Sketchy phone manufacturers pretending to update phones?

[PereDroid]

Security Research Labs in Germany has just completed a 2 year study on Android security and the monthly patches released by Google. They claim that several companies, none actually named (yet), are telling users they've got an update but in reality doing nothing more then just updating the date! Others release real updates but since they skipped 2, 3 or 4 (or more!) any cumulative effects of the patches may not get installed leaving security holes.
The lying about the date thing isn't common by any means as SRL founder Karsten Nohl said "We found several vendors that didn’t install a single patch but changed the patch date forward by several months. That’s deliberate deception, and it’s not very common”.
They are presenting at a security conference today, so I wonder if they will come out and say who's guilty of this. They should, right?

Security Research Labs also released a list of who performed the best at security updates:

• Samsung, Sony and Google were the best followed by
• OnePlus and Nokia
• Huawei, HTC, LG and Motorola coming in 3rd
• ZTE and TCL coming in a dismal last place missing on average more then 4 security updates.

Source: The Guardian
Picture from XDA

 

[me just sayin]

surprised to see Samsung as one of the best.

 

[xeene]

Samsung must be combining monthly security updates into one big annual update. Surprised Motorola isn't up there with Google because I get updates every month on a dot. Sometimes more then once a month.

 

[Sajo]

I read a few articles about this at lunchtime yesterday. There seems to be a slight difference in the way that Security Research Labs data is being reported between some of the popular tech news websites (about who misses more patches and who is best vs worst). To answer the original question asked by the OP, Yes...they should release their full report and name the companies that are providing false updates just to look like security patches.

But, as many of us have said on this Forum numerous times, security patches are a good thing, but not a guarantee that your phone is safe. As Google & Security Research Labs both agreed, and was reported with this information:

"...Google's other major point: Hacking Android phones by exploiting their missing patches is far harder than it sounds. Even Android phones that don't have solid patching records still benefit from Android's broader security measures, like address space layout randomization (which since Android 4.0 - Lollipop) has randomized the location of a program in memory to make it harder for malware to exploit other parts of the phone—and sandboxing, which limits a malicious program's access to the rest of the device.

That means most hacking techniques, known as exploits, that can gain full control of a target Android phone requires taking advantage of a series of vulnerabilities in a phone's software, not just one missed patch...

As a result, he says, Android phones are far more often hacked with simpler schemes, namely rogue apps that find their way into the Google Play Store or that trick users into installing them from other sources outside of the Play Store. "Criminals will most likely stick with social engineering as long as humans are gullible and install free or pirated software that comes packaged with malware,"...

 

[Miller6386]

surprised to see Samsung as one of the best.

To my knowledge unlocked devices straight from Samsung get timely updates. Carriers in the US hold up our updates.

Sent from my SM-P550 using Tapatalk

 

[me just sayin]

Samsung must be combining monthly security updates into one big annual update. Surprised Motorola isn't up there with Google because I get updates every month on a dot. Sometimes more then once a month.

but is the update the current month or the previous month

 

[me just sayin]

To my knowledge unlocked devices straight from Samsung get timely updates. Carriers in the US hold up our updates.

Sent from my SM-P550 using Tapatalk

got the latest update with the oreo upgrade. generally the times I have noticed, samsung usually runs about half a month behind.

 

[me just sayin]

I read a few articles about this at lunchtime yesterday. There seems to be a slight difference in the way that Security Research Labs data is being reported between some of the popular tech news websites (about who misses more patches and who is best vs worst). To answer the original question asked by the OP, Yes...they should release their full report and name the companies that are providing false updates just to look like security patches.

But, as many of us have said on this Forum numerous times, security patches are a good thing, but not a guarantee that your phone is safe. As Google & Security Research Labs both agreed, and was reported with this information:

"...Google's other major point: Hacking Android phones by exploiting their missing patches is far harder than it sounds. Even Android phones that don't have solid patching records still benefit from Android's broader security measures, like address space layout randomization (which since Android 4.0 - Lollipop) has randomized the location of a program in memory to make it harder for malware to exploit other parts of the phone—and sandboxing, which limits a malicious program's access to the rest of the device.

That means most hacking techniques, known as exploits, that can gain full control of a target Android phone requires taking advantage of a series of vulnerabilities in a phone's software, not just one missed patch...

As a result, he says, Android phones are far more often hacked with simpler schemes, namely rogue apps that find their way into the Google Play Store or that trick users into installing them from other sources outside of the Play Store. "Criminals will most likely stick with social engineering as long as humans are gullible and install free or pirated software that comes packaged with malware,"...

no such thing as a guarantee.

 

[RyanPm40]

surprised to see Samsung as one of the best.

I mean, I definitely get a security update on my S8 monthly from Verizon. It's impressive to me.

 

[xeene]

but is the update the current month or the previous month

Looks like current month.

 

[PereDroid]

Follow Up: they did not name names.