Millions of Android smartphones are left vulnerable as wireless phone carriers and handset manufacturers refuse to launch existing software security fixes to devices within an adequate timeframe.
Chris Soghoian, Principal Technologist and Senior Policy Analyst with the American Civil Liberties Union, said that unlike the iPhone, which sees Apple having power over carriers and also controlling the release of software updates to its devices, Android users are unable to receive an update on their phone without the carrier’s involvement. "The phones have to contact a server run by the carrier in order to get an update."
The update schedule of bug fixes coming from wireless carriers or hardware makers can take up to a year or longer to come to fruition. "When Apple decides that it’s going to give a security update to consumers or a feature update, every consumer who plugs their phone into their computer gets the update whether or not their respective regional carrier likes it," Soghoian said at the Kaspersky Security Analyst Summit.
With Android, "you get updates when the carrier wants it and when the hardware manufacturer wants it, and usually that’s not very often." He added, "This is not an instance where I’m criticizing Google for not fixing the bugs. Google’s team will usually fix it very promptly and make it available to all of their hardware partners. The problem here is that fixes for critical security vulnerabilities are simply not getting downstream and reaching consumers."
"You don’t need [a zero-day exploit] to attack most Android devices if consumers are running 13-month old software," Soghoian continued. He said that carriers need to accept responsibility for the devices they’re selling or leave the control of updates to Google. However, he believes that won't happen unless the government intervenes and applies pressure.
During the third quarter of 2012, the amount of Android malware surged by a considerable amount, with each new exploit becoming more sophisticated.
