We are presenting a paper at SPSM next week that shows that, on average over the last four years, 87% of Android devices are vulnerable to attack by malicious apps. This is because manufacturers have not provided regular security updates. Some manufacturers are much better than others however, and our study shows that devices built by LG and Motorola, as well as those devices shipped under the Google Nexus brand are much better than most. Users, corporate buyers and regulators can find further details on manufacturer performance at AndroidVulnerabilities.org
We used data collected by our Device Analyzer app, which is available from the Google Play Store. The app collects data from volunteers around the globe and we have used data from over 20,000 devices in our study. As always, we are keen to recruit more contributors! We combined Device Analyzer data with information we collected on critical vulnerabilities affecting Android. We used this to develop the FUM score which can be used to compare the security provided by different manufacturers. Each manufacturer is given a score out of 10 based on: f, the proportion of devices free from known critical vulnerabilities; u, the proportion of devices updated to the most recent version; and m, the mean number of vulnerabilities the manufacturer has not fixed on any device.
The problem with the lack of updates to Android devices is well known and recently Google and Samsung have committed to shipping security updates every month. Our hope is that by quantifying the problem we can help people when choosing a device and that this in turn will provide an incentive for other manufacturers and operators to deliver updates.
Google has done a good job at mitigating many of the risks, and we recommend users only install apps from Google’s Play Store since it performs additional safety checks on apps. Unfortunately Google can only do so much, and recent Android security problems have shown that this is not enough to protect users. Devices require updates from manufacturers, and the majority of devices aren’t getting them.
For further information, contact Daniel Thomas and Alastair Beresford via contact@androidvulnerabilities.org
Dear Sir, where the hack is Lenovo?
Unfortunately we do not have enough data from many manufacturers to reliably assign a score.
A quick search of the term ‘Device Analyser’ produces no results on Google Play (Moto G, 1st Gen)
You should be able to install the app on a Moto G. Try here.
If this doesn’t work, please email us and we’ll try and help.
I wonder how you analyze the Android phone to find the security issues.
I’ve checked out: http://deviceanalyzer.cl.cam.ac.uk/collected.htm
Here you only mention:
the version of the operating system and the type of device
Does that you base the security issues on the Android version. That means that patched old versions will also be calculated as insecure?
Or do I overlook something?
We use the build number to determine whether the phone may have received a backported patch, and therefore we may classify phones running old versions of Android as either “insecure” or “maybe secure”. Further details are available on the page explaining the graph. Full details are in our paper.
Here is another datapoint that your build number based method may be missing:
For LG model LG-H340n, the updated build LRX21Y (Android 5.0.1, Kernel 3.10.49-gd21b467, SW V10g-EUR-XX) just recently released to handsets fixes the initial Zimperium discovered Stagefright issues, but not the 2 issues some people call “Stagefright 2”. This was measured using Zimperiums testing app.