Why Google won't fix a security bug in almost a billion Android phones

http://www.engadget.com/2015/01/14/google-security-bug-billion-android-phones/

by moe • 11 years ago

51 47 11 years ago

zues• 11 years ago

A more detailed response is here: https://plus.google.com/117193854832907724231/posts/1md7ruEw...

fidotron5• 11 years ago

That's no so much a response as a wall-of-text that attempts to deflect any responsibility from Google at all. Given that they are so keen on pointing out the weaknesses of others in exactly this area they really need to make sure their own shit is together much better.

ryanhuff3• 11 years ago

Sheez. So when the broken code in question is over 2 years old, and is hard to fix, then Google just washed their hands of it? Google is a big company with substantial resources. How about they support their customers beyond the "new and shiny period" like many, many other companies do?

divegeek3• 11 years ago

Google could invest the resources to create patches. What Google can't do is get those patches delivered to end-user devices. Given the fact that if Google provided patches they'd never reach users anyway, why should Google bother? And we know that OEMs won't provide updates because they are already refusing to provide the one that has existed for some time now: Android 4.4.

(Disclaimer: I'm a Google employee, and I work on Android security, but I'm not a spokesperson and these are only my own opinions.)

Zigurd4• 11 years ago

Is it that PR people are pushing this story, or that the clickbait potential of the headline is irresistible?

The fact is that Android 4.0+ can use Chrome, which doesn't have this bug. That's 85%+ of the installed base. This is an uncontroversial as any of the other bugs recently closed as NTBF.

mccr8• 11 years ago

That doesn't help with apps that use WebView to render web content.

guelo• 11 years ago

WebView is embedded in many apps so using Chrome, or Firefox, won't help.

divegeek3• 11 years ago

Correct. At present the only solution for pre-4.4 devices is to avoid using WebView to display untrusted content. If you're an app developer using WebView you should make sure it's only displaying trusted content which means either local content or remote content from trusted sites with non-broken SSL. I recommend using Google's recently-released nogotofail toolkit to test for SSL breakage (https://github.com/google/nogotofail).

The ideal fix for this problem is for OEMs to update devices to 4.4.

ryanhuff3• 11 years ago

I suspect that your average Android user has no idea about the browser on their phone. These are the users who are most at risk.

Also, correct me if I am wrong, but app-based webviews (or app actions that spawn a browser instance) would defer to the default browser, ignoring any installed 3rd party browser. So i believe that the "install chrome" solution does not actually resolve the problem.

irremediable• 11 years ago

Also, correct me if I am wrong, but app-based webviews (or app actions that spawn a browser instance) would defer to the default browser [...]

I think that is wrong, based on my phone's behaviour. Still with you, though; neglecting to fix this leaves the most vulnerable users open to attack.

Yver• 11 years ago

Here's an excerpt from the article. The very first words of the article:

A day after Google publicized a flaw in Windows 8.1 before Microsoft could do anything about it, [...]

I stopped reading after this, for obvious reasons.

nhayden2• 11 years ago

That's some biased journalism there, shameful for engadget.

PhasmaFelis2• 11 years ago

Given that the bug in Android 4.3 was fixed in Android 4.4, which AFAIK is available to all manufacturers, how much blame should accrue to the manufacturers for being chronically months or years late in pushing out version updates?

I can see arguments both ways.

nhayden2• 11 years ago

I don't think they're late, I think they choose to stop sending updates to devices. The obvious reason is they want people to buy new devices (i.e. renew 2 year contracts).

PhasmaFelis2• 11 years ago

It's both, really. They stop producing updates entirely after a year or two to deliberately cripple old machines, and when they do send updates they are often many months late.

krschultz• 11 years ago

The fact is that Google has fixed the bug. The fix is in Android 4.4. From Google's perspective, the onus is on manufacturers to then ship Android 4.4 to the end users.

In retrospect it was a poor assumption on Google's part to think that these manufacturers were actually going to support their customers. That is why they have spend the last 2+ years re-architecting the system to shove a bunch of functionality into things that Google can update or libraries that developers can incorporate into their apps. I imagine when they started out, they did not intend to have a huge amount of the system in a support library that is packaged inside every single app. I bet they also didn't intend to have the bulk of new features be in the Google Play Services package. Yet here we are, largely because the manufacturers are much like PC makers in that they put their own interests far ahead of the ecosystem interests.

ryanhuff3• 11 years ago

My immediate question is whether requiring an upgrade to 4.4 is substantially more difficult for the manufacturers and carriers to make it work with the affected hardware. That seems like a much messier job than just patching WebKit.

ldng2• 11 years ago

Was it poor assumption on my part that what was once opensource in the baseline OS would stay open even after being extracted into "library" apks ?

What I mean here is that Google's move here is far from being only a support matter.

drewg1233• 11 years ago

The problem is that even GOOGLE does not support their customers on the Nexus line. I have, in my drawer, an otherwise perfectly good Galaxy Nexus that is stuck running 4.3 because Google cannot be bothered to update it to 4.4. If Google will not update its own Nexus hardware to 4.4, how can anybody reasonably blame other hardware vendors for behaving the same way?

achernya2• 11 years ago

I'm not sure it's reasonable to expect Google to update a device to the latest version when the hardware manufacturer has exited the market -- http://www.cnet.com/news/google-to-samsung-galaxy-nexus-owne.... While Google does control Android, that's not the only software that is present on the phone. Short of the Nexus series starting to have open source baseband and radio firmware, we'll be at the mercy of hardware manufacturers.

LukeB_UK• 11 years ago

Wasn't that because Texas Instruments pulled out of the mobile market?

on_and_off• 11 years ago

I am not sure whether Google should develop a fix or not for these devices. Version 4.4 does not have this issue, so the obvious solution would be to update the system. In the real world, android updates are not .. ubiquitous though, not to mention that after some time, all OEMs stop updating their terminals (that also includes security patches though ...).

Google has solved webview/browser bugs in 5.0 by having auto-updates during the activation and a chromium based webview which is update through the webstore but there are surely bugs that can't be solved that way or through Play Services.

The absence of 'forced' upgrades was probably a very good idea in order to popularize Android among OEMs but it seems to me that Google should start thinking about a way to make Android easy to update.

In that context, I would not be against reduced customization possibilities. Especially since the need for OEMs to differentiate themselves often lead to UIs with very discutable choices compared to stock Android (cough Samsung cough). Most skins brought large improvements over stock in the 1.x 2.x era, nowadays it is far more debatable.

fidotron5• 11 years ago

The problem is Google are abusing their position once the customization capability is removed.

For example, they were done for using Google Street View cars to slurp WiFi information, so now they just use Android devices to do it for them. Manufacturers have to have this enabled by default if they want Gmail and the Play Store on the device. (EDIT: and even worse, if you agree to that for one device you have to agree to not release any Android devices which do not have those things, thus removing the ability for the market to decide).

When people, rightly, complain about the Facebook app having permission to do way more than it should they seem to be oblivious to the fact Google are doing things which are far worse.

Oletros4• 11 years ago

For example, they were done for using Google Street View cars to slurp WiFi information, so now they just use Android devices to do it for them.

What? Street View problems were not about slurping SSID, MAC and geolocaction from wifi's, but because of capturing snippets of broadcasted data.

They still use Google Street cars to geolocate wifi's.

Manufacturers have to have this enabled by default if they want Gmail and the Play Store on the device.

Source for that?

and even worse, if you agree to that for one device you have to agree to not release any Android devices which do not have those things, thus removing the ability for the market to decide

Source for that?

Zigurd4• 11 years ago

That is likely to be the actual importance of Ara: Not configurable hardware, because hardly anyone re-configures their hardware, but rather software that can be configured to a much wider range of hardware.

chisleu• 11 years ago

"Google statues on Google's Mountain View campus. A day after Google publicized a flaw in Windows 8.1 before Microsoft could do anything about it"

Biased article from line 1.

I want to like Microsoft. I really do. This kind of "journalism" isn't doing them any favors in that regard.

Why Google won't fix a security bug in almost a billion Android phones

Related Stories