I am somewhat confused in terms of how secure Android OS is and how updates work on Android. Are there security fixes on each release? How can I keep track for Android exploits and what are the most common attack vectors for Android devices. Any decent books on Android Security?

closed as too broad by Adi, TildalWave, NULLZ, user10211, Gilles Sep 26 '13 at 9:38

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.


All the apps on an Android device have their own updates, which are then fed to the devices through the normal app channels (say, Google Play). This covers not only the apps you have downloaded, but also the apps which were provided with your device (I know that my phone regularly nags me about an update for the Facebook app which came with the device OS).

As for the core of the OS... well, it is more a "do nothing and pray" situation. If some remotely exploitable hole is found in the kernel for an OS version, then we are all doomed. Theoretically, the device manufacturer is responsible for pushing updates to users, and some devices include an automatic check to download new updates on a regular basis. At least so says the FAQ. But it is well-known that a lot of not-so-new devices are simply abandoned by their vendors, left to fend from themselves in a harsh wilderness. My phone uses Android 2.2 and I never saw it download a core OS update; maybe it is all transparent, but somehow I doubt it.

  • It's best to treat a phone as an unencrypted USB stick. I say unencrypted because unless you put the phone in hardcore safe while you shower and sleep, you would need to use a forensic lab to double-check the phone each time it re-enters your possession. It's also unclear whether auto-updates are inherently good - as you are inherently trusting the supplier of these updates with whatever power is within the updated code's authority. – LateralFractal Sep 25 '13 at 23:14

Android devices often don't get updates or are very slow to get them. They are naturally a more locked down ecosystem however and don't give nearly the same level of access to applications unless rooted. Some exploits do exist for an application to get root for itself, but it's generally a fairly involved process that is difficult to externally exploit without the user pushing it through.

Typically, if updates do ever make it, they take months or even years to get to most people's devices.

Not the answer you're looking for? Browse other questions tagged or ask your own question.