Android Security: Google or Carriers issue?

In the world of Android a couple of disturbing articles have come out recently. Google is no long patching 4.3 (Jellybean) and earlier versions. Also the amount of malware for Android increased by 75% last year. This begs, who is to receive blame on the vendor side?

We all know people do not patch apps. Maybe they don’t like “new” terms that come with the update (most terms are the same as the prior versions). A lot get not the best information. Patching is important, and we all know that. In the world of PC’s we all know about Patch Tuesday (Microsoft, Adobe), and know how long it can take Apple to patch flaws in OSX and iOS (which they completely control and is out of the carriers hands). So what about Android, the worlds most popular phone OS?

The announcement this week that Google is no long patching WebView for versions 4.3 and earlier started me thinking more about this. Yes, Google is “abandoning” 930 Million users. Yes, They come out with new versions of Android so fast that the OS is fractured all over the place. The question is though, is Google doing the right thing? I personally think so. The reasoning why places a bunch of blame on the carriers.

Outside of iOS (iPhone), the carriers control when consumers get updates to their Android (and Windows) phones. In the world of Android, Google announces a patch, update, new version, then it gets sent to the device manufacturers. They have to test against their hardware and customization that they have done to Android for their devices (the look and feel of the OS you see). Then it gets sent to the carriers (Verizon, AT&T, Sprint, etc.) where even more testing has to be done against the carriers modifications to the OS (special built in apps, their radios, any network lock downs or features such as tracking cookies). Basically once Google releases the new version/patch/update getting it onto most peoples phones is out of their hands, the exception being the Nexus devices which Google controls. The longer an update take to get out there, the more chance there is for a breach. The easier it also may be for malware to get on the phones, and could be a reason the amount of malware for Android increased by 75% last year.

So the question arises, why does it take so long to hit our phones. the obvious and simple answer to me is money. Why bother pushing patches and updates, let alone new versions of the OS to phones especially ones that are only a year or two old, when you can try to force people to get new hardware, and either extend or get new contracts to get the latest? Security as a Service you can almost think of it as, but not quite. Seriously, the carriers have a cash cow on their hands with Android and doing things this way. The lastest verion of iOS is out and works on phones that are years old. Apple has it available for those older phones through their updater, although some features may not work on the older phones, it is still available. I am by no means an Apple fan, but the control they have over their updates is what Google needs to have over Android. The carriers don’t care, and won’t unless they lose some major lawsuit because someone’s phone got hacked due to a security update not having been available for that model. When I tweeted to my carrier (Verizon) about this, they sent me a link to their “news” page which has no information on updates. I also tweeted them back as they asked about what I was looking for (latest Windows Phone update, Android Lollipop) for specific devices. Never heard back from them.

The bottom line on this, from my perspective, is that both Google and the carriers are to blame. Google is to blame, not for not patching, but for not controlling the push out of patches and updates to the OS, and the carriers for not pushing out updates and patches in a timely fashion. Until this gets resolved, Android is going to stay heavily fragmented, and security for everyday peoples phones is going to be shaky at best.

Can Infosec get ahead of the Blackhats?

It is described at times as an arms race. Information Security always seems to be behind the bad guys. Can this ever change?

We all know the routine by now. New exploit, new signatures, new patches, new updates, new exploits. Rinse, lather, and repeat. We hear of the next big thing to be adaptive. Heuristic scanning, signature scanning, IDS, IPS, all to mitigate the threats. We are always fighting the good fight from behind. Unfortunately, this will always be the case. Yes, we get faster, not as far behind, and better. Yes, we have people on our side actively looking for the latest exploits. It is a neck and neck race in this day and age, but the fact remains, the bad guys will always find something we haven’t. We do our best to mitigate. We know that people are the weakest link. We try to educate, but even the best education, following the best practices will not stop exploitable scenarios, be they human or code. Why? Because we are human and are flawed.

Now don’t think that I am all doom and gloom. We have made great strides forward, and will continue to do so. Truth be told though, their are only a few ways to even have a chance of truly stopping the situation, and they are either super extreme or extremely improbable.

First idea I have is to have, as was a tag line from the movie Sneakers, “No More Secrets.” If everyone from corporations, to governments were wide open about everything, then what is there left to steal? Just money which brings me to the second thought. Go back to the bartering system. This gets rid of the money issue, and actually makes sense. Trading goods and services for other goods and services. Now you don’t need credit cards, Money, bank accounts, etc… The other big one that gets brought up in my mind is of course getting rid of technology all together.

None of these ideas are practical of course, so we are back to the original thought here. Can we ever get ahead. More thank likely not, but we keep getting closer to being even. So keep training, keep educating others, and keep your wits about you. We are in for a bumpy ride.

Meanwhile, away from Las Vegas

Yep, Hacker or Security Summer Camp time is here. For those of us not out in Las Vegas at Blackhat, B-Sides, and Defcon, The world continues on. As it goes, the U.S. Army has a lot to learn about the world of hacking.

The Register put out a story on how the US Cyber Army got its rear whooped by reservists. This article should be scary, and for good reason. If the full time Cyber Army didn’t even know how they had been attacked, how do we expect them to defend our country, let alone attack aggressors? The simple answer is they won’t be able to, but why? Well it is actually a matter of a few things.

The military is a great institution. As such they have a great regiment, and are highly organized. Follow orders, follow procedures, be a good soldier. The higher up you are the more planning you are able to do, but still the open thinking is still limited unless under true fire. This goes against the idea of being a hacker, someone who can go out and keep directly up to date with the infosec world. the world of Zero Days, backdoors, malware and the like is ever evolving and at a breakneck pace. The amount of “Eureka” moments compared to normal military strategy “Eureka” moments is astronomical. Yes the ideas put for in The Art of War by Sun Tzu still apply but the pace of shifts, adjustments and new “weapons” one talks about is daily.

Now while both the full timer Cyber Army members and the reservists both might have an interest or passion for the world of hacking and security, the reservists have a huge advantage. According to the article a good majority of the work in the infosec field full time. Imagine how more up to date, be it from looking at darknet forums, to researching zero days, penetration testing all different sorts of systems, they are. Add on that they have gone through the training and regiment that the full time Army has. This is where the full time military failed. think about it, we all have heard of former hackers recruited by the government, and for good reason. It is straight out of Art of War, “Know thyself and know thy enemy and never in 1000 battles will you lose.” The full time Cyber Army needs that adaptation. they need to be more loose on regulations, need to be able to constantly think outside the box and be able to expand their skills and knowledge outside of a regimented system. Until that time, I hope those reservists are ready to defend the country cause the full timers are a liability.

.