dell's version of Win7.
    • Re: (Score:2, Informative)

      by Anonymous Coward

      Two reasons:

      1) Hardware component manufacturers don't provide updated drivers. Many of them are binary blobs that aren't compatible with newer kernel/Android versions. Especially Qualcomm and Nvidia chipsets.

      2) Carrier certification is *expensive*. Going through the effort of getting updates carrier-approved costs tens of thousands of dollars, per update.

  • by Casandro (751346) on Friday February 08, 2013 @01:45AM (#42829215)

    If there was either a common hardware platform, like on the PC, where every PC is essentially compatible with every other PC, you could easily update your operating system without the manufacturer of the hardware.
    However SoC vendors don't want that, since it would mean that a device maker could easily switch from one SoC to another one. Plus they still use undocumented proprietary hardware in those SoCs, that's why you have binary device driver blobs which are hard to port.

    The other problem lies within Google. They should have mandated some sort of "BIOS" which would have allowed any operating system to see what kind of hardware there is. This wouldn't have been more than a few hundred bytes in the flash containing the bootloader. That way you could have a generic operating system image, which would read out that ROM and execute routines found in it to use the hardware and then, perhaps at a later stage, use specialized drivers... just like it's done on the PC.

    The sort of fragmentation we currently have in the Android market is simply bad, but a logical consequence from bundling hardware with the operating system. I just hope that one day the Chinese will wake up, and design a common hardware platform allowing the user to boot its own operating system from the SD-card, and even move it from device to device.

  • missing disclaimer (Score:3, Informative)

    by Anonymous Coward on Friday February 08, 2013 @01:47AM (#42829221)

    TFA author is an iPhone user, according to his twit feed https://twitter.com/craigtimberg [twitter.com]

  • Fragmentation (Score:4, Insightful)

    by LordLucless (582312) on Friday February 08, 2013 @01:55AM (#42829263)

    Trying to argue about fragmentation with people attacking Android is a losing battle. "Fragmentation" means there's too many different hardware form-factors. No, it means too many vendor-specific UIs. No, it means that we need to support multiple OS versions. No, it means that we can't guarantee what security patches have been applied.

    Bah, from where I'm sitting, "fragmentation" means nothing more than "I don't like it" - a way of disparaging choice from those who don't want it.

    • by symbolset (646467) *

      This. They've actually been at it since before the first Android device was even launched, claiming it was a fatal ill. Despite the dire fragmentation it has succeeded handily.

      I'm kind of curious how many millions have been spent Android-slandering in this way. Has to be quite a few. Any self-respecting for-fee product slanderer would have switched to another strategy that was failing less spectacularly by now. His customer might have switched to another more effective slanderer in some sort of normal

    • Re: (Score:2, Insightful)

      by tsj5j (1159013)

      And dismissing it is the easiest way to avoid the problem and do nothing about it.

      Fragmentation is a problem as it undeniably results in a subpar experience: apps that may or may not work, much more testing required for developers, slow update process (due to all those pesky vendor UIs), and apps contorted to fit resolutions it's not designed for.
      But most importantly of all, it guarantees you a platform where finding an exploit is lucrative: because most people will still be vulnerable months after it is an

      • by Belial6 (794905)

        Fragmentation is a problem as it undeniably results in a subpar experience:

        I'm confused. You are implying that Android is 'Fragmented' and that Fragmentation causes a subpar experience. Those to ideas don't add up.

    • there's too many different hardware form-factors. No, it means too many vendor-specific UIs. No, it means that we need to support multiple OS versions. No, it means that we can't guarantee what security patches have been applied.

      You realize all of these are valid criticisms, right?

      • Yeah. But when you address one, the issue shifts to another; when you address that, suddenly you're arguing about the next. Moving goalposts. Although I notice there are far you form-factor fragmentation arguments now that Apple's got at least three different form-factors under their belt...

        • Well Apple's fragmentation is annoying too! Android being bad doesn't preclude Apple from being bad. If only WebOS had made it, since clearly it was the perfect OS.
    • Trying to argue about fragmentation with people attacking Android is a losing battle. "Fragmentation" means there's too many different hardware form-factors. No, it means too many vendor-specific UIs. No, it means that we need to support multiple OS versions. No, it means that we can't guarantee what security patches have been applied.

      Boy, it sounds like the kinds of attacks on Android feasibility are splitting into a lot of different forms. If only we had a word for that.

  • by Morgaine (4316) on Friday February 08, 2013 @02:04AM (#42829333)

    Linux has huge diversity among its many distributions, and yet it doesn't suffer from the security problems described in the article. So-called "fragmentation" isn't really a valid technical reason for lack of security at all. If a system is designed for security then it will be secure, regardless of the number of its variations.

    The real reason why Android is lacking in security is because Google hasn't focused on security. They decided not to include iptables/netfilter (the Linux firewall) as a standard facility in Android, which would have been very easy to do. And they haven't allowed users to block privileges demanded by apps after install. Instead you're offered only a package deal, either let the app do whatever it wants or don't install it, period. Android users are hence pressured into a corner, and the end result is often worse security than they would wish.

    Don't blame fragmentation. Instead point a finger at Google designers who seem remarkably disinterested in supporting the Android user's security and privacy requirements.

    • by kllrnohj (2626947)

      Android's security is top notch, and your claim Google isn't focusing on it is bullshit. With every release it has gotten better than the one before it.

      And those permissions you complain about? Yeah, that's something desktop Linux doesn't even have. Android wins that by default. Your attempt to turn a very obvious and straightforward advantage into some sort of negative is ridiculous.

      iptables/netfilter doesn't help here in the least, by the way. They are completely pointless here.

      • Re: (Score:3, Insightful)

        by Anonymous Coward

        Android's security is top notch

        I guess you didn't read the article then.

        With every release it has gotten better than the one before it.

        Which implies that every earlier release has had insecurities which Google had to fix.

        And those permissions you complain about? Yeah, that's something desktop Linux doesn't even have.

        Desktop Linux doesn't install insecure apps from unknown 3rd parties as Android encourages. Because Android's approach to apps is vastly more dangerous, it requires a hugely more comprehensive

    • by jvonk (315830)

      The real reason why Android is lacking in security is because Google hasn't focused on security. They decided not to include iptables/netfilter (the Linux firewall) as a standard facility in Android, which would have been very easy to do.

      That's why I installed the free DroidWall [google.com] app from Google Play. Now I have an Android iptables firewall that is very versatile.

      And they haven't allowed users to block privileges demanded by apps after install. Instead you're offered only a package deal, either let the app do whatever it wants or don't install it, period.

      That's why I built and installed the free PDroid [xda-developers.com] framework into my free custom ROM. Now I can grant, deny, or spoof the permissions on all my apps.

      If anyone's interested, I currently recommend using Auto-Patcher [xda-developers.com] as the tool to inject PDroid into your ROM. I also recommend using the OpenPDroid [xda-developers.com] option in Auto-Patcher, with PDroid Manager [google.com] as the front-end UI app.

      So, both of the Android

    • They decided not to include iptables/netfilter (the Linux firewall) as a standard facility in Android, which would have been very easy to do

      The vast majority of Android phones I've found actually do have iptables. You need to be root to do much with it, though....

  • Having everything all being exactly one way is one giant target for easy attacks. The more different, the better. They have this completely backwards.
  • That whole article reads like it could have been written by the Microsoft FUD division. It's either nobody uses Open Source or, if it is popular, then it has to be fragmenting ...

    "Android also gives you tools for creating apps that look great and take advantage of the hardware capabilities available on each device. It automatically adapts your UI to look it's best on each device, while giving you as much control as you want over your UI on different device types."

    "you can create a single app binary [android.com] th
  • ba-dum-tish

    But seriously folks, it's not that Apple releases updates several times a year that's the important bit. It's that those updates are available instantly, worldwide, to everyone, on every carrier, to every device younger than about four years old, and the update process is so easy and convenient that everyone (close enough) installs the updates.

    The biggest install base for iOS is always "the latest version". The biggest install base for Android is what, Honeycomb? Shit.

  • by rueger (210566) * on Friday February 08, 2013 @02:41AM (#42829507) Homepage
    What? Android bad for corporate security? BYOD bad for corporate security?

    Excuse me sir... {smile}
  • I'm wondering if the solution would not be for OS updates to be on sale, at a low-ish-price, ie 5 or 10 bucks. That way, OEMs can recoup part of their investment, and users can put their money were their mouth is. I personally don't care that much about OS updates, my Xoom has gone from 3.x to 4.0 to 4.1 and I really didn't notice any difference.

  • by drolli (522659) on Friday February 08, 2013 @02:45AM (#42829533) Journal

    I always thought its the responsibilty of the manufacturer of the device to make a product which sticks to certain definitions. I dont see many android products listet with security as a feature, therefore i also dont assume that the design of the preinstalled sw goes into that direction.

  • Some of us look forward to the inevitable shitstorm and think this kind of excitement is just... great!

    Obligitory Animal House [youtube.com]

"The chain which can be yanked is not the eternal chain." -- G. Fitch

Working...