Perimeter
4/15/2011
07:26 PM
Rob Enderle
Rob Enderle
Commentary
50%
50%

Android Unsafe At Any Price

Google's approach of offering little support to vendors that deploy the OS is worrisome, among other things

Years ago, Ralph Nader made a name for himself with his attack on the General Motors Corvair, entitled "Unsafe at Any Speed," and in watching Google and Android this month I’m beginning to wonder whether Android is the new Corvair with regard to security. When you step back for a moment and really look at Google’s mission and history, using one of its products is like being asked to dinner by a cannibal: you are likely what is on the menu and from a security perspective, that's incredibly stupid.

Android is an open source free copy of iOS (iPhone/iPad OS) done with Linux at its core and designed to lock you into Google search, funded with Google advertising revenue. It is delivered as a kit with very little support by a vendor that clearly believes that those that get Android should be happy with that fact and that it is free. In effect, Google treats Android as a gift to hardware OEMs that comes with some restrictions, but a gift nevertheless and not at all the same as a product someone else would sell. Customer satisfaction is meaningless to Google and they expect the OEMs and carriers to market their own products and assure the customer experience even though these companies get little say about Google’s roadmap, priorities, or access to the secondary advertising revenue stream.

According to “In the Plex” book by Steven Levy about Google, Steve Jobs was tricked into providing Google with core iPhone ideas, and the result was Android. Working with Google may be one of Jobs' greatest regrets, and he had to fire the-then Google CEO from the Apple board. Jobs believes that Android was effectively stolen from him while he was attempting to mentor the Google founders. The hottest topic at the RSA Conference in February was the number of malware-infested applications being written for Android and finding their way onto Android devices. Based on that, Android appears to be the least secure of the currently shipping mass market operating systems.

Google’s core mission is providing access to information regardless of the concerns by the information owners. Initially, CNET grew concerned about how much personal information Google was providing access to, and used the information they acquired on Eric Schmidt’s personal life that was accessible with Google to point this out.

Instead of addressing the problem, Google blacklisted CNET for pointing it out. Since then, the company has had its cars chased out of neighborhoods in Europe by pitchfork- wielding residents, gotten caught and penalized for scanning for and seizing personal information from home Wi-Fi networks, placed under a consent decree for privacy violations by the US government, and has had at least one instance of Google employees stalking young women through their Gmail accounts -- and this list isn’t exhaustive.

Google is regularly being accused of profiting from content and killing the very media industries that supply this content, and currently there are 37 lawsuits pending, alleging that Google illegally copied intellectual property belonging to others when creating Android, most of which are filed against those building Android products. Currently, Google is being investigated for falsely advertising that it had a FISMA security certification on a product designed specifically for government, and for falsely representing products as adequately secure to the County of Los Angeles, California. Each instance put Google advocates at high risk of losing their jobs in the government agencies using, or intending to use, Google’s products.

So a company that was designed to provide information to others-- regardless of concerns by the information owners built a product that Apple allegedly was tricked into contributing to, is considered to be the least secure of the smartphone platforms. And Google has largely stood by while Android licensees are sued for intellectual property theft in Android, and is reported to be unresponsive to the needs and concerns of these vendors on product quality issues, privacy concerns, and unplanned excessive costs (like litigation).

I’m left wondering why anyone would use this smartphone platform. But one thing is clear: unless and until Google changes its approach, Android is unsafe at any price.

--Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-2184
Published: 2015-03-27
Movable Type before 5.2.6 does not properly use the Storable::thaw function, which allows remote attackers to execute arbitrary code via the comment_state parameter.

CVE-2014-3619
Published: 2015-03-27
The __socket_proto_state_machine function in GlusterFS 3.5 allows remote attackers to cause a denial of service (infinite loop) via a "00000000" fragment header.

CVE-2014-8121
Published: 2015-03-27
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up while the database is iterated over...

CVE-2014-9712
Published: 2015-03-27
Websense TRITON V-Series appliances before 7.8.3 Hotfix 03 and 7.8.4 before Hotfix 01 allows remote administrators to read arbitrary files and obtain passwords via a crafted path.

CVE-2015-0658
Published: 2015-03-27
The DHCP implementation in the PowerOn Auto Provisioning (POAP) feature in Cisco NX-OS does not properly restrict the initialization process, which allows remote attackers to execute arbitrary commands as root by sending crafted response packets on the local network, aka Bug ID CSCur14589.

Dark Reading Radio
Archived Dark Reading Radio
Good hackers--aka security researchers--are worried about the possible legal and professional ramifications of President Obama's new proposed crackdown on cyber criminals.