Android Ecosystem Contains Several Hidden Patch Gaps that Can be Exploited by Hackers

The Android operating system is one of the most widely used platforms with 2 billion active users at the same time it facing a lot of security issues that need frequent fixes and release the patch for the users is one of the main processes in Android Ecosystem.

Android Phones are receiving monthly security patches and it needs to be implemented by specific vendors for their respective mobile models.

But most of the Android manufacturing vendor are regularly forget to fix some of the patches including Critical and High severity rate flaws that lead to underlying risks, eventually, it will be exploited by the cybercriminals.

In this case, Google can release an important update for software related flaws without any specific vendors interaction but in-terms of drivers and system libraries, there should be respective manufacturers involvement.

Some of the phones still contain several hidden Patch gaps included multiple times with different firmware’s releases.

missed_patches by vendor

In this list shows the missing Critical and High severity patches before the claimed patch date (Few: 5-9; Many: 10-49; Lots: 50+).

This research was based on how many patching mistakes are made in this complex
The Android ecosystem that means how many patches go missing.

Android Ecosystem Patching is Really Very Hard

The nature of Android makes patching is really much more difficult it has gone through a lot of complex challenges.

Patches are handed down a long chain of typicality four parties before reaching the user including OS vendors, chipset vendors, Phone vendors, telecom vendors.

Patches are released more frequently by OS vendors but sometimes other vendors are failed to implement within the specific time.

Android Exploitation is Really Super Hard

Android security system contains several security layers and performing remote hack a phone is typically very hard since the attacker has to handle with multiple vulnerabilities to reach the point where he can take the control over the vulnerable mobile.

According to Security Research Labs, a few missing patches are usually not enough for a hacker to remotely compromise an Android device.

“That leaves state-sponsored and other persistent hackers, who usually operate stealthily. These well-funded hackers would typically resort to “zero-day” vulnerabilities but may also rely on known bugs to develop effective exploit chains. “

In this case, single defense layer can withstand large hacking incentives for very long, prompting “defense in depth” approaches with multiple security layers.

Details of this research were presented at the HITB conference on April 13, 2018, in Amsterdam: Announcement and slides

Balaji

BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Recent Posts

2 Chrome Zero-Days Exploited at Pwn2Own 2024: Patch Now

Google has announced a crucial update to its Chrome browser, addressing several vulnerabilities, including two zero-day exploits showcased at the…

13 mins ago

The Moon Malware Hacked 6,000 ASUS Routers in 72hours to Use for Proxy

Black Lotus Labs discovered a multi-year campaign by TheMoon malware targeting vulnerable routers and turning them into bots for the…

14 mins ago

Hackers Actively Exploiting Ray AI Framework Flaw to Hack Thousands of Servers

A critical vulnerability in Ray, an open-source AI framework that is widely utilized across various sectors, including education, cryptocurrency, and…

19 hours ago

Chinese Hackers Attacking Southeast Asian Nations With Malware Packages

Cybersecurity researchers at Unit 42 have uncovered a sophisticated cyberespionage campaign orchestrated by two Chinese Advanced Persistent Threat (APT) groups…

20 hours ago

CISA Warns of Hackers Exploiting Microsoft SharePoint Server Vulnerability

Cybersecurity and Infrastructure Security Agency (CISA) has warned about a critical vulnerability in Microsoft SharePoint Server, CVE-2023-24955. This vulnerability poses…

21 hours ago

Microsoft Expands Edge Bounty Program to Include WebView2!

Microsoft announced that Microsoft Edge WebView2 eligibility and specific out-of-scope information are now included in the Edge Bounty Program. The…

21 hours ago