First-ever monthly Android security updates start to roll out

Stagefright¹ was the scariest Android vulnerability to come along in some time . A bug in Android’s “Stagefright” media library could, if fully weaponized, allow an attacker to execute malicious code just by sending an MMS message to a user . Luckily exploit mitigation techniques in newer versions of Android stopped the Stagefright vulnerability from becoming a pwning free-for-all, but the bug shined a bright light on Android’s sub-par security situation.

The publicity got the Android device ecosystem Google, OEMs, and carriers to at least start paying attention to delivering security updates to users in a timely manner . Google, Samsung, and LG scrambled to get fixes out² to their flagship devices and promised monthly security updates³ for their devices . That was 36 days ago.

Today, Google has posted the first of those monthly security updates for Nexus device owners .

The Nexus system image⁴ page added Android 5.1.1 build “LMY48M” for the Nexus 4, 5, 6, 7, 9, and 10, along with build “LMY48N” for the Android TV-based Nexus Player . LMY48M hit Google’s public AOSP repository yesterday (September 9).

Our friends at Android Police cobbled together⁵ a changelog, which contains a few security fixes, including a “Moderate severity vulnerability” that allowed apps to bypass the SMS short code notification prompt that warned users that short codes can cost them money.

Now that Google’s fixes are out the door, how is everyone else doing ? With no scalable update system⁶, getting these security updates out to users is the responsibility of every OEM and carrier combo out there, and updates are unique for every individual device model .

So far, we’ve seen the US carrier T-Mobile announce OTAs for the Nexus 4, 5, 6, 7, and 9⁷ the company actually beat Google to the punch by a day . T-Mobile’s support page says an update is coming for the Galaxy S6⁸ and Note 5⁹ on September 10, and a representative from the company told us the LG G4 will be updated soon as well.

Nexus devices, being directly from Google and being the devices Android is actually developed on, are of course going to have faster updates and therefore better security than everything else . The question is how much faster will they be?

Today the clock starts for everyone else .

We’ve contacted Samsung, LG, HTC, Motorola, Sony, Verizon, AT&T, Sprint, and T-Mobile for update timelines to see how they’re doing .

We will also be contacting other major carriers from the UK and Europe, such as Vodafone, EE, Three, and O2 .

Hopefully enough of them will get back to us that we’ll be able to put together a picture of what the current Android update landscape looks like.

This post originated on Ars Technica¹⁰

References

1. ^{^} Stagefright (arstechnica.com)
2. ^{^} scrambled to get fixes out (arstechnica.com)
3. ^{^} monthly security updates (officialandroid.blogspot.com)
4. ^{^} Nexus system image (developers.google.com)
5. ^{^} Android Police cobbled together (www.androidpolice.com)
6. ^{^} no scalable update system (arstechnica.com)
7. ^{^} Nexus 4, 5, 6, 7, and 9 (www.androidpolice.com)
8. ^{^} Galaxy S6 (support.t-mobile.com)
9. ^{^} Note 5 (support.t-mobile.com)
10. ^{^} Ars Technica (arstechnica.com)

The post First-ever monthly Android security updates start to roll out appeared first on News4Security.