Some Android phones “lied” about the security patch they are on

[D13H4RD]

Well, this sucks really bad.

 

Researchers from Security Research Lab (pretty obvious name, no?) uncovered a pretty grim reality where many phones even from top-tier OEMs like Samsung don’t actually have the required patches installed despite showing the appropriate patch date that should have meant that it was installed.

 

According to a chart which they have published, Google/Samsung/Sony/Wiko have missed 0-1 patches on average since October 2017, with Xiaomi/OnePlus/HMD phones falling down a tier, missing 1-3 patches on average, followed by HTC/Xiaomi/LG/Motorola, missing 3-4 patches and then TCL/ZTE, missing 4+ patches altogether.

 

Quote

While it’s disgraceful for the companies to misrepresent a security patch level, SRL points out that often chip vendors are to blame: devices sold with MediaTek chips often lack many critical security patchesbecause MediaTek fails to provide the necessary patches to device makers. On the other hand, Samsung, Qualcomm, and HiSilicon were far less likely to miss providing security patches for devices running on their chipsets.

 

As for Google’s response to this research, the company acknowledges its importance and has launched an investigation into each device with a noted “patch gap.” There’s no word yet on how exactly Google plans to prevent this situation in the future as there aren’t any mandated checks in place from Google to ensure that devices are running the security patch level they claim they are running.

Source: https://www.xda-developers.com/android-oem-lying-security-patches/

 

Another bizarre thing is that even phones from the same manufacturer would wildly differ based on how “honest” it was about what patch it was running on.

Quote

SRL found that one Samsung phone, the 2016 J5, was perfectly honest about telling the user which patches it had installed and which it still lacked, while Samsung's 2016 J3 claimed to have every Android patch issued in 2017 but lacked 12 of them—two considered as "critical" for the phone's security.

Source: https://www.wired.com/story/android-phones-hide-missed-security-updates-from-you/

 

I’ve said if before, any OEM not named “Google” sucks ass when it comes to updates and if this is indeed the case for “lied” patches, then it only serves to affirm my stance.

[DrMacintosh]

That is so odd. What do OEMs get from lying about what their devices are running? Oh....thats right, more ways to weasel out of actually supporting your products more than a year after it is released. 

 

Mobile security on Android devices other than Googles seems to be pretty sketch man. 

 

It is a shame Androids update system is the way it is.  

[D13H4RD]

6 minutes ago, DrMacintosh said:

That is so odd. What do OEMs get from lying about what their devices are running? Oh....thats right, more ways to weasel out of actually supporting your products more than a year after it is released. 

 

Mobile security on Android devices other than Googles seems to be pretty sketch man. 

 

It is a shame Androids update system is the way it is.  

Nah, they could just choose to never update it for months and then suddenly release it only to leave you in the dust again. 

 

Many, MANY Android OEMs are like this, even for top tier flagships 

[BlueChinchillaEatingDorito]

Isn't it sad that I'm sort of not surprised considering how many devices these brand release? Also not surprised the most aggressions ones are the Chinese brands.

Spoiler

 

[DrMacintosh]

I hope Google can arrange more control over the software update side of their OS. With all these dumb skins, launchers, and custom UIs that Android OEMs put on their phones I can see why that might cause a problem, but I bet you people would rather have stock android than something like TouchWiz if it meant getting updates. 

 

 

[DrMacintosh]

 

31 minutes ago, valdyrgramr said:

The only ones that get a ton of updates are mainline Galaxy phones

But how many of those get any real meaningful support time? What a year after launch? Maybe 2?

Edited April 13, 2018 by airdeano

[BlueChinchillaEatingDorito]

9 minutes ago, Blademaster91 said:

Meanwhile Apple just slows down or bricks your device after an update, it sucks either way and whats worse imo is Google stopped selling the Pixel phones.

I wasn't aware Samsung had so many phone models, no wonder why they don't update them all. Not surprised either that the mediatek soc's are the worst.

Well you have of course the S and Note series, then you got the A series which includes A3, A5, A7, A8, A9, the C series (C5, C7, C5, C8), and J Series (a bunch JXs). I'm probably still missing a bunch.

 

Then you have the tablet lineup with the Tab A, Tab E, Tab Pro, and Tab S.

 

So yea, their line up is large which for them to be one of the better ones in terms of number of missing updates, is pretty good. Not perfect, but you could do a lot worse. Not to mention you have the yearly releases which have updates for the next ~2 years.  

[Guest The Viking]

19 minutes ago, DrMacintosh said:

But how many of those get any real meaningful support time? What a year after launch? Maybe 2?

depends on the brand, model and year. It's a huge hit and miss. 

 

From my own experience, with Huawei:

 

5 years ago, huawei would only support their flagships 1 year max. So you would get 1 update then done.

They then moved to 2 updates per high end device.

They now promise 2 to 3 years of support per high end device. The P9, from 2016, is getting Oreo 8.0 soon, it's already in testing phase. P10 too. P8, 2015, not scheduled, so probably not.

 

A weird thing is my Mediapad X1, from 2014, got an update at the end of 2017, which is... unexpected? No updates for 3 years and suddenly we get a security patch.

 

It seems chinese manufacturers prioritaze the chinese market first, so local devices get the update first and europe is last, but we still get it.

 

Not sure about other brands.

[airdeano]

umm, a lot of this has been removed to keep on-topic of security patch application.

seems some want to make it about apple and android.. lets stop that now and talk to the topic of application to security patches, whether they are implemented soon enough or not..

[DrMacintosh]

13 minutes ago, The Viking said:

depends on the brand, model and year. It's a huge hit and miss. 

That is Googles largest problem. They allowed anyone to start up and put their OS on a phone. Now you would think that that would not be that big of a deal, but because of the nature of Android these OEMs get some level of control over aspects of Android and how it exists on a device. 

 

Imo I think Google should take a more authoritative stance on the conditions of being able to use Android on devices to ensure that at the very least security patches are only an option to the end user. (that way you avoid annoying forced updates)

[D13H4RD]

42 minutes ago, DrMacintosh said:

but I bet you people would rather have stock android than something like TouchWiz if it meant getting updates. 

Here’s the thing

 

People are unfortunately still in the “Windows Update” mindset when it comes to updates, in that they would rather keep their devices on the current version if it meant that it works fine and they won’t have to get used to any UX changes. One of the biggest problems is that updating renders a device useless for a certain period of time (usually a few minutes) while the update process is being undergone. Seamless updates aims to solve that by installing it in the background and only requiring a reboot that takes no-longer than a standard reboot to apply, but sadly, very, VERY few Android phones have this.

 

Treble is one area where Google aims to make this a little better. I do one day hope that the front-end UX layer and the back-end layer ends up being separated so they can be updated independently of each other.

40 minutes ago, DrMacintosh said:

 

But how many of those get any real meaningful support time? What a year after launch? Maybe 2?

Usually 2-3 years of guaranteed updates. After that, you may continue to get patches, but at a significantly more irregular period

[DrMacintosh]

2 minutes ago, D13H4RD2L1V3 said:

 

People are unfortunately still in the “Windows Update” mindset when it comes to updates, in that they would rather keep their devices on the current version if it meant that it works fine and they won’t have to get used to any UX changes. One of the biggest problems is that updating renders a device useless for a certain period of time (usually a few minutes) while the update process is being undergone. Seamless updates aims to solve that by installing it in the background and only requiring a reboot that takes no-longer than a standard reboot to apply, but sadly, very, VERY few Android phones have this.

Android culture pitfall I guess. I hate to bring up Apple again but they have managed to keep the vast majority of people running the latest version of iOS since, well iOS 5 I think. 

 

Google should really look into what causes people on iOS to be so eager to update to the new version to see how they can improve themselves and emulate that drive to update without forcing updates on the end user. 

[Guest The Viking]

3 minutes ago, DrMacintosh said:

Imo I think Google should take a more authoritative stance on the conditions of being able to use Android on devices to ensure that at the very least security patches are only an option to the end user. (that way you avoid annoying forced updates)

google's problem. Android itself is crap, i refuse to use stock due to how bad it looks.

 

google just seems to rush out stuff. Android Wear? piece of crap of software, 2 years to make it look like something and still bad.

 

Android? ohh let's allow anybody, even the carriers, to play around. Let's not bother having to update stuff like microsoft does, no no no, let's allow carriers & manufacturers to push the update... or not.

 

though until now the way it worked would be by breaking the skin the phone used so...no wonder most manufacturers don't bother, they have to design and optimize the skin once for launch, and again every time they want to update the phone. With huawei it takes months of testing per device, so they'll announce that "p10 gets oreo 8.0" then you need to wait half a year to get it, due to the amount of markets & versions that have to be tested.

 

now they've put the treble... i'm not confident it'll solve the issues.

 

Besides, do we really need a new version of android every 6 months????

[DrMacintosh]

2 minutes ago, The Viking said:

Besides, do we really need a new version of android every 6 months????

 Nah who wants their phones to be able to do new things or be more secure!

[Guest The Viking]

5 minutes ago, DrMacintosh said:

Android culture pitfall I guess. I hate to bring up Apple again but they have managed to keep the vast majority of people running the latest version of iOS since, well iOS 5 I think. 

 

Google should really look into what causes people on iOS to be so eager to update to the new version to see how they can improve themselves and emulate that drive to update without forcing updates on the end user. 

apple only has 3 devices to update across the board. Oh, wait, maybe just 2, with all the copy/paste & refreshing they do. It's not the same to test and update 3 devices that cover 90% of your userbase than having to update 30 different devices per manufacturer per year, all having some kind of difference.

 

It's called choice. It's both good and bad. At least we get to choose from a large amount of devices, all with some unique thing to them, not like apple.

 

[Drak3]

3 minutes ago, The Viking said:

Besides, do we really need a new version of android every 6 months????

What, you don't enjoy seeing how Google can fuck everything up on a yearly basis, and make their products continually worse?

 

Blasphemy.

 

/s

[DrMacintosh]

1 minute ago, The Viking said:

It's not the same to test and update 3 devices that cover 90% of your userbase than having to update 30 different devices per manufacturer per year, all having some kind of difference.

And that is Androids problem, its fragmented and that is keeping it down. 

 

I get that Google has a lot on its plate, but that is not a reason for an OS to become subject to OEMs doing stuff like lying about what updates your phone has. 

[mr moose]

10 minutes ago, DrMacintosh said:

Android culture pitfall I guess. I hate to bring up Apple again but they have managed to keep the vast majority of people running bricking at the latest version of iOS since, well iOS 5 I think. 

Fixed that for you.

 

10 minutes ago, DrMacintosh said:

Google should really look into what causes people on iOS to be so eager to update to the new version to see how they can improve themselves and emulate that drive to update without forcing updates on the end user. 

Becasue the last update slowed their phone to the pouint they thought they needed a new one.

 

 

Bottom line is all phones are shit at something,  Apple have taken a more unethical turn of late, google are just hard to get updates on and Windows never had any app support.   

[Guest The Viking]

Just now, DrMacintosh said:

And that is Androids problem, its fragmented and that is keeping it down. 

 

I get that Google has a lot on its plate, but that is not a reason for an OS to become subject to OEMs doing stuff like lying about what updates your phone has. 

i'm not even sure it's the OEMs 100% fault, if some devices have the right patch and others not. That could just be google doing its own thing.

 

but yeh, i get your point. Then again, yeah, I don't expect a company releasing 30 different phones a year to keep up with all of them.

[DrMacintosh]

2 minutes ago, mr moose said:

Fixed that for you.

You did not. 

2 minutes ago, mr moose said:

Becasue the last update slowed their phone to the pouint they thought they needed a new one.

More intelectual dishonesty. 

 

You are also drifting the thread back to the reason it got locked the first time. 

[mr moose]

Just now, DrMacintosh said:

You did not. 

More intelectual dishonesty. 

Are you saying apple updates haven't slowed, bricked or otherwise caused issues on iphones?   

 

All phones are the same in that they all have issues that are not acceptable to the end user.  This is about android. If you want to make it about apple go in to the general sub forum and start your own Apple versus android thread.  Otherwise you are going to have to accept the fact that when it comes to updates, apple are no better than any of the others.

[Blademaster91]

7 minutes ago, mr moose said:

Fixed that for you.

 

Becasue the last update slowed their phone to the pouint they thought they needed a new one.

 

 

Bottom line is all phones are shit at something,  Apple have taken a more unethical turn of late, google are just hard to get updates on and Windows never had any app support.   

Exactly, everyone is doing something awful,and the more crap Apple does, Android phone companies love to follow. I pointed that out too but apparently I was being off topic,yet the Android bashing isn't,lol.

So surprised this turned into Apple vs. Android again /s

[DrMacintosh]

4 minutes ago, mr moose said:

Are you saying apple updates haven't slowed, bricked or otherwise caused issues on iphones?   

No, but you are saying that this is what iOS updates set out to do, which there is simply no basis for since the inception of iOS in 2007. 

 

4 minutes ago, mr moose said:

This is about android. If you want to make it about apple go in to the general sub forum and start your own Apple versus android thread.

Ironic

 

It is about Android, but you don't get to say that while you attack Apple and then turn around and say that I am making this into a Apple thread. You just don't. You're instigating. 

[Blebekblebek]

Whats with these constant bitching about irrelevant topics

We know that Android is fragmented and it is a gift and a curse

 

But then again what's the point since most people focusing only with 2 brands, which is samsung and apple

How about stop using both for a change.

 

Most patches also are released based on apps anyway, even if the phone didn't get major updates/fix, the major apps usually cover that anyway, and if the os is outdated then the apps simply refuse or can't be installed.

 

for example new firefox quantum can't be installed into android 4.4.2 or lower.

[captain_to_fire]

I hope Google finally ditches Qualcomm in favor of their in-house SoCs.