Too many perfectly usable phones are put into a questionable security situation by lack of vendor support for keeping key software up to date.
But what’s the actual risk of using an Android phone on a stock ROM without updates? What’s the attack surface?
It seems like most things that’d contact potentially malicious software are web and messaging software, but that’s all done by apps which continue to receive updates (at least until the android version is entirely unsupported) eg. Webview, Firefox, Signal, etc.
So are the main avenues for attack then sketchy apps and wifi points? If one is careful to use a minimal set of widely scrutinised apps and avoid connecting to wifi/bluetooth/etc. devices of questionable provenance is it really taking that much of a risk to continue using a device past EOL?
Or do browsers rely on system libraries that have plausible attack vectors? Perhaps images, video, font etc. rendering could be compromised? At this point though, that stack must be quite hardened and mature, it’d be major news for libjpg/ffmpeg to have a code-execution vulnerability? Plus it seems unlikely that they wouldn’t just include this in webview/Firefox as there must surely be millions of devices in this situation so why not take the easy step of distributing a bit more in the APK?
I’m not at all an Android developer though, perhaps this is very naive and I’m missing something major?
It’s not necessarily true that the baseband has unfettered access to the entire phone. Pixel devices for example use a special IOMMU to restrict what the baseband can access, forcing it to go through a specialized interface only. It still requires more work for a compromise of baseband to get control of Android.
First you need to exploit the baseband. Then, you need to exploit the kernel.
Now, that’s a significant attack surface, but the point stands that many phones now have some compartmentalization because of this risk. This has been a concern for some time and newer designs are trying to mitigate it.
Here’s a security evaluation of the pixel which shows that a compromise of the modem does not equate to an immediate compromise of the device. The modem must be restricted in what it can access of the application processor.
That’s good news, but GrapheneOS does not support older Pixel phones because they are insecure and cannot be made secure, so apparently the baseband isn’t the only problem.
Unfortunately, they’re not specific about which firmware poses a security threat unless updated. I was under the impression that the baseband firmware is the problem, but I must have been mistaken.