Researchers Catch Android OEMs Lying About Security Patches

[Faybert]

Content source

https://www.bleepingcomputer.com/news/security/researchers-catch-android-oems-lying-about-security-patches/

A large number of Android manufacturers (OEMs) are skipping security patches but are lying to users about it, according to the team at Security Research Lab (SRL), a Berlin-based cyber-security firm.

Google releases Android security patches each month in the form of the Android Security Bulletin. The OS maker releases the security bulletin to OEMs and chipset providers, and each add their own updates, depending on the Android OS variation that ships with each smartphone.

Every time any of these updated OS versions reaches a user's device, the update also increments the "Android security patch level" in the phone's settings section to the respective month and year of the Google Android security bulletin they have implemented patches for.
Some OEMs are slacking off

But speaking today at the HackInTheBox security conference in Amsterdam, Holland, SRL researchers said that many OEMs are lying about these patches.

For the past two years, SRL researchers Karsten Nohl and Jakob Lell have analyzed the content of the security updates delivered by today's biggest Android OEMs.

The two discovered that some OEM vendors claim to deliver up-to-date security updates, but many skip installing some patches on users' devices, for unknown reasons.
.......
.......
.......

 

[Ink]

Is ZTE an American or Chinese company? I hear mixed answers about them.

At the moment, I have Android Oreo 8.0.0 with 1 February 2018 security patch level. Not too bad considering it's not a Google Pixel/2 device.

Older devices lose support as the chips advance and Android cannot support all features on them (ie. SD 801).