Related
I have wondered on and off occasionally what happens if a security issue happens with the android OS.
Currently as we all know android is incredibly fragmented, mainly due to a system where the phone vendors roll out updates at their own leisure and google upgrading the OS at a very fast pace. Combination of the two equals fragmented userbase. But I have never seen an update for android on any version stated to fix a security issue.
Then I read this article.
http://www.bbc.co.uk/news/technology-23431281
It mentiones manufacturers have yet to pass on the patch which is no surprise as here in the uk the phones that still do get updates tend to be 12 months behind google's updates (unless a new model on market), which is a deliberate policy so people buy a new phone to get new android.
Does anyone here know which android version's are affected and if custom roms have it patched?
chrcol said:
I have wondered on and off occasionally what happens if a security issue happens with the android OS.
Currently as we all know android is incredibly fragmented, mainly due to a system where the phone vendors roll out updates at their own leisure and google upgrading the OS at a very fast pace. Combination of the two equals fragmented userbase. But I have never seen an update for android on any version stated to fix a security issue.
Then I read this article.
http://www.bbc.co.uk/news/technology-23431281
It mentiones manufacturers have yet to pass on the patch which is no surprise as here in the uk the phones that still do get updates tend to be 12 months behind google's updates (unless a new model on market), which is a deliberate policy so people buy a new phone to get new android.
Does anyone here know which android version's are affected and if custom roms have it patched?
Click to expand...
Click to collapse
if you're rooted (which i assume seeing your signature) you're safe.
Also read this: http://www.androidcentral.com/making-sense-latest-android-security-scare
well it doesnt say you safe if rooted it just says you have bigger security concerns to worry about so dont worry about this.
So in short if that article is right, its been a problem since android 1.6, all that time google hasnt bothered to patch it, samsung did their own patch but only on the s4, and android 4.3 is expected to be patched.
In the meantime ensure unknown app sources is disabled.
thats what I get from that article.
Very important thread.
Thanks for posting.
I'm glad I'm rooted
another article.
http://searchnetworking.techtarget....s-Report-Mobile-malware-attacks-grew-over-600
Seems android not disclosing the security issues and it wouldnt surprise me all the older phones with no updates are full of security holes.
should google be backporting security fixes to 2.2.x 2.1.x etc?
Install Xposed framework and then load the patch module to fix both security exploits, or simply only install well trusted apps
yeah I patched my AOKP now.
looking at this url it seems I can do the same on TW rom also.
http://forum.xda-developers.com/showthread.php?t=2374453
i am buying a new phone, the S8+ to be exact, and there have been a lot of new developments (problems) when it comes to rooting your device. i've been rooting my smartphone devices for over 10 years because i love the freedom it brings (er, brought). Now i read things like Netflix, Snapchat, and AndroidPay not working on rooted devices. So i am wondering what people's experiences have been like. Any regrets? Are the trade-offs worth it to you? Is it worth being able to uninstall bloatware and install custom ROMs if a lot of other features and apps will stop working? i know most of this is personal preference but would like to know more about what other people have experienced.
billybag said:
i am buying a new phone, the S8+ to be exact, and there have been a lot of new developments (problems) when it comes to rooting your device. i've been rooting my smartphone devices for over 10 years because i love the freedom it brings (er, brought). Now i read things like Netflix, Snapchat, and AndroidPay not working on rooted devices. So i am wondering what people's experiences have been like. Any regrets? Are the trade-offs worth it to you? Is it worth being able to uninstall bloatware and install custom ROMs if a lot of other features and apps will stop working? i know most of this is personal preference but would like to know more about what other people have experienced.
Click to expand...
Click to collapse
First and foremost, if you plan on getting a US variant, meaning it will have a SD835 in it, Root is unlikely to come soon for it, This doesn't mean it won't happen, just not soon. Now if we're talking international, the ones that ship with an Exynos in it, they're rootable now.
Now, with that out the way let's get into the questions you've asked. There will indeed be a selection of apps that will not work when rooted these days because of "SafetyNet" check failure. Some of the biggest would be Snapchat and Android pay, However they will work with the assistance of Magisk which will allow SafetyNet to pass it's check, Same goes for most apps that fail to work because of root presence.
Heading back to what I first mentioned now, Rooting a Samsung device of recent years comes with some pretty notable cons to it, These would include loss of KNOX, I'm not sure what your stance on security is but if security is a concern to you, losing KNOX is not good. Another big and notable con is you will lose all Samsung pay support permanently, Actually to be honest both of the latter are permanently lost once rooted. If these things aren't a concern for you then by all means root away.
On to other things now, Rooting these days doesn't present as many attractive things as it use to, especially on a Samsung device. Most OEMS have given alternatives to many of the things a user couldn't do without root before. Currently there is no Xposed on Nougat and above, it's being worked on but there is no foreseeable date that can be given on when it will be completed.
So all in all, Until root is achieved for the Snapdragon variants, I'd hold off on a purchase of an S8. If we're talking Exynos variants then by all means get one, as I've said they're rootable right now. But don't let that be the ray of sunshine, though they're rootable, They're in infact an Exynos and Samsung is unwilling to provide source code to their Exynos chipsets. Which basically means to you that custom ROMs will be limited to rehashes of the stock ROMs with a couple mods if possible, AOSP such as Lineage and others like it are next to impossible to happen on Exynos without​ a source code to work from. It has been done before but the resulting roms took a long time to develop and either were extremely buggy or were just simply not usable for daily use.
I'm pretty sure I've hopefully covered every aspect I could but if you've got any more questions I'll surely answer them.
I apologise for this being so long lol.
Perfect. Thank you, this helped a lot.
billybag said:
Perfect. Thank you, this helped a lot.
Click to expand...
Click to collapse
Glad I could help, Again sorry it was a lengthy response but it was necessary to cover all of it.
Hello everyone, I plan to buy a S9+, so I have some questions about the S9+
Should I buy the Exynos or Snapdragon variant ? (those two model cover the band of my provider)
If I trigger Knox, can I still use apps like Snapchat, Pokemon Go, Google Pay... ?
When Knox is tampered, what apps will no longer works ?
Does some applications not provided by Samsung verify the Knox state ?
Thanks
marwanpro said:
Hello everyone, I plan to buy a S9+, so I have some questions about the S9+
Should I buy the Exynos or Snapdragon variant ? (those two model cover the band of my provider)
If I trigger Knox, can I still use apps like Snapchat, Pokemon Go, Google Pay... ?
When Knox is tampered, what apps will no longer works ?
Does some applications not provided by Samsung verify the Knox state ?
Thanks
Click to expand...
Click to collapse
When knox is tampered functions like Samsung pay,secure folder stop working.Other apps will work flawlessly,Not sure about google play.Roms are more for exynos version,Although snapdragon will have better support for Android in future.Gcam works better on SD
I'm dealing with similar issues. Sorry, the information isn't very concise or clear. I think there are a lot of people giving advice who don't really understand the technical issues.
If you are going to break Knox and the international (Exynos) supports all of the LTE bands of your provider, I'd recommend it. There are far more choices for ROMs because it has an unlocked bootloader.
The Snapdragon variant can reportedly be unlocked through a paid service. I'm not sure if that trips Knox. Extreme Syndicate allows rooting without tripping Knox, but I've been unable to verify whether it will work on newer bootloaders. (Someone help!!)
Google's SafetyNet fails if Knox is tripped. Pokemon Go, specifically will not work. I'm not sure about the other 2, but I have read that Google Pay works while Samsung Pay can never work again. Someone please correct me if this is inaccurate.
In general, you will have problems with secure apps like banking, etc., but there are work-arounds for some of them.
A program that I use and the only reason for my concern, Boomerang Parental Controls, uses Knox to increase security. It's unclear whether it will continue to function fully if Knox is tripped.
Any program could be coded to check the Knox state, but they generally will not unless there is a need to. The banking apps and other secured apps are generally looking for system tampering because it might lead to failed security measures.
Hope this helps.
The days of rooting is over, from my S2-S8+ there where numerous roms but for my S9+ there is less than a handful. Is it because of Knox or something else? or maybe because of all the themes that are out. If it is due to Knox, Sammy have fulfilled their objective with it, what do you lot think.
Knox is the same between the two models, rooting permanently trips it.
I'd guess part of the problem with the unlocked rootable models is no one upgraded from the S8+ because it wasn't a big jump.. less developers using them equals less roms..
While the number of total ROMs have gone down, there's still a fair selection to choose from in the S9/S9+ cross-device development forum. But to answer your question, I'm sure the US variants of the S9+ having locked bootloaders halted a lot of potential development for the device.
Since there is the knox sdk that now allows us things to do like dns firewall, systemwide adblock, disable nearly all unwanted apps.. For me there is no real need for root anymore.
I only miss a few apps (titani um backup, game g uardien) but I can live with that..
What do you need root for?
It is not over yet because we have gsi's to flash and have the whole pixel experience etc.
Hi everyone,
I can't find a satisfactory answer on my favorite search engines, so I thought I'd come here and ask. Sorry if this question has already been put on the table, carved, sliced and gobbled, I couldn't find trace of it in the forum's search engine either.
My phone's a Leagoo T5c that will forever be stuck on Android 7.0, it seems, because the OEM has already lost interest, and because its SoC makes it difficult, if not downright impossible, to find a suitable custom ROM.
The latest ROM I could find and install on this phone goes back to August of 2018 (no-no, no typos), and its Security Update is even one month older (July 2018).
My question is in the title: Is it possible to install Security Updates without reinstalling/updating/upgrading the firmware itself, like you would in, say, Windows or any other OS, I presume?
UglyStuff said:
Hi everyone,
I can't find a satisfactory answer on my favorite search engines, so I thought I'd come here and ask. Sorry if this question has already been put on the table, carved, sliced and gobbled, I couldn't find trace of it in the forum's search engine either.
My phone's a Leagoo T5c that will forever be stuck on Android 7.0, it seems, because the OEM has already lost interest, and because its SoC makes it difficult, if not downright impossible, to find a suitable custom ROM.
The latest ROM I could find and install on this phone goes back to August of 2018 (no-no, no typos), and its Security Update is even one month older (July 2018).
My question is in the title: Is it possible to install Security Updates without reinstalling/updating/upgrading the firmware itself, like you would in, say, Windows or any other OS, I presume?
Click to expand...
Click to collapse
With android 10 were introduced Google play security updates that lets you received security updates (not all of them unfortunately, some requires to upgrade) without updating the full OS. You can't do it because you're stuck with the wrong Android version
Hopefully you won't have any issues with hacking but consider buying a new phone when you'll get a chance
Security updates get rolled out as OTA by OEM/Carrier if they consider it's necessary. You can't force it. Theoretically, all Android smartphones should get around two years of security updates. However, the reality is often very different.
The Leagoo T5c is a small-budget phone what was sold for 99 USD - so more or less a disposable item. You cannot expect OEM/Carrier to have any interest in providing updates for such a phone.
Thank you both for your explanations. I understand that Android works differently when it comes to updating itself, mostly because Google isn't the only party to have a voice in the chapter; still, it's unnerving to see that the end-user is more or less captive anyway.
It kinda defeats the very purpose of an open-source OS, to have to wait for an OEM to release (or not) an update, when you could install the patches yourself.
As for buying another phone, well, as soon as I've got the dough, I will, believe me. Not because I'm dissatisfied with this one, but because I don't like the idea of totting around with a phone that hasn't seen a security update in over two years.
I'm also seriously considering moving to Ubuntu Touch, though there again, my phone's exotic platform could be problematic. Custom ROMs seems to be as complicated an avenue as others, too.
All in all, Android isn't what they sold me: It's not secure, it's not "free", it's just another way to make you shell out bucks for new hardware every couple years.
Android is just iOS without the eye-candy, you ask me...
UglyStuff said:
Thank you both for your explanations. I understand that Android works differently when it comes to updating itself, mostly because Google isn't the only party to have a voice in the chapter; still, it's unnerving to see that the end-user is more or less captive anyway.
It kinda defeats the very purpose of an open-source OS, to have to wait for an OEM to release (or not) an update, when you could install the patches yourself.
As for buying another phone, well, as soon as I've got the dough, I will, believe me. Not because I'm dissatisfied with this one, but because I don't like the idea of totting around with a phone that hasn't seen a security update in over two years.
I'm also seriously considering moving to Ubuntu Touch, though there again, my phone's exotic platform could be problematic. Custom ROMs seems to be as complicated an avenue as others, too.
All in all, Android isn't what they sold me: It's not secure, it's not "free", it's just another way to make you shell out bucks for new hardware every couple years.
Android is just iOS without the eye-candy, you ask me...
Click to expand...
Click to collapse
Android isn't iOS precisely because you can break free from your OEM by flashing a custom ROM. You can develop one for almost any device as long as the OEM releases the kernel source code. And most OEM do (expect for some very unknown phones).
Custom ROMs like GrapheneOS are made to free you from google Services and are truly privacy oriented. And all of that is possible because Android is open source.
Trust me, the Android community has always worked actively to counter aging of their devices (including me).
Just buy a phone with a solid community behind and you'll be able to keep it up to date a looong time
Raiz said:
Android isn't iOS precisely because you can break free from your OEM by flashing a custom ROM. You can develop one for almost any device as long as the OEM releases the kernel source code. And most OEM do (expect for some very unknown phones).
Custom ROMs like GrapheneOS are made to free you from google Services and are truly privacy oriented. And all of that is possible because Android is open source.
Trust me, the Android community has always worked actively to counter aging of their devices (including me).
Just buy a phone with a solid community behind and you'll be able to keep it up to date a looong time
Click to expand...
Click to collapse
I agree with you in principle, but if I must take an example: I have this Early 2006 MacBook Pro with a Core Duo CPU that precludes me from even installing Mac OS X 10.7 "Lion" on it, because the CPU is 32-bit-only, and Lion requires a 64-bit CPU.
The machine itself works very well, albeit a bit slowly, but then it's got only 2 GB of RAM and a 120-GB SSD. When I got fed-up with OS X applications not updating/upgrading and Firefox addons not installing because my copy of Firefox was too old, I partitioned the SSD, installed rEFInd as boot manager, and installed Zorin 15.2 (now 15.3) Lite 32-bit.
I now spend more time on the Linux side of this Mac than on the OS X side, and updating/upgrading it is a breeze, either via the dedicated application or in Terminal. I know there'll be an end-of-the-line there too, someday, but at least I'll keep using this Mac until it truly dies on me, not when Apple tells me it's dead.
This, for me, is the very essence of open-source: Not just the fact that it's free, but that you can revive an old machine and keep it running long after Apple et al have decided that it had gone the way of the dinosaurs.
The same doesn't apply to Android, alas. Here, you must have a compatible SoC/chipset/what-have-you, a Treble-compatible device, you must have this, you must have that...
In the end, only a fraction of Android users really get to enjoy everything their device has to offer for as long as they choose; the others just pop into the nearest phone store, be it brick-and-mortar or cyber, and must produce their credit card.
My question was as much a challenge to myself as anything else. I would really like to learn how Android works, but the tutorials and articles I've found here and there are all a bit cryptic.
That's why I'm regularly prowling this forum, I guess.
"Hunting high and low", as the song goes... :laugh:
yep, good question but google & manufactures are in it for the moola not the users 2 yr old phone.
hiitsrudd said:
yep, good question but google & manufactures are in it for the moola not the users 2 yr old phone.
Click to expand...
Click to collapse
Don't I know it! It's true that even budget phones have decent specs nowadays, still, why dump a perfectly functioning phone simply because you can't update/upgrade the software?
I understand Google's rationale, of course: They invest tons of money year after year after year to keep the whole boat afloat, and they need a steady income. OK. Still, to not be able to keep your phone ***safe*** is a no-go for me.
I'm seriously beginning to think about installing Ubuntu Touch on the device. I think I'm going to try that next weekend.
I'll probably come back here with my eyes red, asking for help in unbricking my phone, though.
Stay tuned! :good:
A followup, if you are mindful of your own security it's conceivable to get more usage of that android. I don't use a banking app, but if need be use a good browser( thats updated of course) And update all often used apps via playstore. I'm still running Oreo on my phone. FYI you iOS ppl need to do critical updates asap