this post was submitted on 23 Jul 2023
2 points (100.0% liked)

Android

9335 readers
1 users here now

A place to discuss anything related to Android or Android adjacent.

INFO:

Check Out Our Partner Communities:

!android@lemmy.world

founded 4 years ago
MODERATORS
JshKlsn@lemmy.ml
LucasDondo@lemmy.ml
2
Better understanding and mitigating the risks of using a phone that no longer receives system updates (lemmy.ca)
submitted 1 year ago by BuoyantCitrus@lemmy.ca to c/android@lemmy.ml
1 comments fedilink hide all child comments
 

cross-posted from: https://lemmy.ca/post/1926125

Too many perfectly usable phones are put into a questionable security situation by lack of vendor support for keeping key software up to date.

But what's the actual risk of using an Android phone on a stock ROM without updates? What's the attack surface?

It seems like most things that'd contact potentially malicious software are web and messaging software, but that's all done by apps which continue to receive updates (at least until the android version is entirely unsupported) eg. Webview, Firefox, Signal, etc.

So are the main avenues for attack then sketchy apps and wifi points? If one is careful to use a minimal set of widely scrutinised apps and avoid connecting to wifi/bluetooth/etc. devices of questionable provenance is it really taking that much of a risk to continue using a device past EOL?

Or do browsers rely on system libraries that have plausible attack vectors? Perhaps images, video, font etc. rendering could be compromised? At this point though, that stack must be quite hardened and mature, it'd be major news for libjpg/ffmpeg to have a code-execution vulnerability? Plus it seems unlikely that they wouldn't just include this in webview/Firefox as there must surely be millions of devices in this situation so why not take the easy step of distributing a bit more in the APK?

I'm not at all an Android developer though, perhaps this is very naive and I'm missing something major?

you are viewing a single comment's thread
view the rest of the comments
[–] GenderNeutralBro@lemmy.sdf.org 1 points 1 year ago

To get a real answer, you'd need look at the security patches that you're missing out on. Here's a brief write-up of the July Android security patches: https://www.bleepingcomputer.com/news/security/android-july-security-updates-fix-three-actively-exploited-bugs/

So this month, you'd be missing out on some pretty severe fixes if you are running a phone with a Mali GPU (which includes many phones with chips made by Mediatek, Samsung, and Google) if your phone is not receiving timely security updates. I'm not aware of any vendors besides Google who commit to monthly security patches (please let me know if there are any), so this is a problem even on actively-supported models.

There's also a patch for a bug in a graphics library. While that was previously patched in Chrome, other apps using the system implementation would still be vulnerable.

Historically, I recall some very severe bugs that had no real defense except "pray that nobody targets me". For example, I ditched my Galaxy S7 specifically because Samsung went months and months without integrating Google's security patch for Blueborne, which made it possible for anyone in your general vicinity to potentially gain full control of your device. I was not comfortable giving up Bluetooth entirely, and not comfortable leaving my device wide open to attack.