6

I own a Pixel C tablet, which currently has Android 8.1 installed. The Pixel C has officially been discontinued at the end of 2017, and received its last security update 2019. I would like to keep using it, since I only use it to watch YouTube videos and occasionally play some games.

However, the fact that it no longer receives any security updates worries me, and I'm not sure how I can keep using it safely. Just replacing it is not an option, since the new tablet would also become obsolete in the next 2-3 years and I find it to be extremely wasteful to throw away perfectly good hardware due to a software issue.

Here are things I have considered so far:

  • Installing a custom OS - There are a handful of Android versions designed to support older devices, such as Resurrection Remix and LineageOS. However, both RR and LineageOS have discontinued support for the Pixel C, and installing some "unofficial" version by "some guy" is...not a prospect I am too happy about.
  • Just not doing anything - Since the tablet would only be reachable through my local network and would only have the same handful of apps installed, attack surface should be relatively small. While it is definitely not ideal, it should not pose a huge risk either.

Is there any other way, that I have not yet considered?

5
  • You could always take their build configuration, audit it, and then build the ROM yourself. Feb 8 at 1:44
  • 3
    @NonnyMoose I cannot audit a whole operating system myself.
    – MechMK1
    Feb 8 at 1:47
  • to enhance your security in the event of a breach you might obtain su on the device, and instal a proper outgoing firewall, such as AFWall (in the absence of su you can use a tool called NetGuard but this is less reliable and doesn't operate during boot)
    – brynk
    Feb 8 at 1:54
  • @MechMK1 I meant you could audit the changes against AOSP / the upstream of the ROM. That should bring it to the same level of trust as an official version of the ROM. Feb 8 at 3:12
  • If it is heavy enough you might be able to safely use it to prop open doors...
    – hft
    Feb 12 at 19:30
4
+125

You have to make trade-offs between usability and security. There are two types of android security patch level. The patch level 01 contains patches to the android framework and patch level 05 contains vendor patches for the Linux kernel, drivers and firmwares.

While custom ROMs deliver 01 patch level, 05 patch level can be only delivered by OEMs. Your device becomes vulnerable to unpatched vulnerabilities that have been discovered since your device was last updated. If your threat model is minimal and you are only using your device for general purpose, it is still safe to use it as long as you are not installing apps from unknown sources. That's because using only Play Store to install apps significantly decreases your attack vector.

Google removes apps with known malware samples at submission time alone. Some unpopular apps manage to evade detection for months and some innocent apps are later updated to become malicious. See, Barcode Scanner app on Google Play infects 10 million users with one update. If you are using reputed apps, it is unlikely you will ever witness such malicious apps that you can't remove. Although, it's still a possibility but this is where you have to make a trade off. Most of the malicious apps that were found on Play Store were malvertisers that were violating Google ads policies and not exploiting any vulnerability.

Besides, Google Play Protect runs a safety check on apps from the Google Play Store before you download them. It checks your device for potentially harmful apps from other sources as well. It also warns you about any detected potentially harmful apps found, and removes known harmful apps from your device. So you still have some anti-virus like protection even if you are not getting security updates.

In 2020, Over 400 code flaws unearthed in Qualcomm’s DSP chips for smartphones | DEFCON. This can definitely compromise your device upto root. No exploit has been seen in the wild exploiting DSP. Critical vulnerabilities in Bluetooth & Wifi firmware and driver are often discovered. Even with custom ROM security updates, they can't be fixed. This is another trade off you have to make.

Unlocked bootloader cannot protect you against physical access to the device. Root access has no impact on device security, you just have to be more responsible about the apps you grant root access to. When using custom ROM, you have to be precautious about whether SELinux is enforcing or permissive. Permissive doesn't block process for violating SELinux policies, only reports them. There is already an exploit to gain root in SELinux permissive mode | Explanation.

Your device is not officially Treble supported but it has custom support of Treble with custom Generic System Image (GSI). You should use that. GSI gets permanent updates but you won't be getting vendor patches.

-3

The main threats to protect against and which your tablet can be used are:

  • Miners
  • Botnets
  • Theft of private data

One way or another, in order to protect, you need a detailed firewall configuration. It is recommended to prohibit any outgoing for all applications and only selectively open the necessary ones to the Internet. Install firewall and antivirus and configure them. Also recommend making full backups at least once a week and keeping the previous one separate from the tablet.

4
  • 1
    Do you have any sources in regards to the effectivity of Anti-Virus software on Android?
    – MechMK1
    Feb 10 at 15:54
  • @MechMK1 Kaspersky Internet Security or free Avast. They are not many of them.
    – Mesky
    Feb 10 at 15:59
  • 1
    That is not the question I asked you. I asked if you have a source for the claim that Anti-Virus software on Android is effective.
    – MechMK1
    Feb 12 at 19:35
  • 1
    If the concern is out-of-date android, then the threat isn't a malicious app - it is an app that breaks out of its jail and gains broader control over the device. At that point in time a firewall is quite useless, since any app-specific restrictions are clearly ignored, and you can't block all outgoing HTTPS traffic from the device (since then it would be useless) Feb 13 at 12:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.