Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

4/15/2011
07:26 PM
Rob Enderle
Rob Enderle
Commentary
50%
50%

Android Unsafe At Any Price

Google's approach of offering little support to vendors that deploy the OS is worrisome, among other things

Years ago, Ralph Nader made a name for himself with his attack on the General Motors Corvair, entitled "Unsafe at Any Speed," and in watching Google and Android this month I’m beginning to wonder whether Android is the new Corvair with regard to security. When you step back for a moment and really look at Google’s mission and history, using one of its products is like being asked to dinner by a cannibal: you are likely what is on the menu and from a security perspective, that's incredibly stupid.

Android is an open source free copy of iOS (iPhone/iPad OS) done with Linux at its core and designed to lock you into Google search, funded with Google advertising revenue. It is delivered as a kit with very little support by a vendor that clearly believes that those that get Android should be happy with that fact and that it is free. In effect, Google treats Android as a gift to hardware OEMs that comes with some restrictions, but a gift nevertheless and not at all the same as a product someone else would sell. Customer satisfaction is meaningless to Google and they expect the OEMs and carriers to market their own products and assure the customer experience even though these companies get little say about Google’s roadmap, priorities, or access to the secondary advertising revenue stream.

According to “In the Plex” book by Steven Levy about Google, Steve Jobs was tricked into providing Google with core iPhone ideas, and the result was Android. Working with Google may be one of Jobs' greatest regrets, and he had to fire the-then Google CEO from the Apple board. Jobs believes that Android was effectively stolen from him while he was attempting to mentor the Google founders. The hottest topic at the RSA Conference in February was the number of malware-infested applications being written for Android and finding their way onto Android devices. Based on that, Android appears to be the least secure of the currently shipping mass market operating systems.

Google’s core mission is providing access to information regardless of the concerns by the information owners. Initially, CNET grew concerned about how much personal information Google was providing access to, and used the information they acquired on Eric Schmidt’s personal life that was accessible with Google to point this out.

Instead of addressing the problem, Google blacklisted CNET for pointing it out. Since then, the company has had its cars chased out of neighborhoods in Europe by pitchfork- wielding residents, gotten caught and penalized for scanning for and seizing personal information from home Wi-Fi networks, placed under a consent decree for privacy violations by the US government, and has had at least one instance of Google employees stalking young women through their Gmail accounts -- and this list isn’t exhaustive.

Google is regularly being accused of profiting from content and killing the very media industries that supply this content, and currently there are 37 lawsuits pending, alleging that Google illegally copied intellectual property belonging to others when creating Android, most of which are filed against those building Android products. Currently, Google is being investigated for falsely advertising that it had a FISMA security certification on a product designed specifically for government, and for falsely representing products as adequately secure to the County of Los Angeles, California. Each instance put Google advocates at high risk of losing their jobs in the government agencies using, or intending to use, Google’s products.

So a company that was designed to provide information to others-- regardless of concerns by the information owners built a product that Apple allegedly was tricked into contributing to, is considered to be the least secure of the smartphone platforms. And Google has largely stood by while Android licensees are sued for intellectual property theft in Android, and is reported to be unresponsive to the needs and concerns of these vendors on product quality issues, privacy concerns, and unplanned excessive costs (like litigation).

I’m left wondering why anyone would use this smartphone platform. But one thing is clear: unless and until Google changes its approach, Android is unsafe at any price.

--Rob Enderle is president and founder of The Enderle Group. Special to Dark Reading.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
DevSecOps: The Answer to the Cloud Security Skills Gap
Lamont Orange, Chief Information Security Officer at Netskope,  11/15/2019
Attackers' Costs Increasing as Businesses Focus on Security
Robert Lemos, Contributing Writer,  11/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-5118
PUBLISHED: 2019-11-18
A Security Bypass Vulnerability exists in TBOOT before 1.8.2 in the boot loader module when measuring commandline parameters.
CVE-2019-12422
PUBLISHED: 2019-11-18
Apache Shiro before 1.4.2, when using the default "remember me" configuration, cookies could be susceptible to a padding attack.
CVE-2012-4441
PUBLISHED: 2019-11-18
Cross-site Scripting (XSS) in Jenkins main before 1.482 and LTS before 1.466.2 allows remote attackers to inject arbitrary web script or HTML in the CI game plugin.
CVE-2019-10764
PUBLISHED: 2019-11-18
In elliptic-php versions priot to 1.0.6, Timing attacks might be possible which can result in practical recovery of the long-term private key generated by the library under certain conditions. Leakage of a bit-length of the scalar during scalar multiplication is possible on an elliptic curve which m...
CVE-2019-19117
PUBLISHED: 2019-11-18
/usr/lib/lua/luci/controller/admin/autoupgrade.lua on PHICOMM K2(PSG1218) V22.5.9.163 devices allows remote authenticated users to execute any command via shell metacharacters in the cgi-bin/luci autoUpTime parameter.