Perimeter
4/15/2011
07:26 PM
Rob Enderle
Rob Enderle
Commentary
Connect Directly
RSS
E-Mail
50%
50%

Android Unsafe At Any Price

Google's approach of offering little support to vendors that deploy the OS is worrisome, among other things

Years ago, Ralph Nader made a name for himself with his attack on the General Motors Corvair, entitled "Unsafe at Any Speed," and in watching Google and Android this month I’m beginning to wonder whether Android is the new Corvair with regard to security. When you step back for a moment and really look at Google’s mission and history, using one of its products is like being asked to dinner by a cannibal: you are likely what is on the menu and from a security perspective, that's incredibly stupid.

Android is an open source free copy of iOS (iPhone/iPad OS) done with Linux at its core and designed to lock you into Google search, funded with Google advertising revenue. It is delivered as a kit with very little support by a vendor that clearly believes that those that get Android should be happy with that fact and that it is free. In effect, Google treats Android as a gift to hardware OEMs that comes with some restrictions, but a gift nevertheless and not at all the same as a product someone else would sell. Customer satisfaction is meaningless to Google and they expect the OEMs and carriers to market their own products and assure the customer experience even though these companies get little say about Google’s roadmap, priorities, or access to the secondary advertising revenue stream.

According to “In the Plex” book by Steven Levy about Google, Steve Jobs was tricked into providing Google with core iPhone ideas, and the result was Android. Working with Google may be one of Jobs' greatest regrets, and he had to fire the-then Google CEO from the Apple board. Jobs believes that Android was effectively stolen from him while he was attempting to mentor the Google founders. The hottest topic at the RSA Conference in February was the number of malware-infested applications being written for Android and finding their way onto Android devices. Based on that, Android appears to be the least secure of the currently shipping mass market operating systems.

Google’s core mission is providing access to information regardless of the concerns by the information owners. Initially, CNET grew concerned about how much personal information Google was providing access to, and used the information they acquired on Eric Schmidt’s personal life that was accessible with Google to point this out.

Instead of addressing the problem, Google blacklisted CNET for pointing it out. Since then, the company has had its cars chased out of neighborhoods in Europe by pitchfork- wielding residents, gotten caught and penalized for scanning for and seizing personal information from home Wi-Fi networks, placed under a consent decree for privacy violations by the US government, and has had at least one instance of Google employees stalking young women through their Gmail accounts -- and this list isn’t exhaustive.

Google is regularly being accused of profiting from content and killing the very media industries that supply this content, and currently there are 37 lawsuits pending, alleging that Google illegally copied intellectual property belonging to others when creating Android, most of which are filed against those building Android products. Currently, Google is being investigated for falsely advertising that it had a FISMA security certification on a product designed specifically for government, and for falsely representing products as adequately secure to the County of Los Angeles, California. Each instance put Google advocates at high risk of losing their jobs in the government agencies using, or intending to use, Google’s products.

So a company that was designed to provide information to others-- regardless of concerns by the information owners built a product that Apple allegedly was tricked into contributing to, is considered to be the least secure of the smartphone platforms. And Google has largely stood by while Android licensees are sued for intellectual property theft in Android, and is reported to be unresponsive to the needs and concerns of these vendors on product quality issues, privacy concerns, and unplanned excessive costs (like litigation).

I’m left wondering why anyone would use this smartphone platform. But one thing is clear: unless and until Google changes its approach, Android is unsafe at any price.

--Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6117
Published: 2014-07-11
Dahua DVR 2.608.0000.0 and 2.608.GV00.0 allows remote attackers to bypass authentication and obtain sensitive information including user credentials, change user passwords, clear log files, and perform other actions via a request to TCP port 37777.

CVE-2014-0174
Published: 2014-07-11
Cumin (aka MRG Management Console), as used in Red Hat Enterprise MRG 2.5, does not include the HTTPOnly flag in a Set-Cookie header for the session cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to this cookie.

CVE-2014-3485
Published: 2014-07-11
The REST API in the ovirt-engine in oVirt, as used in Red Hat Enterprise Virtualization (rhevm) 3.4, allows remote authenticated users to read arbitrary files and have other unspecified impact via unknown vectors, related to an XML External Entity (XXE) issue.

CVE-2014-3499
Published: 2014-07-11
Docker 1.0.0 uses world-readable and world-writable permissions on the management socket, which allows local users to gain privileges via unspecified vectors.

CVE-2014-3503
Published: 2014-07-11
Apache Syncope 1.1.x before 1.1.8 uses weak random values to generate passwords, which makes it easier for remote attackers to guess the password via a brute force attack.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Marilyn Cohodas and her guests look at the evolving nature of the relationship between CIO and CSO.