Android Ecosystem Contains Several Hidden Patch Gaps that Can be Exploited by Hackers

The Android operating system is one of the most widely used platforms with 2 billion active users at the same time it facing a lot of security issues that need frequent fixes and release the patch for the users is one of the main processes in Android Ecosystem.

Android Phones are receiving monthly security patches and it needs to be implemented by specific vendors for their respective mobile models.

But most of the Android manufacturing vendor are regularly forget to fix some of the patches including Critical and High severity rate flaws that lead to underlying risks, eventually, it will be exploited by the cybercriminals.

In this case, Google can release an important update for software related flaws without any specific vendors interaction but in-terms of drivers and system libraries, there should be respective manufacturers involvement.

Some of the phones still contain several hidden Patch gaps included multiple times with different firmware’s releases.

In this list shows the missing Critical and High severity patches before the claimed patch date (Few: 5-9; Many: 10-49; Lots: 50+).

This research was based on how many patching mistakes are made in this complex
The Android ecosystem that means how many patches go missing.

Android Ecosystem Patching is Really Very Hard

The nature of Android makes patching is really much more difficult it has gone through a lot of complex challenges.

Patches are handed down a long chain of typicality four parties before reaching the user including OS vendors, chipset vendors, Phone vendors, telecom vendors.

Patches are released more frequently by OS vendors but sometimes other vendors are failed to implement within the specific time.

Android Exploitation is Really Super Hard

Android security system contains several security layers and performing remote hack a phone is typically very hard since the attacker has to handle with multiple vulnerabilities to reach the point where he can take the control over the vulnerable mobile.

According to Security Research Labs, a few missing patches are usually not enough for a hacker to remotely compromise an Android device.

“That leaves state-sponsored and other persistent hackers, who usually operate stealthily. These well-funded hackers would typically resort to “zero-day” vulnerabilities but may also rely on known bugs to develop effective exploit chains. “

In this case, single defense layer can withstand large hacking incentives for very long, prompting “defense in depth” approaches with multiple security layers.

Details of this research were presented at the HITB conference on April 13, 2018, in Amsterdam: Announcement and slides