5

As we know it from e.g Windows OS on desktops, if the support is outdated there is a risk for security and feature bugs and unstable OS.

If a smartphone can't be updated to use a newer OS because of low hardware resources and no more official updates, should it be not used anymore? Is there the same concept as for Desktop PC's?

I found this it seems somehow yes/no.

  • 1
    the article you link does not seem relevant to your question – schroeder Dec 30 '16 at 15:37
  • 3
    If an OS is not getting security updates, then any vulnerability will not get patched – schroeder Dec 30 '16 at 15:37
  • 1
    @GiaRui Immediately after when it cannot become up to date anymore – FarazX Dec 30 '16 at 16:16
  • 2
    The pace of technology is speeding up, and security, is safety - even you are only using computers for surfing the net and listening to music. – FarazX Dec 30 '16 at 17:14
  • 1
    @GiaRui I guess nothing else would be threatening you if you disconnect your device from the net. BTW, why don't you think of contracts like ones you can have with Apple, Verizon, AT&T or other provider and companies? You can check this link for iPhone Upgrade Program. – Parsa Samet Dec 30 '16 at 17:18
2

This might be helpful, as it mention when to change :

"Updates are available for at most three years on Android devices, (OS updates up to two years, Security only for the last year) while IOS supports four year old, and sometimes older devices with their latest iOS versions."

Many Mobile Devices Not Running Current Operating Systems (May 23, 2018)

Statistics from Duo Security indicate that as many as 90 percent of 10.7 million Android devices in the US and Western Europe are not running up-to-date versions of the Android operating system. The problem lies in the fragmented nature of Android patch distribution; many Android users receive updates from manufacturers or carriers irregularly. Duo also found that 56 percent of iOS devices are not running the most current version of that operating system. Eighty-five percent of Chrome OS systems and 74 percent of macOS systems were found to be running outdated operating systems as well.

Editor's Note

[Neely]
While Google has worked to improve this for some devices, before an update is available for a given device, the update has to pass through both the OEM and Mobile Operator for vetting and verification, which slows the process, if the OEM supports updates in the first place. Updates are available for at most three years on Android devices, (OS updates up to two years, Security only for the last year) while IOS supports four year old, and sometimes older devices with their latest iOS versions. Glitches in the latest iOS releases, such as battery life woes with 11.3.1, are slowing uptake; it remains a good idea to keep rolling to continue the updates as they often address security weaknesses, particularly in WebKit and other browser technology.

Read more in:
- www.cyberscoop.com: No one is updating their Android devices, new data shows

Source: Newsletter

  • 1
    This is pretty much a link only answer. I think this should be a comment and not an answer. – Tom K. May 30 '18 at 12:52
4

Sorry for being too frank, your answer is a big YES, it shouldn't be used anymore - at least it shouldn't be connected to the net if you don't wanna change your device. It's twenty-first century and we're living in the age of IoT (Internet of Things). Security, is the most important thing in everyone's life since what we are dealing with - daily, hourly or secondly - is DATA! And most of those people not working a lot with Computers, are keeping their Data in their smartphone!

Updates are not only meant for more compatibility with newer applications with new enhancements, they are meant to patch vulnerabilities, pitfalls, and security breaches. When vulnerabilities don't get patched, attackers can easily use them as your weak-point, to access to your Data, you data will lead them through your life, your life can even mean your house if you have a smart house! Afterwards it will lead them to gain access to other's lives whom are in relation with you, and so on!!! It's like a tree with thousands of branches. One master card means thousands of master cards - if the attacker who has gained access to yours is an expert!

On the other hand, consider someone willing to hack a governmental agency, or an organization, or etc., they can hide and cover their tracks behind yours, they can throw you in trouble to escape from trouble.

Being up tp date, means safety, not only yours, but also your loved ones. Please consider being up to date a serious thing.

I'm a Linux System Administrator and System Architect responsible for System-Level Security for such things - I should test things sometimes as a penetration tester, so I'm not exaggerating, I've seen all those I mentioned.

If you need an example:

From WikiPedia:

Dirty COW (Dirty copy-on-write) is a computer security vulnerability for the Linux kernel that affects all Linux-based operating systems including Android. It is a local privilege escalation bug that exploits a race condition in the implementation of the copy-on-write mechanism in the kernel's memory-management subsystem. The vulnerability was discovered by Phil Oester. Because of the race condition, with the right timing, a local attacker can exploit the copy-on-write mechanism to turn a read-only mapping of a file into a writable mapping. Although it is a local privilege escalation bug, remote attackers can use it in conjunction with other exploits that allow remote execution of non-privileged code to achieve remote root access on a computer. The attack itself does not leave traces in the system log. It has been demonstrated that the bug can be utilized to root any Android device up to Android version 7.

The bug has been lurking in the Linux kernel since version 2.6.22 released in September 2007, and there is information about been actively exploited at least since October 2016. The bug has been patched in Linux kernel versions 4.8.3, 4.7.9, 4.4.26 and newer.

N.B. I recommend you use 4.9 if you're a linux user.

You can check the following link to find the codes and further information:

https://dirtycow.ninja

By the way, it makes no odds if you're using smartphone or a computer to keep your data in, the only thing matters is that your keeping your data, even your sensitive data sometimes. Either your smartphone and Computer have something called OS that are running atop something called Kernel! What would it be if kernel never gets newer updates? Kaboom! Compromised, no matter if you are an important person or a normal guy, you'll be compromised because your address - IP, MAC, Device anything, - will be considered as either a bait, or an aim.

  • You can easily try/test Dirty Cow on an Android machine or Linux Machine with the mentioned Versions. Then you decide yourself how dangerous might it be to have an out-dated OS. – FarazX Dec 30 '16 at 15:56
  • 2
    we're living in the age of IoT so you can be sure that most of those things are part of botnets that will try hard to crack any vulnerable device like your outdated phone. – André Borie Dec 30 '16 at 18:15
  • @GiaRui Dirty Cow was just an example, but no. It really depends on how the attacker can gain an access to your device, no matter if it's physically or remotely. DirtyCow is used for Privilege Escalation, for instance the attacker could gain access but could gain it through another user, not root. In that case, to become root he/she can use the breach and so can circumvent rules and become root without having root passphrase. – FarazX Dec 30 '16 at 19:05
  • 1
    @GiaRui BTW, the reason you can see "local privilege escalation bug" in WikiPedia, is that the attacker needs to be inside, in other words, the system should be somehow compromised. No matter if s/he's sitting in front of the machine (physically) or s/he's in via ssh (remotely) or etc. S/He only needs to have local access - be inside. – FarazX Dec 30 '16 at 19:13
  • Thanks, it means it depends how secure are the other security devices. I don't know I think due the multiple attack vectors I can't say if it is enough secure. – Tech-IO Dec 30 '16 at 21:54
1

TL;DR: Yes, out-of-support OS have increased security risks over time.

It's like with every piece of software, basically. As time goes by, new security vulnerabilities are being discovered, and they have to be patched by software manufacturers in order to protect against them. There might be workarounds (for example disabling certain services), but over time, your software system is bound to be less secure.

This is especially true for complex software systems like operating systems. Take Windows for example - every new vulnerability found in, let's say, Windows 10, is also likely to be already there in previous versions. If those don't get patched any more (for example because XP support has ended), attackers basically have a blueprint to exploit these vulnerabilities in older versions.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.