Perimeter
4/15/2011
07:26 PM
Rob Enderle
Rob Enderle
Commentary
50%
50%

Android Unsafe At Any Price

Google's approach of offering little support to vendors that deploy the OS is worrisome, among other things

Years ago, Ralph Nader made a name for himself with his attack on the General Motors Corvair, entitled "Unsafe at Any Speed," and in watching Google and Android this month I’m beginning to wonder whether Android is the new Corvair with regard to security. When you step back for a moment and really look at Google’s mission and history, using one of its products is like being asked to dinner by a cannibal: you are likely what is on the menu and from a security perspective, that's incredibly stupid.

Android is an open source free copy of iOS (iPhone/iPad OS) done with Linux at its core and designed to lock you into Google search, funded with Google advertising revenue. It is delivered as a kit with very little support by a vendor that clearly believes that those that get Android should be happy with that fact and that it is free. In effect, Google treats Android as a gift to hardware OEMs that comes with some restrictions, but a gift nevertheless and not at all the same as a product someone else would sell. Customer satisfaction is meaningless to Google and they expect the OEMs and carriers to market their own products and assure the customer experience even though these companies get little say about Google’s roadmap, priorities, or access to the secondary advertising revenue stream.

According to “In the Plex” book by Steven Levy about Google, Steve Jobs was tricked into providing Google with core iPhone ideas, and the result was Android. Working with Google may be one of Jobs' greatest regrets, and he had to fire the-then Google CEO from the Apple board. Jobs believes that Android was effectively stolen from him while he was attempting to mentor the Google founders. The hottest topic at the RSA Conference in February was the number of malware-infested applications being written for Android and finding their way onto Android devices. Based on that, Android appears to be the least secure of the currently shipping mass market operating systems.

Google’s core mission is providing access to information regardless of the concerns by the information owners. Initially, CNET grew concerned about how much personal information Google was providing access to, and used the information they acquired on Eric Schmidt’s personal life that was accessible with Google to point this out.

Instead of addressing the problem, Google blacklisted CNET for pointing it out. Since then, the company has had its cars chased out of neighborhoods in Europe by pitchfork- wielding residents, gotten caught and penalized for scanning for and seizing personal information from home Wi-Fi networks, placed under a consent decree for privacy violations by the US government, and has had at least one instance of Google employees stalking young women through their Gmail accounts -- and this list isn’t exhaustive.

Google is regularly being accused of profiting from content and killing the very media industries that supply this content, and currently there are 37 lawsuits pending, alleging that Google illegally copied intellectual property belonging to others when creating Android, most of which are filed against those building Android products. Currently, Google is being investigated for falsely advertising that it had a FISMA security certification on a product designed specifically for government, and for falsely representing products as adequately secure to the County of Los Angeles, California. Each instance put Google advocates at high risk of losing their jobs in the government agencies using, or intending to use, Google’s products.

So a company that was designed to provide information to others-- regardless of concerns by the information owners built a product that Apple allegedly was tricked into contributing to, is considered to be the least secure of the smartphone platforms. And Google has largely stood by while Android licensees are sued for intellectual property theft in Android, and is reported to be unresponsive to the needs and concerns of these vendors on product quality issues, privacy concerns, and unplanned excessive costs (like litigation).

I’m left wondering why anyone would use this smartphone platform. But one thing is clear: unless and until Google changes its approach, Android is unsafe at any price.

--Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-9676
Published: 2015-02-27
The seg_write_packet function in libavformat/segment.c in ffmpeg 2.1.4 and earlier does not free the correct memory location, which allows remote attackers to cause a denial of service ("invalid memory handler") and possibly execute arbitrary code via a crafted video that triggers a use after free.

CVE-2014-9682
Published: 2015-02-27
The dns-sync module before 0.1.1 for node.js allows context-dependent attackers to execute arbitrary commands via shell metacharacters in the first argument to the resolve API function.

CVE-2015-0655
Published: 2015-02-27
Cross-site scripting (XSS) vulnerability in Unified Web Interaction Manager in Cisco Unified Web and E-Mail Interaction Manager allows remote attackers to inject arbitrary web script or HTML via vectors related to a POST request, aka Bug ID CSCus74184.

CVE-2015-0884
Published: 2015-02-27
Unquoted Windows search path vulnerability in Toshiba Bluetooth Stack for Windows before 9.10.32(T) and Service Station before 2.2.14 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that contains a space character.

CVE-2015-0885
Published: 2015-02-27
checkpw 1.02 and earlier allows remote attackers to cause a denial of service (infinite loop) via a -- (dash dash) in a username.

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.