Researchers from Germany’s Security Research Labs (SRL) conducted a two-year study into the state of Android security focused around the monthly updates that Google issues and urges smartphone manufacturers to install.
These monthly updates are crucial for keeping smartphones secure, fixing collections of known bugs and holes each month to keep hackers at bay. But the researchers found there is often a hidden “patch gap” between what the manufacturers tell the users and what they actually do to the software – some simply tell people they have updated the phones without actually patching anything.
“Installing patches every month is an important first step, but is still insufficient unless all relevant patches are included in those updates,” the researchers said. “Our large study of Android phones finds that most Android vendors regularly forget to include some patches, leaving parts of the ecosystem exposed to the underlying risks.”
Each monthly security update contains a collection of patches for a variety of security bugs. Google dates the monthly security updates so that users can see if their smartphones have been updated with the latest fixes. But while manufacturers may install some of the fixes, changing the security update date to the latest available in the process, they can fail to install all of the patches bundled in any particular month’s update.
In the findings due to be presented at the Hack in the Box security conference in Amsterdam on Friday, the researchers said of the 1,200 smartphones tested, some manufacturers may miss one or two patches from the monthly security updates, but others may miss many more.
Failing to update their smartphones with the latest security updates is one thing, but SRL found that some simply lie about installing any patches at all.
“We found several vendors that didn’t install a single patch but changed the patch date forward by several months. That’s deliberate deception, and it’s not very common,” SRL founder Karsten Nohl told Wired.
SRL found that of the major smartphone manufacturers, Google, Sony and Samsung performed the best, missing up to one patch, OnePlus and Nokia missed between one and three patches, HTC, Huawei, LG and Motorola missed three to four patches, while Chinese manufacturers TCL and ZTE missed more than four.
While many of these missed security patches may not be inherently dangerous in isolation, hackers typically chain together multiple security holes to reach their goal, taking over devices and stealing data. Leaving any holes unpatched weakens the overall security of a device.
“Modern operating systems include several security barriers … all of which typically need to be breached to remotely hack a phone. Owing to this complexity, a few missing patches are usually not enough for a hacker to remotely compromise an Android device,” the researchers wrote.
While criminals typically rely on social engineering to attempt to steal data from users, through malicious apps and the like, state-sponsored actors are more likely to exploit missed patches as part of their attacks using previously unknown methods, the researchers say.
Google’s Android product security lead, Scott Roberts, said: “We’re working with [SRL] to improve their detection mechanisms to account for situations where a device uses an alternate security update instead of the Google-suggested security update.
“Security updates are one of many layers used to protect Android devices and users. Built-in platform protections, such as application sandboxing, and security services, such as Google Play Protect, are just as important. These layers of security — combined with the tremendous diversity of the Android ecosystem — contribute to the researchers’ conclusions that remote exploitation of Android devices remains challenging.”
Guardian
