Well, if this isn't vindication in many respects of what I was saying
just a couple of weeks ago. Essentially what we now have is yet another major
security threat
being levied against smart phones and smart devices.
And once again because of the fragmented way that Google's ecosystem
works in fact Google has not solved the problem of how to provide security updates to all
their devices.
Apple will have their update out next week which will go out to every single
iPhone and iPad device and Google has just released the update to
manufacturers who will
probably never bother including it. As I said at the time
Google has now got to sort this house out. At the end of the day
because of the way they built the Android operating system,
released it to everybody and failed to provide a back-channel there for security
updates
we now have over a billion devices with a big security hole. There's a slow clap for you Google.
At the end of the day these problems as I said
several months ago were not going to suddenly go away
because of the way Android is built we are only going to have more
and more and more of these situations. Essentially Google
for Android 5.5, Android 6, whatever,
it has got to come up with a back channel. It has to find a way
to stop continuously
leaving Android devices with no appreciable way
to get security updates. So
what's this latest security threat all about? Well,
it's being called the Freak attack. Now what has basically happened here is
a policy of the US government
over a decade ago was to not allow strong forms of encryption to leave
the US. That basically meant that devices were being shipped all around the world
with weakened security.
Now that was a policy that was basically abandoned ten years or so ago
and rightly so because it was bonkers. Effectively America
was making the entire world security weaker because it felt like it.
Now as we now know with the NSA, GCHQ and everything that's come out since then
this was obviously part of the wider plan. It's just over time
they could no longer maintain this kind of guise
that they were doing it to protect American interests because actually America was
doing business all over the world
and then it was having to do business with computer systems which were inherently flawed.
Even the US weren't stupid enough to carry on that particular policy
long term. But this new
attack effectively allows that very old piece of encryption
software that still is floating around on servers and devices all over the world
to effectively come back as an avenue of attack.
Now unfortunately, around one-third of
all the web sites in the world can be tricked into accepting this
compromised security scheme. Now
what we have to do is we need to patch up the devices that
need to talk to those servers. Patching the servers is all well and good up to a
point
but there will still be some devices out there that need to use and can
only use the old RSA scheme. But obviously if you've got a modern device
we really don't want any opportunity whatsoever
for an attacker to be able to force devices to communicate over that
insecure channel.
For Apple, that's going to be a nice simple one. They're just going to have to release a
software update and push it down to their
devices. For Google? Well, God knows!
The Nexus range will obviously get the update
at some point although as we're discovering, you know,
Google isn't even being particularly fast at getting those updates out.
Again, then when we kind of consider that we are still waiting
for devices to get the memory leak
patch from Android 5.0.3 available onto devices
I'm still not seeing that on my Nexus Shield for goodness sake and that was obviously
a key
bug that we had in Android operating system. Doesn't exactly bode well that
Google is going to be able to fix this security bug and get it out to even
the Lollipop devices in a
reasonable time frame because the ecosystem now
has become so fragmented they have no way to push these very important
security updates out.
Now I am absolutely positive that there's going to be a whole section of the Android
community here that is
going to go and drink the Google Kool Aid and will be massive apologists for
Google
because of Google's stupidity, and that's actually what we're dealing with here.
Google could have thought ahead on this one many times over the last few years
that these security issues have occurred and they haven't done anything about it.
Now the question we have to start asking ourselves is are we really trusting
Google here
and should we be continuing to trust them because I'm starting to feel that
Google doesn't
actually take security all that seriously. If they did they would have put
systems in place to make sure things could be patched quickly and
easily. They never did. They still haven't to this day
and we have to ask ourselves are they really taking our security
at heart? I don't think they are any more I think effectively they've
bundled themselves up at Google now. When you look at the projects they've been
releasing
and then killing. If you look at what's been happening with Google+ within the
Android operating system with the people who are now in charge of these projects
they're spread too thin.
Their focus is not actually into delivering the best products,
it's into delivering the most money for Google.
Now I love Google's products, I love Google services but
as I've always said here I will always tell you the truth about
the industry and at the moment Google is failing us
and we should be demanding better from them. So let me know what you think in the
comments.
Is this just yet another storm in a teacup bearing in mind we've had many, many storms
in this teacup now.
It's looking more like a flipping tsunami for Google with all of these security problems.
And do we think that Apple did the right thing by maintaining more of a
slimmed-down product range and controlling the ecosystem
that they're able to avoid the worst of these security problems. All right,
from a security problems' point of view, the impact
is more minor for Apple. Frankly there's fewer devices out there to worry about.
But even so should we not have expected more from Google,
one of the world's biggest and most innovative software companies
that they couldn't come up with a solution to patch security
issues as they came up within the operating system. Ufortunately it appears that we have to wait
months or even years or
we may never actually get these security updates. So again
now we have a billion devices, not just half a billion devices
there are now a billion devices open to this vulnerability. My advice would simply be
do not use anything on your Android devices
to exchange information like credit card details. Don't make those purchases from
your Android device
over the internet because right now you cannot guarantee that the server you're
going to be connecting to
does not have this vulnerability and that you yourself are not being hijacked.
It's a massive pity and it's yet another black mark for Google.
Let's hope they're going to do something about this long-term.
.