Google and Samsung will release new security updates for Android phones every month, in an attempt to prevent the platform from falling behind in the fight against malware.
The two companies’ announcements come in the wake of an embarrassing bug in Android’s media handling framework, called Stagefright, which had been dubbed “Heartbleed for mobile” after the desktop virus of that name. Despite being warned about Stagefright in April, the vast majority of Android phones were weak to the vulnerability when security researcher Joshua Drake went public with it 90 days later.
Alongside the new frequent security updates, Google has finally released a patch for Stagefright for its own Nexus line of phones, which it sells directly to customers. The company argues that the majority of users weren’t at risk, however, with application sandboxing limiting the amount of damage an attacker could do.
Adrian Ludwig, lead engineer for Android Security, said: “From this week on, Nexus devices will receive regular OTA updates each month focused on security, in addition to the usual platform updates … Nexus devices will continue to receive major updates for at least two years and security patches for the longer of three years from initial availability or 18 months from last sale of the device, via the Google Store.”
Samsung partially matched Google’s offering, confirming that users of the company’s mobile phones would receive their own security updates once a month. Dong Jin Koh, Samsung’s head of mobile research, said: “With the recent security issues, we have been rethinking the approach to getting security updates to our devices in a more timely manner. Since software is constantly exploited in new ways, developing a fast response process to deliver security patches to our devices is critical to keep them protected.
“We believe that this new process will vastly improve the security of our devices, and will aim to provide the best mobile experience possible for our users.” Samsung has not, however, matched Google’s promise to patch devices for at least three years from release.
The Android platform has been regularly criticised for the time it takes for it to get critical security updates to users. Google, which runs the Android Open Source Project, the coding initiative at the heart of the operating system, does not have direct relationships with the vast majority of Android users. Instead, it fixes the open-source part of Android, before passing the fixes on to device manufacturers such as Samsung.
Frequently, those manufacturers themselves then have to check with the mobile phone carriers before they are able to push out updates to the devices. Given the low profit margins on many Android phones, support dries up quickly.
In July, security reporter Lorenzo Franceschi-Bicchierai wrote that these problems had led him to ditch the platform entirely for Apple’s iPhone.
He wrote: “This is the fundamental difference between Android and iPhone. When there’s a bug on iOS, Apple patches it and can push an update to all iPhone users as soon as it’s ready, no questions asked.
“When the same thing happens with Android, Google patches and then … God knows when the AT&Ts, Verizons, HTCs, and Sonys of the world will decide it’s important enough that they should care and send you the update with the patch (though, to their credit, they’re starting to care, mostly because having an updated OS is now seen as a competitive advantage). Hell, even Google-owned Nexus phones, which the company has full control over, haven’t been patched for Stagefright yet.”
Following Google’s announcement, the most popular Android are, or will be, fixed this month. The company confirmed fixes for the HTC One M7, One M8, One M9, LG Electronics G2, G3, G4 and Sony Xperia Z2, Xperia Z3, Xperia Z4, and Xperia Z3 Compact.
No comments:
Post a Comment