At the Usenix security conference in Philadelphia, USA, researchers from the Graz University of Technology presented an analysis of 994 smartphones from ten major manufacturers. They were looking for defense mechanisms against known security holes, one-day exploits. The Android Generic Kernel Image (GKI) version 6.1 provided by Google was used as the basis for the investigation. It was able to prevent 85 percent of attacks, some of which were automated. With kernels customized by cell phone providers, only between 29 and 55 percent of attacks occurred.
Advertisement
Not surprising, but still notable: the older the devices, the less security they offer. Smartphones that came to market between 2018 and 2023 were tested. Many of them are now likely to drop support, which, depending on the manufacturer, only lasted a few years. The Android versions of the devices ranged from version 9 to 14, with kernels ranging from 3.1 to 6.1.
Manufacturers allow research results (PDF) As for older smartphones, many security functions are unused and can only be activated by configuring the kernel differently. The scientists say that even kernel 3.1 from 2014 will be more secure than 38 percent of all devices, apparently including those with a more modern operating system.
Protection is turned off for better performance
In addition to age, smartphone performance also plays a role: slower and cheaper devices are 24 percent more vulnerable than high-end cell phones. Scientists attribute this to the fact that some security measures would reduce performance and were therefore discontinued by cell phone manufacturers.
in his Notice of analysis Graz scientists Lukas Marr, Florian Draschbacher, Lukas Lamster and Stephan Mangard also rank the companies. From most secure to least secure provider it is: Google, Realme, OnePlus, Xiaomi, Vivo, Samsung, Motorola, Huawei, Oppo and Fairphone. Android market leader Samsung is in the bottom half of the providers examined, but this is probably due to its large number of devices, including cheap devices.
According to the researchers, of the companies the scientists made the results of their research available to them, only Google, Fairphone, Motorola, Huawei and Samsung “accepted” them. However, some of them have released patches, for whom and for which devices it is not yet known. Google also wants to take up the matter and improve security, especially that of the kernel.
(Never)
