New Android warning hits 750 million customers.
Google is on a mission to shut the hole to iPhone, with a raft of recent Android security measures now hitting units as among the yawning gaps in its safety are lastly closed. However the ecosystem is much from protected, and there are actually greater than 750 million units weak to assault. However it may very well be that Google’s newest replace is the ultimate push for these customers to improve their units.
Whereas its “fascinating” discovering that “iOS units are extra uncovered to phishing and internet content material threats than Android” took the headlines, the newest cell menace report from the workforce at Lookout truly paints a a lot bleaker image for Android than iOS.
Lookout flagged the ten “most typical cell browser vulnerabilities,” all of which (unsurprisingly) focused “Chromium-based browsers.” Whereas which means Chrome, Edge, Opera and extra, it actually means Chrome, which alongside Safari instructions a 90% share of the cell browser market.
All 5 of the “most typical cell app vulnerabilities” recognized by Lookout’s machine scanning additionally focused Android, however 2004’s “file numbers of iOS zero-day vulnerabilities.” What’s of explicit observe is spy ware. 5 of the seven “most important menace households” recognized throughout Q3 reporting interval have been spy ware, as have been half of probably the most encountered malware households. Lookout says it detected greater than 100,000 malicious apps on enterprise units within the interval, which is an alarming improve of just about 33% from the prior quarter.
There have been a succession of Android zero-days this 12 months, which has highlighted the challenges in updating the Android ecosystem—OEM, mannequin, area, service—when in comparison with Apple’s everybody, in all places strategy. Whereas units operating old-fashioned working system variations are an even bigger threat on iPhone than Android, experiences discover that it’s much less of a difficulty throughout enterprises. An outdated Android OS, when added to the dangers inherent in sideloading apps is a large menace to a person and their employer.
Earlier this 12 months, Zimperium’s International Cellular Menace Report warned that 14% of Android units used inside enterprises “can’t be upgraded, leaving them inclined to exploitation.” The researchers flagged the chance for iPhones at a a lot decrease 1%. Zimperium additionally reported that 18% of Android units are actually operating variations of the OS that may not be upgraded, broadly the identical for iPhone.
However as Zimperium’s Nico Chiaraviglio informed me, “Android faces larger malware dangers, primarily on account of its open ecosystem, which permits third-party app shops and software sideloading,“ regardless that “Apple’s App Retailer assessment course of creates an phantasm of good safety, malware and apps that violate Apple’s phrases of service can and do nonetheless slip by or exploit zero-days.”
And whereas Android 15 brings enormous enhancements, Chiaraviglio warns that “Android’s open structure will proceed presenting extra assault vectors than iOS’s managed ecosystem. The fragmented nature of Android updates throughout distributors and carriers might affect these safety enhancements’ effectiveness by rising the variety of bugs that may be exploited.”
In response to StatCounter, whereas 56% of Android telephones are operating Android 13 or newer, one in 4 are operating Android 11 and 12, with 10% on Android 9 and 10. Google ended assist for Android 9 in 2021, Android 10 in 2023 and Android 11 in February this 12 months. Meaning virtually one in 4 telephones operating end-of life OS variations, or a staggering 750 million out of three billion Android telephones.
Clearly, there’s a difficulty right here that isn’t simply solved. And it’s not distinctive to Android—simply have a look at Microsoft’s struggles to shift customers from Home windows 10 because it approaches its personal end-of life. However cell units within the period of BYOD characterize a singular dangers. Carried into the enterprise every day whereas largely beneath the management of the person and outdoors the total attain of IT.
As ESET’s Jake Moore has warned, old-fashioned working techniques might be left weak to assault as criminals search for any vulnerabilities that aren’t patched and goal individuals’s information. They could be protected for the primary few weeks and even months after their assist has come to an finish, however over time, even when the units appear wholesome, they may nonetheless simply be focused by newly positioned vulnerabilities.”
All informed, these 750 million customers should act now and improve their units. If the rising menace from spy ware is just not sufficient, Google is now stepping in to repair the problem. As I reported earlier this month, its Play Integrity API will ramp up from 2025 for “all units operating Android 13 and above to make it sooner, extra dependable, and extra non-public for customers… making it considerably tougher and extra pricey for attackers to bypass.” That can isolate older variations of Android, which means banking and enterprise apps will probably fail to operate or limit what might be executed on older variations of Android. These modifications develop into necessary in Could and can affect excess of simply the 750 million end-of-life units.
Android is altering—the times of aged variations of the OS operating endlessly are coming to an finish,