My Android smartphone is many years old though still satisfies more than absolutely, I really don't want to change it for a new one. The vendor, however, doesn't seem to issue updates any more. Besides installing fresh CyanogenMod (it is not 100% compatible: there are problems with the camera and some other hardware. also another old phone of mine I still use is not supported by any custom roms at all), how can I protect myself from new Linux vulnerabilities getting discovered every day? My phones are rooted (one may say that rooting a phone is a security hole itself but this is the only way to block all the spyware stuff pre-installed by the vendor and embedded in 3-rd party apps) and I can potentially patch system libraryes but needless to say I can hardly maintain all of them myself.
-
What phone is it?– Joseph Sible-Reinstate MonicaMar 9, 2017 at 3:06
-
So essentially you are asking: How do I update a system that can't be updated? Yea, that doesn't work very well. The only way to fix this is to upgrade to a new ROM.– B00TK1DMar 21, 2017 at 14:15
2 Answers
It's actually impossible to keep an unsupported device completely up-to-date, since device-specific binary-only drivers often have vulnerabilities, and only the manufacturer has the sources necessary to update these. This is why CopperheadOS stops supporting phones as soon as the phone's own manufacturer stops.
If you ignore that issue (as most people do), your only real option is to completely replace the ROM. Since you mention CyanogenMod and not LineageOS, I assume you haven't tried it since 2016, if not earlier. I'd recommend trying LineageOS to see if it resolved the compatibility issues. If not, and if they're deal breakers, your only real option is to look for other custom ROMs. In theory, it'd be possible to hexpatch vulnerabilities in stock ROMs, but this very quickly becomes completely impractical.
Some software you have installed may already be vulnerable, this is just the nature of software, developers are constantly plugging holes/ opening new ones with updates. What protects software is the rotation of these holes, not that they do not exist. There is a very well written piece of software called the OS which mediates what a user-space app can do. As long as an isn't given permission to do anything drastic, you can be fairly certain that it can't, unless there is a vulnerability in the OS.
An OS is not invulnerable to attack, and like user-space software needs to rotate the holes to stop exploits. If you don't install new programs, and your old programs are secure enough that they don't provide an exploit path to the OS, you should be fine.
Otherwise the best you can do is keep regular backups, and do a clean restore if the device is compromised.
