5

Background

My Android phone is rather old. It's running stock Android 4.1.2, which includes known security vulnerabilities. Unfortunately, this is the latest firmware which T-Mobile offers for this phone. Still, I'm fairly happy with Android 4.1.2.

I plan to upgrade to a newer phone in the future. Maybe a BlackBerry Priv, in a year or so, once the price of a used Priv falls has fallen some more. But not yet.

I generally only install apps from the Google Play store or from F-Droid; normally not from other sources. I surf the Internet a fair bit, normally using either Google Chrome or Firefox. I'm not picky about making sure that I watch videos hosted only on trusted websites such as YouTube; I'm willing to watch online videos hosted anywhere. I install app updates from the Google Play store perhaps once a month or so.

I don't have a data plan; I use Wi-Fi sometimes. I do download and view MMS messages from friends. I never receive MMSes from strangers.

My device is rooted. I use SuperSU to let me decide which apps can become root. I only let an app become root if I have a good reason to do so.

I see at xda-developers.com that there are various third-party "ROMs" (unofficial firmware images) available for my device, including CyanogenMod and others. If I install one of these ROMs, I can end up with a newer Android version, including all of its security fixes.

I already have ClockworkMod Recovery installed, which is a tool which helps to install third-party ROMs. I have a current backup of my existing stock ROM; the backup is stored on a MicroSD card.

My question

Like I said, I am running Android 4.1.2, and it does include known security vulnerabilities. But I'm not a security professional and don't really know how bad these vulnerabilities truly are.

I would rather not install a third-party ROM. This would require time and effort.

Is it important for me to install a newer ROM? If so, how important is it?

Improve this question

4 Answers 4

Reset to default
5

That depends how important is anything you do on the phone. If it is prepaid plan and you only anonymously watch youtube clips and surf the web, the worst that could happen is your phone becoming just another of zombies in some botnet and use up your credits and spy on you.

If it is postpaid, it could build up your phone bill with extra data usage, calls and sms/mms to who-knows-where. If you use it to access email, it could destroy or takeover your email account. If you use it to enter credit card details for online shopping, your credit card could get maxed out. If you are famous person, your pictures and homemade videos could make some paparazzi very happy. And so on. So it really depends.

Another question is how likely you are to be exploited. That is also pretty hard to say. If you drive Audi A7 while under influence of alcohol, how likely is it you'll have an car accident? There is just no way to tell (even if you provide much more detail), and even if we had accurate statistics, they still won't tell what happens to individual.

So, you should assess what is the worst risk that can happen if your phone is taken over, how likely you think that may be, and how much effort are you willing to put in to avoid it. Nobody else can do it for you but you...

About exploits - some are pretty bad, other less so. It depends mostly on your luck... Judging by amount of red stuff there, I'd upgrade if I were you...

Improve this answer
2

If you go the third-party route, consider installing a third-party firmware that you trust and can build from source code yourself if needed(CyanogenMod). Check that md5 hash ;)

Also...consider buying something that comes with OEM unlock out of the box(Nexus, Dev devices, etc) if you want to stay updated in the future and not worry about as many vulnerabilities or third-party firmware compatibility issues.

Improve this answer
4
  • Hi, bobbyd3, and welcome to Security.SE! Thank you for your useful answer. We hope you'll like the place and decide to stay. Indeed, maybe I will choose CyanogenMod; it definitely is one of the options available to me. What does "OEM unlock" mean? Please edit your answer and clarify. If you improve your answer, you might get more upvotes and more reputation points. Once you gain more reputation points, you will gain access to more of the site's features.
    – unforgettableidSupportsMonica
    Commented Aug 24, 2016 at 12:31
  • See this Android Stack Exchange thread for more information regarding OEM unlock and fastboot. OEM unlock is only available on a limited selection of developer Android devices(Nexus, etc) and allows you to install custom firmware on your device without exploiting a security vulnerability to obtain root on your device. The CyanogenMod Fastboot documentation is a good read as well.
    – bobbyd3
    Commented Aug 24, 2016 at 19:03
  • Ah OK. Still, what's the problem with exploiting a security vulnerability in order to install custom firmware? Security vulnerabilities are so common that it's easy to find one on most Android devices, even if a device doesn't support fastboot oem unlock.
    – unforgettableidSupportsMonica
    Commented Aug 25, 2016 at 11:57
  • OEM's have countermeasures to prevent users from using or installing third-party software which can result in a brick. There is also the issue of running an unknown exploit on your device. I suppose if the exploit is opensource it's a relative non-issue but you would still have the usual usability/stability issues that result from a less open device for developers. AOSP support means quicker security updates for stock firmware and better support for third-party firmware developers.
    – bobbyd3
    Commented Aug 25, 2016 at 23:03
1

Let me add one more suggestion. The next time you buy a device, consider doing two things:

  1. Consider choosing a device whose maker offers monthly security updates for the stock ROM. These updates take time and effort to produce, and the devices might therefore cost more, but monthly security updates are nice to have. Nexus devices get monthly security updates for three years after release, or 18 months after Google stops selling them — whichever is greater.

  2. Consider choosing a device for which you can continue to get security updates for the maximum number of years possible. Third-party ROMs can be a good way to get long-term security support, but once third-party ROM development ceases for your device, you may be out of luck. Consider choosing a device which third-party ROM developers are likely to support for many years.

Improve this answer
-1

Regardless of which version, Android can still be vulnerable, e.g., godless exploit for Android 5 (Lollipop).

However there are a few things that you can do to secure your Android device:

  1. Ensure that your Android version has Address space layout randomisation (ASLR), which is a computer security technique involved in protection from buffer overflow attacks. Your's does.
  2. Do not sideload apps or install non-Play apps. Using the official Google Play Store to install apps will ensure that if an app is discovered as malicious and gets pulled from the Store by Google, it will automatically be uninstalled from your Android device. (i.e., don't use CyanogenMod)
  3. Install an antivirus app from a reputable vendor.
  4. Do not root your device. Rooting it will allow malware to install rootkits much more easily, i.e., without needing an exploit.
  5. Above all, don’t click on crazy stuff. :-)
Improve this answer
2
  • 2
    I disagree with point number 2. That is, I disagree with the last part. There is nothing wrong with CyanogenMod because it does not ship with Google Play, and furthermore you can patch CyanogenMod to include Google Play. Granted, if your advice is to not root the phone, installing third-party ROMs isn't realistic anyways
    – Verbal Kint
    Commented Aug 23, 2016 at 12:22
  • +0. Zaakiy, three things: A) @VerbalKint is right. B) Also, the exploit you mention in your first paragraph is an exploit which I think only affects outdated Android versions. Although it's true that most Android users are still running outdated Android versions, they can upgrade if they want. C) If you edit your answer to fix or remove the first paragraph and to fix your bullet point 2, and then if you ping me, I will consider upvoting your answer.
    – unforgettableidSupportsMonica
    Commented Aug 24, 2016 at 12:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .