Google is Possibly Splitting the Android Security Patch Levels for Faster Security Updates

[xriqn]

So as far back as most Android users remember, Android has been in the spotlight for being less secure than its Apple counterpart, iOS, usually because of how restricted Apple make iOS in order to maintain high security standards. But according to Mishaal Rahman at XDA Developers, things are about to change. Google are going to be offering "enterprise grade security" in their devices, all thanks to a hardware security module used in the Google Pixel 2 series. In order to keep a device secure, you require continuous updates to patch any vulnerabilities, right? This is why Google use monthly security updates for all vendors to apply patches to known security threats and bugs. Alas, it seems these monthly bulletins are no longer enough. Rahman infers that Google may even be making changes to the patching system we currently see on Android, possibly to distinguish between framework patch level updates and vendor patch level updates along with things such as the bootloader and kernel, which would ultimately split all the layers of the security patch system so OEMs can identify the patch level they're using and provide pure framework updates. Due to the current system that Google uses for updates, the patching can take months, even years sometimes for just one monthly patch to reach a device. 

Quote

The chart below shows that Google and Essential provide the fastest monthly security patch updates while other companies fall behind. It can take months for an OEM to bring the latest patches to a device, such as how the OnePlus 5 and OnePlus 5T recently received the April security patch when they were previously on December’s patch.

However, according to Rahman, this new system should abolish most fragmentation as OEMs will be able to ship the latest Android OS security patches but the vendors would not be required to provide updated patches for that monthly patch level. The alternative to this? Rahman seems to think the alternative is that Google will just display the more minor of the two patch levels alongside possible bootloader and kernel patches to accurately display the patch level to an end user. Of course, this is unconfirmed as of now, but the people at XDA are hoping to find out more in the near future.  But again, according to Rahmaan this should

Quote

at the very least, this will be helpful for those of us on Project Treble Generic System Images (GSIs) and other AOSP-based custom ROMs as often custom ROMs only provide framework updates without patching all of the vendor, bootloader, and kernel patches that are specified in a monthly security bulletin, so the mismatch causes confusion among users as they think they are running the latest patches when in reality their device is only partially patched against the latest monthly security bulletin.

What do you think to all of this? Leave your comments down below!

 

Credit to Mishaal Rahmaan @ XDA Developers for the source of this news.

Source: https://www.xda-developers.com/google-separate-vendor-security-patch-android-security-patch-level/

[Crunchy Dragon]

Please edit your post to conform to Tech News posting guidelines or it may be moved out of Tech News.

 

[xriqn]

2 minutes ago, Crunchy Dragon said:

All the Tech News posts are like that, don't worry about it.

 

Cleaning thread now...

Fixed the initial post, changed my conclusion to the same one you'd find on XDA and a couple other bits.

[Crunchy Dragon]

-Thread cleaned-

[captain_to_fire]

The green color for the iOS row pleases my eyes. Just saying. 

 

Nonetheless, if one wants fast updates for their Android phone just like iOS, their choices are either get a Pixel or a Nokia (HMD) phone. It sucks that Blackberry which is known for their enterprise features doesn't receive updates after two years. I bet that Google will eventually get rid of Qualcomm Snapdragon in the Pixel phones in favor of their in-house chips just like Apple. 

https://arstechnica.com/gadgets/2016/08/why-isnt-your-old-phone-getting-nougat-theres-blame-enough-to-go-around/

[xriqn]

Just now, hey_yo_ said:

The green color for the iOS row pleases my eyes. Just saying. 

 

Nonetheless, if one wants fast updates for their Android phone just like iOS, their choices are either get a Pixel or a Nokia (HMD) phone. It sucks that Blackberry which is known for their enterprise features doesn't receive updates after two years. I bet that Google will eventually get rid of Qualcomm Snapdragon in the Pixel phones in favor of their in-house chips just like Apple.

Nah, they wouldn't. Android phones have mostly used SD chips for years and believe it or not, those chips have been the most dev friendly.

[captain_to_fire]

Just now, xriqn said:

Nah, they wouldn't. Android phones have mostly used SD chips for years and believe it or not, those chips have been the most dev friendly.

They did it already with Pixel 2's Pixel Core SoC which powers the cameras machine learning. They can do the same with SoCs.

 

[DrMacintosh]

A safer mobile space is always appreciated. Android is fragmented beyond belief and this might help that problem just a tiny bit by helping phones get the security updates they need. 

[xriqn]

Just now, huilun02 said:

Timely Android updates across the board will never be a reality as long as manufacturers and carriers insist on customizing the OS with their own bloat.

 

The only way is for devices to conform to a standard - to be designed to take a hardware-agnostic OS just like Windows. It can include a device model detection function which automatically download specifically tweaked API (by the manufacturer) to enable peak efficiency and any special hardware. Google can then push updates quickly and DIRECTLY to in-use devices just like Apple.

 

But no, that will never happen. Because Android phone manufacturers and retailers want our phones to not get updates, in the interest of using these updates as bait to sell us new phones over and over again.

 

In reality OS updates are not a big deal as long as the user isn't some casual who is easily brainwashed into compromising their own security. Sad to say that is not the case for majority of phone users. Most don't even know how their handheld device even works. Really sad.

It's not even bait to people like me. It's a signal that its time to go custom.

[xriqn]

37 minutes ago, huilun02 said:

S4 on custom Oreo, four healthy spare batteries

Capitalist haters can suck it up

Same but mini variant, no spare batteries since my battery is still healthy. Are you on lineage or different.

[ScratchCat]

1 hour ago, xriqn said:

Google are going to be offering "enterprise grade security" in their devices, all thanks to a hardware security module used in the Google Pixel 2 series.

Real security or Equifax grade enterprise security? As we have seen black boxes are not always particularly secure (Tizen OS, AMD Secure Processor, Intel ME, Asmedia firmware).

 

This and Project Treble should alleviate the main issue with Android handsets produced by non-Google/Essential  - the lack of updates. Additionally this combination will allow custom ROM users to obtain patches without waiting for the developer to implement the update.

 

1 hour ago, huilun02 said:

The only way is for devices to conform to a standard - to be designed to take a hardware-agnostic OS just like Windows. It can include a device model detection function which automatically download specifically tweaked API (by the manufacturer) to enable peak efficiency and any special hardware. Google can then push updates quickly and DIRECTLY to in-use devices just like Apple.

 

In reality OS updates are not a big deal as long as the user isn't some casual who is easily brainwashed into compromising their own security. Sad to say that is not the case for majority of phone users. Most don't even know how their handheld device even works. Really sad.

Treble is the beginning of this new standard - Treble-based phones will be able to update to newer versions of Android once the chipset manufacturer stops supplying updates even if the kernel source has not been released. Treble theoretically allows the use of Generic System Images from Google or any sort of custom ROM without major modification.

OS updates are needed as Android has had a number of security issues - Stagefright, QuadRooter etc

 

 

[xriqn]

1 hour ago, huilun02 said:

Unofficial LOS15.1 for GT-I9506

Its the late SD800 LTE variant. Performing better than Stock S5, because.

Unofficial 15.1 for GT-I9195I, aka the 64 bit one with slightly more processing power.

[xriqn]

2 hours ago, ScratchCat said:

Real security or Equifax grade enterprise security? As we have seen black boxes are not always particularly secure (Tizen OS, AMD Secure Processor, Intel ME, Asmedia firmware).

 

This and Project Treble should alleviate the main issue with Android handsets produced by non-Google/Essential  - the lack of updates. Additionally this combination will allow custom ROM users to obtain patches without waiting for the developer to implement the update.

 

Treble is the beginning of this new standard - Treble-based phones will be able to update to newer versions of Android once the chipset manufacturer stops supplying updates even if the kernel source has not been released. Treble theoretically allows the use of Generic System Images from Google or any sort of custom ROM without major modification.

OS updates are needed as Android has had a number of security issues - Stagefright, QuadRooter etc

 

 

I'm guessing Equifax grade security but even still it could all make Android better than its current state. I agree with you (and so does XDA) that essential and google get the latest Android updates too, maybe this new system will help OEMs move away from this and get closer to unifying security patch times.

[Doobeedoo]

That's great. Also I'd still like to get a phone that doesn't get cucked after 2y as far as updates. 

[xriqn]

9 minutes ago, Doobeedoo said:

That's great. Also I'd still like to get a phone that doesn't get cucked after 2y as far as updates. 

I agree, 2 years is piss poor in terms of updates, Apple support for 5 or something like that.

[xriqn]

If this did extend how long devices are updated for, I should hope it'd make our devices more secure (which I'm 99% sure it will).

[mr moose]

On 4/12/2018 at 1:26 AM, hey_yo_ said:

The green color for the iOS row pleases my eyes. Just saying. 

 

 

 

The almost identical follow up for MS further illustrates why I have always maintained it a good option for those who want iOS stability/security but on an android budget.