EFF: Don't Sacrifice Security on Mobile Devices
By contrast, mobile systems lag far behind the established industry standard for open disclosure about problems and regular patch distribution. For example, Google has never made an announcement to its android-security-announce mailing list, although of course they have released many patches to resolve many security problems, just like any OS vendor. But Android open source releases are made only occasionally and contain security fixes unmarked, in among many other fixes and enhancements."
Posted Jan 22, 2011 5:52 UTC (Sat)
by anon@mailinator (guest, #72513)
[Link] (1 responses)
But Android open source releases are made only occasionally and contain security fixes unmarked, in among many other fixes and enhancements. Well, just like what the Linux kernel is doing all the time (on the security fixes side).
Posted Jan 23, 2011 14:37 UTC (Sun)
by intgr (subscriber, #39733)
[Link]
Posted Jan 23, 2011 1:50 UTC (Sun)
by foom (subscriber, #14868)
[Link] (15 responses)
For example: I have this android 1.5 device (a Cliq XT). That's the latest OS that Motorola has gotten around to releasing for it. And, BTW, it was first released in March 2010 (when 2.1 was current), and is still being made and sold today [2], still with Android 1.5 (hopefully goes without saying: don't buy it, it's utter crap, as are most other phones made by Motorola).
So I've really gotta wonder: just how many *known and already fixed by Google* remotely exploitable security holes does it have? Motorola promised to upgrade it to Android 2.1 someday ("2Q 2010", haha). If that ever actually happens, how many *known and already fixed by Google* remotely exploitable security holes will it still have at that point?
This situation seems rather untenable. I'm just waiting for some hackers to start trawling the latest code releases looking for bugs to exploit the older OS versions with...
[1] http://developer.android.com/resources/dashboard/platform...
Posted Jan 23, 2011 19:23 UTC (Sun)
by Aissen (subscriber, #59976)
[Link] (11 responses)
Google seems to do an OK job with the two devices it's managing (for now
), but it's far from being enough, and some of the EFF's remarks apply to them too(no responsible disclosure).
Posted Jan 23, 2011 19:37 UTC (Sun)
by drag (guest, #31333)
[Link] (10 responses)
If users decide that is important to have updated firmware on their phones then their purchasing decision will reflect this. Companies will see a financial reward for keeping their stuff up to date. I don't see anything criminal at all about not updating the firmware. It's a problem between the manufacturers, carriers, and their customers.
You can't force people not to suck. You just don't give them money.
Google might be able to force them a little bit. Google has compliance rules that go along with their proprietary Google Apps add-ons so they could add versioning requirements on top of them.
This is a classic problem with dealing with embedded developers. They have had no need in their professional experiences to make sure their customer's firmwares are up to date. It's expensive and difficult and the market dictates that new devices have priority over updating old ones.
The only thing that can be done is to make it cheaper and easier as far as the Linux kernel and friends are involved to make updates for phones combined with educating the buying public why having newer Android versions is in their advantage and what phones to buy that will provide them with up to date features.
Personally I only buy phones that I know will get supported by third parties like Cyanogenmod, but this approach is not suitable for most people for a whole host of reasons.
Posted Jan 23, 2011 20:56 UTC (Sun)
by Aissen (subscriber, #59976)
[Link] (5 responses)
Posted Jan 23, 2011 21:18 UTC (Sun)
by foom (subscriber, #14868)
[Link] (1 responses)
2) How are users even supposed to know if there are any security holes in their phones that their OEMs haven't fixed if Google doesn't release advisories?
Posted Jan 23, 2011 21:51 UTC (Sun)
by Aissen (subscriber, #59976)
[Link]
2) True, that's what I tried to say in my first comment above.
Posted Jan 24, 2011 1:34 UTC (Mon)
by drag (guest, #31333)
[Link] (2 responses)
Yes. That is about it. They decide how important something is to them then they give their money out accordingly. Manufacturers that do a decent job providing what the users actually want and need will probably do better then those that don't.
BTW. Android virus is found in the wild in China. Unlike the bank widget thing that happened in Android market that was entirely blown out of proportion (the one group that actually examined the software instead of just speculating dismissed the idea that he was using the software to steal bank information as fantasy with no evidence in the software) this is a actual virus infecting applications.
I didn't see much details, but from what I remember it was a virus attached to legit software. Found in third party repos (aka app markets).
> Or maybe they will decide that having an open phone with replaceable firmware is important (but that is a dream
for now
).
Possibly.
One of the big things that we have going for us is the desire to cut costs will probably lead to a standardized platform. This will raise the cost of the development of the hardware a bit and increase complexity, but per unit costs shouldn't be affected much and it will lower the cost of development and support. This should have the effect of dramatically lower the barrier for third party software to support phones.
Since now we have phones and hardware developed from the ground up to work specifically with Linux kernel in Android then we can hopefully avoid most of the 'What would Windows Do?' solutions to work around bugs in ACPI and such.
Posted Jan 24, 2011 2:46 UTC (Mon)
by drag (guest, #31333)
[Link] (1 responses)
Here is some details:
Of course this does not come close to the level of really horrible crap that was a constant plague on Symbian and Windows mobile phones, especially in that area of the world. But it's just the beginning.
Posted Jan 25, 2011 7:32 UTC (Tue)
by cmccabe (guest, #60281)
[Link]
Unless you create an Apple-style lockdown on the platform, people are always going to be able to download trojan'ed applications from shady pirate sites and install them. Some people will also be unwise enough to give those shady applications full security capabilities.
Posted Jan 25, 2011 0:18 UTC (Tue)
by AndreE (guest, #60148)
[Link] (3 responses)
Who has published definitive support and update timelines for their phone.
And what level of warranty does Cynogenmod provide again? Do they have a security team patching security flaws?
The consumer has no choice in the matter, period, and neither the software nor hardware vendors seem to really care.
Posted Jan 27, 2011 10:27 UTC (Thu)
by trasz (guest, #45786)
[Link] (2 responses)
Posted Feb 1, 2011 19:34 UTC (Tue)
by leoc (guest, #39773)
[Link] (1 responses)
Posted Feb 1, 2011 20:33 UTC (Tue)
by foom (subscriber, #14868)
[Link]
Posted Jan 24, 2011 19:01 UTC (Mon)
by cmccabe (guest, #60281)
[Link] (2 responses)
Android certainly seems to have minimized the trusted code base, compared to a typical Windows or Ubuntu install. Since most software is Java, there are no such things as buffer overflows, return-to-libc attacks, and so on. There is a better security model-- for example, random applications can't just read and write the user's data unless they've specifically been given that capability. Another advantage Google has against malware is that it can remove known malware from Google Market, which is the only way that most users get their applications.
Of course, since Android now supports native code, hackers can attack the kernel API. I kind of hate to admit this, but that API might be one of the more vulnerable parts of the system at the moment.
One thing that annoys me about Android is that you can't install an app without granting it all the security capabilities it wants. This has led to me uninstalling things like the Pandora radio application, because it just wanted too much power.
A lot of people think that the computer security battle has more or less been lost on the desktop front. Developers keep adding features, which also add security bugs, and hackers keep finding those bugs. It's a never-ending cycle which will never lead to real security. In order to really start winning, we need to change the game so that new bugs get put in at a lower rate than they're discovered. Higher level languages and better security models are a good start. You don't have to constantly patch applications and libraries unless they're part of the trusted code base.
Posted Jan 24, 2011 20:16 UTC (Mon)
by foom (subscriber, #14868)
[Link] (1 responses)
I think the image display libraries and the web browser are still prime attack targets (written in C, note!). Think of an MMS message, spam email, or webpage that takes control of your phone. And of course emails or MMSes itself to all your contacts to continue propagation.
Posted Jan 25, 2011 1:12 UTC (Tue)
by cmccabe (guest, #60281)
[Link]
Remember that just because code is written in C, doesn't mean it's part of the trusted codebase.
For example, the Chrome web browser is sandboxed. So if you can buffer overflow a webkit HTML rendering thread (not a very hard task), you get control of... what is displayed on the screen. Nothing else.
There was an article on the sandbox at http://lwn.net/Articles/347547/
I'm not 100% sure if Google has deplyed the seccomp stuff yet on Chrome for Android (I haven't checked the source.)
On the other hand, I'm guessing that the image display libraries are built into Dalvik itself. They probably are part of the trusted codebase.
C.
Posted Jan 23, 2011 13:53 UTC (Sun)
by clump (subscriber, #27801)
[Link] (3 responses)
I've since moved the phone to Cyanogen. Now I'm responsible for keeping it up to date, though sadly Cyanogen doesn't appear to do per-problem updates either.
Posted Jan 23, 2011 14:09 UTC (Sun)
by khim (subscriber, #9252)
[Link] (1 responses)
Well, in my experience such modular updates need a lot of hand-holding. Kernel is updated and X server no longer starts (rememeber that all phones include proprietary 3D acceleration module), browser is update and help no longer works (because new security settings don't work with old JS library in help system), etc. For the non-geeks partial updates are huge disaster. What they need are delta-updates (to save bandwidth if it's OTA update) and it looks like recent phones (like Nexus S) support them. Do you have any statistic? Anecdote evidence looks mixed: iPhone uses 'service pack' model of security and it's broken again and again, but XBox360 is totally different story (take a look on the price of JTAGed consoles: they are 2x-3x vs original price which suggests scarcity).
Posted Jan 23, 2011 23:00 UTC (Sun)
by Cyberax (✭ supporter ✭, #52523)
[Link]
But the fact that Android is monolithic is already starting to take its toll. Vendors aren't going to be able to keep up with all the changes (and they little motivation to do this). So separating Android into a set of 'core' components and vendor-specific additions (aka 'crap') should do wonders.
Ongoing work on standardization in the ARM space should also help this.
Posted Jan 23, 2011 19:17 UTC (Sun)
by Aissen (subscriber, #59976)
[Link]
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
[2] http://www.walmart.com/ip/Walmart-Family-Mobile-Motorola-...
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
Or maybe they will decide that having an open phone with replaceable firmware is important (but that is a dream
for now
).
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
http://blog.mylookout.com/2010/12/geinimi_trojan/
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
Not really. The original iPhone, which is not even 3 years old, is no longer supported by Apple.
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
EFF: Don't Sacrifice Security on Mobile Devices
> attack targets (written in C, note!). Think of an MMS message, spam email,
> or webpage that takes control of your phone. And of course emails or MMSes
> itself to all your contacts to continue propagation.
EFF: Don't Sacrifice Security on Mobile Devices
Evidence? Where is it?
This seems backwards given the history of modular Linux distro management. If the kernel is updated, send a kernel update. If the browser needs an update, send a browser update
I think there's much evidence that the 'service pack' model of security and bug fix management doesn't work well.
Evidence? Where is it?
EFF: Don't Sacrifice Security on Mobile Devices