Comment by chickenbane | Hacker News Reader

Comment by chickenbane | Hacker News Reader

Parent Full thread

> you should have started on it years ago

As somebody who has been following Android for a while, this statement is incredibly unfair. The Android ecosystem is huge and remarkably safe. For those actually interested in the details, the Android security team releases annual security reviews, and the report for 2016 was just released: https://security.googleblog.com/2017/03/diverse-protections-...

The tldr: the number of devices with a harmful app is 0.05%, and for 1.5B devices extremely impressive. Basically, if you only install apps from Google Play and never enable unknown sources (the default and the vast majority of users) you are safe.

While the argument that most devices aren't running the latest security patch is certainly valid, it's important to note that there are many services running on device and in the cloud provided by Google which are doing most of the heavy lifting. If anything, the example of Stagefright actually shows the safety of Android - many many devices have never received any security patch to address Stagefright and yet most users aren't affected.

Citing Google's blog post for Android security is not very convincing. If Android is so secure, why are we seeing (often more frequently than) weekly headlines on Android security woes, often containing something like "millions of devices affected" (and often enough, no fix in sight)?

Also, quote from linked blog post:

> only 0.05 percent of devices that downloaded apps exclusively from Play contained a PHA.

1. What percentage of Android devices download apps exclusively from Play? They don't say. I, for one, have quite a few not so technical friends who sideload stuff. Also, pretty much all Android devices in Mainland China don't qualify for this criterion, and that's a huge number.

2. Given the track record of malware in Play Store, the number of devices containing a PHA is probably much larger than that of ones containing a known PHA.

> many many devices have never received any security patch to address Stagefright and yet most users aren't affected.

Not sure how you even know that. Not all exploits are visible.

>weekly headlines on Android security woes

stagefright is the last major Android vulnerability I'm aware of. Do you have sources for these? In my experience it's far less than weekly. Maybe yearly at most.

I could be exaggerating a little bit, but do check https://arstechnica.com/security/.

And where is your proof that Stagefright is actively being exploited? All you did was point to a scaremongering blog post with no data.

According to Adrian Ludwig, Android security director, not 1 Stagefright exploit has ever been seen in the wild according to the telemetry they receive from SafetyNet and the 1.4 billion devices it's installed on.

Would a successful targeted exploit be detected?

Yes.

Source: ask any female hollywood celebrity.

What about the Vault 7 releases?

In today's media environment is it strange scary-sounding headlines are published without deep analysis or actual evidence to back them up? But headlines saying devices are vulnerable is not evidence that the Android users are adversely impacted by PHA.

On the other hand, I referenced a report with actual numbers of devices impacted. Obviously you should be skeptical, but as you point out, if millions of devices affected is true, shouldn't we be seeing millions of instances of Android spam, remote roots, SMS fraud, botnets, etc.?

Yes, it is true that some users sideload, and threats to Android users vary a lot by country. There is only so much Google can reasonably do, and this is appropriate given Android is open source and has so many participants (device vendors, carriers, app stores, etc.). But it turns out with good integration with the developers, the distribution platform, and regular check ups, you can do a decent job at protecting your users.

You can also compare to other platforms and recall how devastating actual malware on Windows was, and how long Microsoft struggled (and still struggles) to protect their users. In Android, yes there are many vulnerabilities like Stagefright found, but in the end Android users are surprisingly safe.

> ... scary-sounding headlines are published without deep analysis or actual evidence to back them up...

Scary-sounding headlines, sure. But there usually is actual evidence.

> I referenced a report with actual numbers of devices impacted.

No, there is no "actual numbers of devices impacted". A number 1.4 billion is thrown out to impress; the pool of devices to which their analysis applies is much smaller, and of which only a percentage is given.

> if millions of devices affected is true, shouldn't we be seeing millions of instances of Android spam, remote roots, SMS fraud, botnets, etc.?

First, what you mentioned do exist. Maybe not in large numbers (not sure), but there's no guarantee they're not rising. Secondly, there are plenty of easier and more profitable channels for hackers these days. Please don't equate vulnerabilities not being exploited with being invulnerable.

> There is only so much Google can reasonably do.

Changing the subject? I was responding to "The Android ecosystem is huge and remarkably safe", and specifically how you quoted the blog post to back that up.

> ... in the end Android users are surprisingly safe.

Webcam users are surprisingly safe too. Not realizing their webcams are DDoS'ing some poor website right now, or their video feed is being streamed online.

> Scary-sounding headlines, sure. But there usually is actual evidence.

Actually, there usually isn't any evidence. Scary headlines sell, finding evidence is a hard work that most readers will not understand anyway. Guess what happens then.

> 1. What percentage of Android devices download apps exclusively from Play?

The entirety of China doesn't even have Google Play Store.

That's hardly Google's fault.

Who's fault is it? Why doesn't Google allow it to be installed on all devices?

>Who's fault is it?

Chinese Government.

>Why doesn't Google allow it to be installed on all devices?

You can install it on devices (with varying difficulty depending on if you can unlock bootloader). It just doesn't come pre-installed on any device sold within China.

While you certainly can, it isn't legal to do so. Plus it might not work very well.

I think there is a difference between Google branded Android and AOSP (Android Open Source). Anybody (users or carriers or phone manufacturers) can build and install AOSP, and Google can't provide updates or force them to install Google play store. Also, AOSP being open source is easier to tinker with (install apps from unverified sources etc.).

When media reports security bugs for Android, it is hardly clear whether the bugs affect AOSP or the Google branded Android, and to what extend.

It's directly Google's fault that even the Play Store app isn't available. They make Google Play not easily installable. Their own help page says, after looking for the app:

"If the Google Play Store app still isn't showing up, contact your carrier or manufacturer for help. "

Most Android issues arise due to either vendors which don't update the devices, or malicious vendors that actually pre-install malware (beware of phones ordered from aliexpress etc ...).

Android is open source, after all. Not much Google can do there.

Why wouldn't a device receive updates when the manufacturer abandons it? Most laptops from 2008 long abandoned by their manufacturers still run Windows 10.

If Microsoft can pull it off Google can do it too. No excuses.

>Citing Google's blog post for Android security is not very convincing.

So instead of believing metrics gathered from Google's SafetyNet telemetry from 1.4 billion devices you would rather believe scaremongering blog posts that have no concrete data to back up their claims?

>If Android is so secure, why are we seeing (often more frequently than) weekly headlines on Android security woes, often containing something like "millions of devices affected" (and often enough, no fix in sight)?

Do you really think it's that easy to exploit an Android phone? Once you have an exploit you must then chain it with other exploits to get around all of the Android security mitigation's in place. And then there's the fact that every OEM creates their own version of Android so not every exploit will work on every device or OS version - you can thank device and OS fragmentation for that one.

So this is why bugs like Stagefright never panned out to be the security armageddon that these click bait blog sites all wanted you to believe. Just because an exploit is discovered doesn't really mean it's being exploited in the wild.

> Just because an exploit is discovered doesn't really mean it's being exploited in the wild.

This becomes less and less true every year.

> 1. What percentage of Android devices download apps exclusively from Play? They don't say. I, for one, have quite a few not so technical friends who sideload stuff.

I also have an anecdote to share. The only app I've sideloaded and helped others sideload was the one I created myself. Out of 10 teenagers who are the most probably to tinker, 0 of them usually install apps from sources outside of the play store.

Why would you even count the lack of security for devices which are sideloading apps at all? I mean, there's a clear section in Android Settings called 'Security', and there's an option there to enable installing apps from Unknown Sources(set to OFF by default). When you try to enable that, it says this in clear words: "Your phone and personal data are more vulnerable to attack by apps from unknown sources. You agree that you are solely responsible for any damage to your phone or loss of data that may result from using these apps."

So if I give you a knife to cut fruits, and clearly tell you that you can also do juggling with it but it's not recommended and you should do it at your own risk, will you still blame me if you get hurt by knife juggling?

Wait a minute - users were requesting for years that Google change the permissions model of the Play Store from upfront to runtime permissions (like iOS does).

Google constantly shot that down and said how it works (agree to everything before downloading) was intentional and expected behaviour. They have finally changed that model now, but in my opinion this was pretty inexcusable and reckless.

I was unable to find the issue in the Android bug tracker now, but it's a pretty long thread.

I think "inexcusable" is very strong.

Maybe "lazy" is the best word, but moving from Android's classic "grant permissions on install" to "prompt for permission" is a major change that they spent a long time working on (I think Android 4 already had a lot of the backend for this?).

It's not like it was secretly granting permissions to apps, and you could always choose to not install something that took too many permissions.

You could say they made the wrong choice, but we're a long way from "this binary can do everything on your files" model of Unices/Windows

Inexcusable may be strong - but I wish I could find the thread I was referring to.

Perhaps they were working on it for a long time, but they were actively defending their stance for years after many people were requesting this, and after many incidents of Play Store apps intentionally doing more than expected (uploading contact lists, tracking location, etc...).

As someone who has developed and published Android apps, it was super frustrating to spend half your app description justifying each and every permission used, and still getting negative reviews simply because you had to request some scary looking permission for the most mundane feature addition.

iOS's permissions model is patented [0]. It takes some lawyer trickery to implement something that doesn't run afoul of the patent.

[0] https://www.google.com/patents/US8646100

You mean the same report where they cleverly omit the actual situation about updates across Android devices, by only mentioning flagship devices sold in 2016?

The purpose of the report is not say what the update situation is across Android devices, Google has a monthly dashboard for that: https://developer.android.com/about/dashboards/index.html

If you're interested in the Android update situation, Adrian Ludwig just gave a talk at Next, the Google cloud conference about it (he even references the Wikileaks CIA breach): https://www.youtube.com/watch?v=Zm6ziX5pqt8

He talks about the task starting with only 5 OEMs to keep their flagships updated. And you start to see the insane complexity of running the update train: this meant 29 devices. Multiply by the 351 carrier partners, which goes to 5000+ builds and variants. That all need to be tested by all the parties. =/

It sounds Google like has an even bigger and more complicated mess to clean up than Microsoft! But they dug the hole themselves, it's going to take them longer to fix it, and they should have started on it years ago.

The fact that the report doesn't even mention that there people like me that don't deserve updates, just because we aren't willing to pay over 500 € is what triggered me off.

The dasboard tracks versions in the wild, not the amount of users that were blessed with an update.

The report is presented in such a way, as if during 2016 the OEMs had a change of heart and now all provide updates.

Be careful what you wish for, my middle tier Motorola phone got an update a couple of weeks ago and has been crashing several times daily ever since. I'm not convinced their patching schedule is enough to make a real difference anyway.

> Basically, if you only install apps from Google Play and never enable unknown sources (the default and the vast majority of users) you are safe.

Except for the half a billion Chinese Android users who can't access Google Play.

Yeah I'm one of the Chinese users. You can never over estimate how expertised the Chinese apps are on stealing privacy.

Android smartphones sold in China almost always have unknown sources enabled.

Bullshit. I've never had a kernel update in six plus years from my carrier. And while they are kind of a micky-mouse operation, they are the 5th leading mobile provider in the US...

P.S. don't get service from US Cellular if there are other options

You aren't going to get kernel updates, even if you get major Android version update.

It's kind of like with RHEL - the fixes are backported in the old kernel vesion and that's it. It has nothing to do with your operator, you can thank Qualcomm and other SoC manufacturers, that they are not willing to make platform support packages for newer kernels for a given chip.

This isn't counting apps that are stealing people's data with their "permission" thanks to shitty UI design and google not caring.

Reply on news.ycombinator.com