Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Mobile

11/15/2016
12:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

More Than Half Of Android Devices Run Outdated Browsers

Researchers discovered 59% of Android devices run out-of-date Chrome browsers, increasing enterprise exposure to hackers.

A new pool of data from cloud-based authentication provider Duo Security found more than half (59%) of Android devices are running out-of-date Chrome browsers. This leaves users – and the organizations they work for – vulnerable to attack.

To gauge enterprise risk amid the rise of BYOD programs, Duo Security researchers analyzed the security vulnerabilities of browsers on 3 million smartphones and PCs.

Just over one million devices surveyed were running Windows desktop, the most common OS in the data. One million of devices surveyed were powered by Android. Chrome was the most popular browser, running on 36% of all devices surveyed.

Overall, across all devices and browsers, 42% of the devices Duo studied were using outdated browsers. Fifty-seven percent of all browsers on Android devices were out of date. 

Android users running Chrome had worse habits than average (59% running outdated), despite Chrome's default setting of auto-updating on restart. The disparity is due to a small number of Android users who run Firefox; they tend to be more up-to-date than Chrome users, says Mike Hanley, director of security at Duo Security.

Hanley says that as a result of platform fragmentation, most Android devices rely on carriers and manufacturers to release operating systems for their specific phone. While auto-updating usually results in fewer out-of-date devices, it can't help when there isn't an option to update.

"Ultimately, auto-updating helps the situation in which you're forced to run an outdated operating system, but it doesn't fix it," he explains.

For example, Chrome for Android is currently only releasing new versions for Jelly Bean and up. There aren't many devices older than that, Hanley notes. However, if Chrome stopped supporting Jelly Bean, 4% of Android users would be stuck with old versions of both Android and Chrome.

"Many other software developers will drop support for old Android versions faster, since they don't have the resources of Google to continually test relatively ancient phones," he says. "This leads to users being stuck with outdated versions of Chrome."

Google Chrome was the most dominant browser in the study, running on 36% of devices. Internet Explorer was next at 29%, followed by Firefox (12%), Safari Mobile (8%), Safari (7%), Chrome Mobile (3%), Microsoft Edge (3%), AppleMail (1%), and Chrome Mobile iOS (1%).

"As with many complex software projects, browser bugs with security implications are frequently discovered and patched," Hanley says. "Attackers can chain attacks together, using one as the foothold for the next, so the risk increases as more bugs are fixed in newer versions."

A successful attack can be used to deploy ransomware, exfiltrate corporate data, and aid further attacks, he adds.

Some 30% of devices were not password-protected. More than 20,000 had been tampered with, which makes them more of a security risk because they could have already been infected with malware.

"The 30% of Android devices that don't have a screen lock passcode, pattern, or fingerprint reader implies a surprising lack of caution on the users' part, particularly given that these devices are being used as part of secure access to corporate resources," Hanley says.

Many of the browsers analyzed were running old and vulnerable versions of Flash, including Internet Explorer (62%), Safari (32%), Firefox (32%), and Chrome (11%). Security flaws in old versions of Flash can lead to data leaks and remote code execution. This makes it easier for hackers to assume control over an affected system.

"Flash frequently updates to patch security bugs, and given that Flash shows up anywhere from online games to ads, it's critical to stay up to date so you and your company's data stay as safe as possible," he says.

As the workforce becomes increasingly mobile, security pros and IT managers may want to rethink their approaches to update security. Oftentimes, businesses and educational institutions will lock their operating systems so users can't install unauthorized software, said Hanley.

"Unfortunately, this often also prevents auto-update tools from functioning properly," he continued. "Configuring your endpoints to auto-update as much as possible reduces risk and lifts the burden on IT administrators from doing mundane software updates."

Going forward, he expects more software - not just browsers - will transition to a Chrome-style update model, in which the new version is silently installed then automatically used when the user restarts their browser or device.

Related Content:

 

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Jason Lares
50%
50%
Jason Lares,
User Rank: Apprentice
5/10/2017 | 5:39:12 PM
Re: Thank you for sharing
"Flash frequently updates to patch security bugs"

Isn't it about time developers ditch this buggy, glitchy software for good?! Always crashing my browser, or is it just me?
darkdobre
50%
50%
darkdobre,
User Rank: Apprentice
11/17/2016 | 1:39:39 AM
Thank you for sharing
I agree, even I pay much attention in internet security, there are many Android app I don't updates, because of I don't use them regularly or don't want because of the big size of the update file. Thank you for sharing the post.
US Turning Up the Heat on North Korea's Cyber Threat Operations
Jai Vijayan, Contributing Writer,  9/16/2019
MITRE Releases 2019 List of Top 25 Software Weaknesses
Kelly Sheridan, Staff Editor, Dark Reading,  9/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "He's too shy to invite me out face to face!"
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15138
PUBLISHED: 2019-09-20
The html-pdf package 2.2.0 for Node.js has an arbitrary file read vulnerability via an HTML file that uses XMLHttpRequest to access a file:/// URL.
CVE-2019-6145
PUBLISHED: 2019-09-20
Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs ...
CVE-2019-6649
PUBLISHED: 2019-09-20
F5 BIG-IP 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 and Enterprise Manager 3.1.1 may expose sensitive information and allow the system configuration to be modified when using non-default ConfigSync settings.
CVE-2019-6650
PUBLISHED: 2019-09-20
F5 BIG-IP ASM 15.0.0, 14.1.0-14.1.0.6, 14.0.0-14.0.0.5, 13.0.0-13.1.1.5, 12.1.0-12.1.4.1, 11.6.0-11.6.4, and 11.5.1-11.5.9 may expose sensitive information and allow the system configuration to be modified when using non-default settings.
CVE-2014-10396
PUBLISHED: 2019-09-20
The epic theme through 2014-09-07 for WordPress allows arbitrary file downloads via the file parameter to includes/download.php.