Perimeter
4/15/2011
07:26 PM
Rob Enderle
Rob Enderle
Commentary
50%
50%

Android Unsafe At Any Price

Google's approach of offering little support to vendors that deploy the OS is worrisome, among other things

Years ago, Ralph Nader made a name for himself with his attack on the General Motors Corvair, entitled "Unsafe at Any Speed," and in watching Google and Android this month I’m beginning to wonder whether Android is the new Corvair with regard to security. When you step back for a moment and really look at Google’s mission and history, using one of its products is like being asked to dinner by a cannibal: you are likely what is on the menu and from a security perspective, that's incredibly stupid.

Android is an open source free copy of iOS (iPhone/iPad OS) done with Linux at its core and designed to lock you into Google search, funded with Google advertising revenue. It is delivered as a kit with very little support by a vendor that clearly believes that those that get Android should be happy with that fact and that it is free. In effect, Google treats Android as a gift to hardware OEMs that comes with some restrictions, but a gift nevertheless and not at all the same as a product someone else would sell. Customer satisfaction is meaningless to Google and they expect the OEMs and carriers to market their own products and assure the customer experience even though these companies get little say about Google’s roadmap, priorities, or access to the secondary advertising revenue stream.

According to “In the Plex” book by Steven Levy about Google, Steve Jobs was tricked into providing Google with core iPhone ideas, and the result was Android. Working with Google may be one of Jobs' greatest regrets, and he had to fire the-then Google CEO from the Apple board. Jobs believes that Android was effectively stolen from him while he was attempting to mentor the Google founders. The hottest topic at the RSA Conference in February was the number of malware-infested applications being written for Android and finding their way onto Android devices. Based on that, Android appears to be the least secure of the currently shipping mass market operating systems.

Google’s core mission is providing access to information regardless of the concerns by the information owners. Initially, CNET grew concerned about how much personal information Google was providing access to, and used the information they acquired on Eric Schmidt’s personal life that was accessible with Google to point this out.

Instead of addressing the problem, Google blacklisted CNET for pointing it out. Since then, the company has had its cars chased out of neighborhoods in Europe by pitchfork- wielding residents, gotten caught and penalized for scanning for and seizing personal information from home Wi-Fi networks, placed under a consent decree for privacy violations by the US government, and has had at least one instance of Google employees stalking young women through their Gmail accounts -- and this list isn’t exhaustive.

Google is regularly being accused of profiting from content and killing the very media industries that supply this content, and currently there are 37 lawsuits pending, alleging that Google illegally copied intellectual property belonging to others when creating Android, most of which are filed against those building Android products. Currently, Google is being investigated for falsely advertising that it had a FISMA security certification on a product designed specifically for government, and for falsely representing products as adequately secure to the County of Los Angeles, California. Each instance put Google advocates at high risk of losing their jobs in the government agencies using, or intending to use, Google’s products.

So a company that was designed to provide information to others-- regardless of concerns by the information owners built a product that Apple allegedly was tricked into contributing to, is considered to be the least secure of the smartphone platforms. And Google has largely stood by while Android licensees are sued for intellectual property theft in Android, and is reported to be unresponsive to the needs and concerns of these vendors on product quality issues, privacy concerns, and unplanned excessive costs (like litigation).

I’m left wondering why anyone would use this smartphone platform. But one thing is clear: unless and until Google changes its approach, Android is unsafe at any price.

--Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading December Tech Digest
Experts weigh in on the pros and cons of end-user security training.
Flash Poll
Title Partner’s Role in Perimeter Security
Title Partner’s Role in Perimeter Security
Considering how prevalent third-party attacks are, we need to ask hard questions about how partners and suppliers are safeguarding systems and data.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5395
Published: 2014-11-21
Multiple cross-site request forgery (CSRF) vulnerabilities in Huawei HiLink E3276 and E3236 TCPU before V200R002B470D13SP00C00 and WebUI before V100R007B100D03SP01C03, E5180s-22 before 21.270.21.00.00, and E586Bs-2 before 21.322.10.00.889 allow remote attackers to hijack the authentication of users ...

CVE-2014-7137
Published: 2014-11-21
Multiple SQL injection vulnerabilities in Dolibarr ERP/CRM before 3.6.1 allow remote authenticated users to execute arbitrary SQL commands via the (1) contactid parameter in an addcontact action, (2) ligne parameter in a swapstatut action, or (3) project_ref parameter to projet/tasks/contact.php; (4...

CVE-2014-7871
Published: 2014-11-21
SQL injection vulnerability in Open-Xchange (OX) AppSuite before 7.4.2-rev36 and 7.6.x before 7.6.0-rev23 allows remote authenticated users to execute arbitrary SQL commands via a crafted jslob API call.

CVE-2014-8090
Published: 2014-11-21
The REXML parser in Ruby 1.9.x before 1.9.3 patchlevel 551, 2.0.x before 2.0.0 patchlevel 598, and 2.1.x before 2.1.5 allows remote attackers to cause a denial of service (CPU and memory consumption) a crafted XML document containing an empty string in an entity that is used in a large number of nes...

CVE-2014-8469
Published: 2014-11-21
Cross-site scripting (XSS) vulnerability in Guests/Boots in AdminCP in Moxi9 PHPFox before 4 Beta allows remote attackers to inject arbitrary web script or HTML via the User-Agent header.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Now that the holiday season is about to begin both online and in stores, will this be yet another season of nonstop gifting to cybercriminals?