Android overtakes Windows as the internet’s most used operating system

There clearly hasn't been any major deployment of this - especially at the scale of Blaster or Conficker.

It's "trivial" perhaps for a single device but every device is different and it'd require its own exploit code, exploit mitigation features cause it to be difficult to actually exploit too - making it quite problematic to deploy in practice.

No it's not. Where are all of the Stagefright exploits? This was supposed to be Android's security armageddon according to the scaremongering bloggers. And yet nothing happened. According to Google's telemetry of over 1.4 billion phones there has not been 1 case of a Stagefright exploit in the wild. So your assumption that Stagefright is "trivially weaponizable" is inconsistent with your knowledge of Android security and mitigations.

The sad part is that the 2016 security report just came out and they brag how the whole security improved, without mentioning the elephant in the room.

Google IO is around the corner and I bet they will keep talking as if everyone could upgrade right away to Android O, with N now having barely 2%.

Suffice to say, if it was as easy as waving the magic wand you think it is, it would have happened already.

Instead, if you tried to wave it, handset makers would have walked and just done something else. Heck, some did!

Besides, why stop at Google? Why not blame the carriers for devices like this be on their networks?

By your logic, if Verizon told Samsung tomorrow said "you must update your phone monthly with security updates in order to stay connected to our network" it would have just happened!

Maybe instead of assuming a vast lack of caring or outright maliciousnss, you should consider that maybe it's not the trivial thing you are making it out to be, and that's the real reason it hasn't happened yet.

1. Insert install disc/USB. 2. Boot to install disc. 3. Spam the next button.

Installing new Android OS versions manually often involves custom third party unlock tools from sketchy download sites.

I get Windows security updates on every damn computer I buy. Yes, the computer is pre-loaded with bloat, but I still get updates like everyone else.

Meanwhile, on Android, I mostly get nothing. What is so fundamentally different between PC and phone? Why is it so hard on mobile phones?

Stable binary driver ABI. Hardware monoculture. Expensive driver certification program. Letting hardware vendors release binary drivers without releasing the corresponding sources. An opt-out automatic update mechanism.

(Disclaimer: I work at Google, but not on the Android team.)

(And device manufacturers do this too, but it's a ton easier to, say, fix flash with a shim than it is to fix networking.)

The reason your question is "stupid" is because you think your phone is just one computer.

In fact, you can do just what you describe - and it wouldn't be that difficult - but it would only be for the application processor and you would end up with a nice PDA.

In order to make phone calls you would also need to control the other two, fully functional, general purpose computers inside of your phone: the baseband processor and the SIM card.

Currently, there is no way for you to control either of those in any meaningful way.[1]

There are deeply entrenched economic and technical forces standing in the way of controlling your own baseband processor and we are nowhere near to doing it.

[1] Osmocom on 2G phones is not meaningful, no matter how impressive and interesting it is.

By the way, the upstream Linux kernel supports the Nexus 5X! http://www.phoronix.com/scan.php?page=news_item&px=Linux-4.9...

And the bootloaders are based on fastboot pretty much everywhere I think? At least that was the case with the non-Google-related HTC phone I've had.

Have look at Redhat, how far got them requiring UEFI at server ARM boards. That's market, where the buyers have much more impact on the design than mobile.

Only with Windows 10 Mobile they engineered a strong way to upgrade the OS without needing vendor intervention too much (or at all?), it is a shame Windows Mobile market share as fallen so low and Windows Mobile is not even a priority of MS anymore :/

On Linux side, some (most?) phone vendors are most of the time not supposed to distribute the kernel and their binary-only driver the way they do it, because most of those distributions are likely GPL violations. The sad thing is some high profile organisations (Linux Fondation comes to mind) don't give a fuck about licence compliance, which is insane given the technical side NEEDS licence compliance in order for the end result to work well and not be dangerous for end-users for a large part of the ecosystem. (Worse, the Linux Fondation happily accept obvious GPL infringers at the highest levels.)

Anyway the kernel part is a small part in an Android distribution, and I'm not sure anything is available to handle the security update problem, or that somebody is even working on it... The technical update model MS has chosen is the way to go and Google is endangering us all by having such a huge market share and not wanting to take any responsibility that should come with it. (It's even worse given how Android has reached this market share levels, using practices that would make look past MS ones as respectful of competition!)

Linux has a driver API; the interfaces are not as stable as windows but they are there - the vendor shoehornning has more to do with closed hardware blobs, drivers not being developed in the open, and profits than a few struct member tweaks here and there shifting across android releases..

the handset manufacturers have no profit incentive to ensure that the phones are compatible for a longer term, and keeping the hardware drivers closed/behind version-specific blobs serves as convenient way to facilitate planned obsolescence

plenty of windows hardware doesn't get new drivers across OS release boundaries for the same reasons so slightly better API stability is not really a very good argument here on its own..

Two minutes is probably too short, but an hour? Maybe not.

Windows even included a utility to let people use it as a router on home networks to "share internet connections". https://support.microsoft.com/en-us/help/310563/description-...

I witnessed this myself back in the day. I was probably about 14 at the time, had just freshly reinstalled a machine, installed AV (from a CD, hah.) and connected it to the internet for the first time via PPPoE DSL. Within minutes I had AV popups from having been hit by Blaster before I could even update Windows. In that day, few people had routers or WiFi, many, my family included just had a single machine connected to a modem directly and so had no NAT.

It was never individual attackers - it was worms running on other systems that had reached critical mass and were just hitting random IPs on the internet with the exploit in an attempt to infect more systems.

You're extremely unlikely to see something this bad with a modern OS - most of the time you're behind a NAT, provided by your router or your mobile provider which effectively blocks inbound connections. There's also exploit mitigations like NX and ASLR which are pretty much how the Stagefright bug didn't turn into a nice new MMS worm - it just sounded scary, but over a year later we've not seen any major attacks from it.

If you plug directly into the internet or DMZ your machine, you'll still see this type of stuff. I've heard it called "internet background radiation" - old worms out scanning for possible targets to this day.

Today, yes. But back in those days? I'm not so sure. IIRC, almost everyone had a public IP.

I had a single device and had to do a fresh install from factory settings. This meant I had about 30 mins before my 500kbps connection would grind to a crippling halt from all the accumulated malware.

This meant I had to incrementally procure protection, save it, then fresh install and repeat until I could access the Internet safely.

I don't miss those days.

You could check how frequent the attacks were by yourself. I was using a custom firewall software, called ZoneAlarm, to see how many attacks I was receiving in a day. The log said literally every few minutes, the infectious Blaster worm packet was received. It was like how frequent your SSH server is attacked with random passwords - you can see this from the SSH server log too.

At the peak it got so bad that IPSs were blocking affected ports on all consumer connections just to save bandwidth.

https://en.wikipedia.org/wiki/Blaster_(computer_worm)

At the peek couple of months your computer would BSOD _during_ installation process, right after initializing network interface and RPC service.

You will see random scanning attempts within minutes. Same principle , minus the effectiveness.

You could basically do "NET SEND 12.34.56.78 my spam message" and it would appear on the screen of your victim.

http://blogopod.com/image/2008/net-send-spam-big.gif

Heh, I remember when Apple used that as a feature. Instead of updates, it downloaded your email and other things you'd want to have already available when you open your laptop.

It does, but it's also operating in a much more hostile environment. At least windows had regular updates though, that's not the case for most android phones.

My work laptop and one or two of my private machines have no HDD light, either. It drives me crazy.

For Windows, there is a tool called HD Activity Indicator. It only works after logging in, obviously, but still better than nothing.

That competition is only on the surface. For SoC, GPU, baseband, radios etc., you are stuck with Qualcomm. Or maybe Samsung's exynos, which isn't necessarily better.

stagefright is the last major Android vulnerability I'm aware of. Do you have sources for these? In my experience it's far less than weekly. Maybe yearly at most.

On the other hand, I referenced a report with actual numbers of devices impacted. Obviously you should be skeptical, but as you point out, if millions of devices affected is true, shouldn't we be seeing millions of instances of Android spam, remote roots, SMS fraud, botnets, etc.?

Yes, it is true that some users sideload, and threats to Android users vary a lot by country. There is only so much Google can reasonably do, and this is appropriate given Android is open source and has so many participants (device vendors, carriers, app stores, etc.). But it turns out with good integration with the developers, the distribution platform, and regular check ups, you can do a decent job at protecting your users.

You can also compare to other platforms and recall how devastating actual malware on Windows was, and how long Microsoft struggled (and still struggles) to protect their users. In Android, yes there are many vulnerabilities like Stagefright found, but in the end Android users are surprisingly safe.

The entirety of China doesn't even have Google Play Store.

Android is open source, after all. Not much Google can do there.

So instead of believing metrics gathered from Google's SafetyNet telemetry from 1.4 billion devices you would rather believe scaremongering blog posts that have no concrete data to back up their claims?

>If Android is so secure, why are we seeing (often more frequently than) weekly headlines on Android security woes, often containing something like "millions of devices affected" (and often enough, no fix in sight)?

Do you really think it's that easy to exploit an Android phone? Once you have an exploit you must then chain it with other exploits to get around all of the Android security mitigation's in place. And then there's the fact that every OEM creates their own version of Android so not every exploit will work on every device or OS version - you can thank device and OS fragmentation for that one.

So this is why bugs like Stagefright never panned out to be the security armageddon that these click bait blog sites all wanted you to believe. Just because an exploit is discovered doesn't really mean it's being exploited in the wild.

I also have an anecdote to share. The only app I've sideloaded and helped others sideload was the one I created myself. Out of 10 teenagers who are the most probably to tinker, 0 of them usually install apps from sources outside of the play store.

So if I give you a knife to cut fruits, and clearly tell you that you can also do juggling with it but it's not recommended and you should do it at your own risk, will you still blame me if you get hurt by knife juggling?

If you're interested in the Android update situation, Adrian Ludwig just gave a talk at Next, the Google cloud conference about it (he even references the Wikileaks CIA breach): https://www.youtube.com/watch?v=Zm6ziX5pqt8

He talks about the task starting with only 5 OEMs to keep their flagships updated. And you start to see the insane complexity of running the update train: this meant 29 devices. Multiply by the 351 carrier partners, which goes to 5000+ builds and variants. That all need to be tested by all the parties. =/

Maybe "lazy" is the best word, but moving from Android's classic "grant permissions on install" to "prompt for permission" is a major change that they spent a long time working on (I think Android 4 already had a lot of the backend for this?).

It's not like it was secretly granting permissions to apps, and you could always choose to not install something that took too many permissions.

You could say they made the wrong choice, but we're a long way from "this binary can do everything on your files" model of Unices/Windows

[0] https://www.google.com/patents/US8646100

It's kind of like with RHEL - the fixes are backported in the old kernel vesion and that's it. It has nothing to do with your operator, you can thank Qualcomm and other SoC manufacturers, that they are not willing to make platform support packages for newer kernels for a given chip.

Android smartphones sold in China almost always have unknown sources enabled.

This makes a lie of the whole notion that Android is open source. Yes, the skeleton is open, but the guts are proprietary. And the skeleton on its own is useless.

Yes, they can. Google makes a conscious choice not to make them open source. There's no fundamental law or anything saying that they can't.

I think the better question is: Why do those services need to phone home? There are plenty of apps that should work just fine without doing that, but don't.

Actually I think what you're saying is the biggest mistaken belief in the programming industry. The industry has been chasing the dream of making programming accessible for everyone for as long as computers have existed. This was the reasoning behind COBOL, BASIC, and Scratch.

> You can't import random libraries, and you can't write spaghetti code, because you are writing in a highly constrained DSL. It's still real code. It's still a Turing machine.

If it's Turing complete then someone can and certain would write spaghetti code. Every constrained environment that ever existed for lay people to use ends up in the hands of frustrated programmers.

> There's no reason the marketing team can't write this file.

There's no reason why they couldn't just drag and drop such logic and prefer to do it as well. Most people have trouble understanding how to work with Turing complete languages to accomplish advanced tasks. Programmers aren't purposely trying to make their environments difficult -- in fact making everything as easy as possible has been the goal since the beginning.

> You could do the "hours of thinking and planning" so that your colleagues could write the high level business code.

Honestly that High level business code that you sort of dismiss is the hard part. Knowing to gather requirements and codify them is the job a programmer. It's a job in itself different from other jobs. It will never be a job for non-programmers and maybe not even junior programmers.

[1] They often bundled a CD with lots of free software with their magazine issues, e.g. different distros of Linux, server software, utilities, etc. All free or trial software, usually. I remember they bundled the QNX OS once, and I installed it and tried it on my PC. It was very light and fast, had a GUI too - Photon, IIRC. They might even have bundled BeOS once. I think I tried installing that too, but it did not work on my PC.

In the case of OSes, it is beneficial to formalize these similarities into a single API. As long as the operating systems remain conceptually simmilar, there is no point in unnessasarily fragmenting the API. When there is need to deviate from the common Unix system, Unix-like operating systems have no problem doing so. But there is not strong enough reason to through out the massive amount of investment, both in software and human expertise, that has been built up on the common Unix base.

Once it was clear developers were ok with using Objective-C, Java Bridge was shown the door.

Back in the early days of the micro-computer, many games used a virtual machine of sorts. The game logic was implemented in VM bytecode and then the VM engine was the only thing that needed porting between systems.

This was to a greater or lesser degree aided by the limited hardware of the time, and that said computers were single task more often than not.