1

Depending on the brand, some Android devices stop receiving security updates as soon as one year after release. In my case, I own a Moto Z Play which latest security update was a year ago...

However, actually how important is this lack of security updates for an end-user? Reading through Android security bulletins, often the updates fix things that cannot be attacked unless you have either physical access to the device or you are using a bogus app.

This leads to the point of my question, given that a device no longer receives security updates, is Google Play enough to protect it? Assuming every app is installed from Google Play, and with a reasonable privileges.

2

However, actually how important is this lack of security updates for an end-user?

Very very important.

Reading through Android security bulletins, often the updates fix things that cannot be attacked unless you have either physical access to the device or you are using a bogus app.

This is not true. The 2019 August Security bulletin itself talks about fixes for multiple vulnerabilities which could be exploited remotely.

This leads to the point of my question, given that a device no longer receives security updates, is Google Play enough to protect it? Assuming every app is installed from Google Play, and with a reasonable privileges.

No, because unpatched system level vulnerabilities may allow local privilege escalation.

  • what are the odds of having someone have access to your device to do local privilege escalation? – yzT Aug 23 at 9:50
1

Some malicious applications do end up appearing on Google Play. Google tries to block malicious apps from entering, and does remove them from the market after they find, but it's not perfect system (I don't think you could have a 100% perfect vetting system that accepted "good" apps while keeping the "bad" ones, even if you had a human reviewing the source code of each of them).

Just as a sample, here is a piece of news from today talking about a spyware that passed through their filters: https://www.welivesecurity.com/2019/08/22/first-spyware-android-ahmyth-google-play/

Moreover, while there are some apps that are clearly for no good, there are other that may comply with their terms of service, but contain features you would probably find undesirable, such as tracking your position continuously (unrelated to the goal you expect that app to fulfill), recording your surroundings or scrapping your address book (but people technically agree them to do through their own Terms and services).

OTOH, if you are not installing new apps, and with a bit of care, it could be hard that a malicious app gets installed.

What I would be most concerned would be if there is a vulnerability that could be exploited remotely, such as one on your browser or in the WebView.

Depending on the exact Android version you are, you could also be missing new security features.

The importance of the lack of security updates for an end-user, should mostly depend on the importance the user itself puts on the consequences it could have. And the probability of such risks actually materializing may depend on the actual use, and even the savvyness and attention of the user.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.