Deploying Android Security Updates: an Extensive Study Involving Manufacturers, Carriers, and End Users

Deploying Android Security Updates: an Extensive Study Involving Manufacturers, Carriers, and End Users Kailani R. Jones Ting-Fang Yen kailanij@ku:edu tingfang:yen@datavisor:com University of Kansas DataVisor, Inc. Sathya Chandran Sundaramurthy Alexandru G. Bardas sathya:chandran3@gmail:com alexbardas@ku:edu DataVisor, Inc. University of Kansas ABSTRACT ACM Reference Format: Android’s fragmented ecosystem makes the delivery of security Kailani R. Jones, Ting-Fang Yen, Sathya Chandran Sundaramurthy, and Alexan- updates and OS upgrades cumbersome and complex. While Google dru G. Bardas. 2020. Deploying Android Security Updates: an Extensive Study Involving Manufacturers, Carriers, and End Users. In Proceedings of initiated various projects such as Android One, Project Treble, and the 2020 ACM SIGSAC Conference on Computer and Communications Security Project Mainline to address this problem, and other involved entities (CCS ’20), November 9–13, 2020, Virtual Event, USA. ACM, New York, NY, (e.g., chipset vendors, manufacturers, carriers) continuously strive USA, 17 pages. https://doi:org/10:1145/3372297:3423346 to improve their processes, it is still unclear how effective these efforts are on the delivery of updates to supported end-user devices. In this paper, we perform an extensive quantitative study (Aug. 1 INTRODUCTION 2015 to Dec. 2019) to measure the Android security updates and OS Android’s highly fragmented and inconsistent ecosystem makes upgrades rollout process. Our study leverages multiple data sources: the updating and operating system (OS) upgrading processes cum- the Android Open Source Project (AOSP), device manufacturers, bersome and complex [16, 17, 21, 47]. With a Linux kernel, multiple and the top four U.S. carriers (AT&T, Verizon, T-Mobile, and Sprint). parties partake within this scheme: operating system developers Furthermore, we analyze an end-user dataset captured in 2019 (e.g., Linux, Android Open Source Project), system-on-a-chip man- (152M anonymized HTTP requests associated with 9.1M unique ufacturers (e.g., Qualcomm, NVIDIA), device model manufacturers user identifiers) from a U.S.-based social network. Our findings (e.g., Samsung, LG), mobile carriers (e.g., AT&T, Verizon), carrier include unique measurements that, due to the fragmented and partners, third-party testing labs, and end users [5, 8, 12, 36, 46]. inconsistent ecosystem, were previously challenging to perform. Over the years, Google initiated multiple projects that seek to For example, manufacturers and carriers introduce a median latency increase the number of Android devices receiving security updates. of 24 days before rolling out security updates, with an additional For instance, in their Security & Privacy report released in 2019 [16], median delay of 11 days before end devices update. We show that Android reported an 84% increase of devices receiving a security these values alter per carrier-manufacturer relationship, yet do not update in contrast to the last quarter in the previous year. However, alter greatly based on a model’s age. Our results also delve into this does not imply that these devices are receiving updates covering the effectiveness of current Android projects. For instance, security the latest Android Security Bulletins – they could actually be behind updates for Treble devices are available on average 7 days faster by months [5, 37]. As Android focuses on improving the availability than for non-Treble devices. While this constitutes an improvement, of security patches, it is also important to assess the impact of other the security update delay for Treble devices still averages 19 days. involved entities in their delivery and rollout to supported devices. Providing a comprehensive study on Android security updates CCS CONCEPTS is a challenging task due to the fragmentation and inconsistencies • Security and privacy ! Mobile platform security. across the involved parties [21, 47]. Various past efforts focused on different aspects of the Android update process. For instance, some KEYWORDS works examined the patch latency in the Android Open Source Project (AOSP) and how it is affected by the vulnerabilities’ content Android security updates; mobile carriers; mobile manufacturers; classifications10 [ , 24, 46]. Other efforts analyzed the manufacturers’ end-users; Project Treble; Android One involvement in this process [5, 11, 36, 46] or multifarious elements on the end-user side [2, 7, 16, 46]. In general, these efforts focused Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed on important but limited facets of security updates. Recently, the for profit or commercial advantage and that copies bear this notice and the full citation U.S. Federal Trade Commission (FTC) released a report on the issues on the first page. Copyrights for components of this work owned by others than the in mobile security updates [5]. While their goal was to provide a author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission comprehensive perspective, this report covered a limited dataset and/or a fee. Request permissions from [email protected]. (i.e., only eight manufacturers). Despite the important insights from CCS ’20, November 9–13, 2020, Virtual Event, USA these previous efforts, we did not encounter a study of the Android © 2020 Copyright held by the owner/author(s). Publication rights licensed to ACM. ACM ISBN 978-1-4503-7089-9/20/11...$15.00 security update rollout process that takes into account all of the https://doi:org/10:1145/3372297:3423346 players including AOSP, manufacturers, carriers, and end users. In this work, our goal is just that. Specifically, once a security device. If we consider that users in the end-user dataset login (on update is available from AOSP, we examine its journey from the average) every 6.12 days and the effect of updates being rolled out manufacturers and carriers to the end user devices. At each step, in batches or stages, the user-incurred delay can be much lower. we measure how the frequency and latency of security updates Examining the effects of Android’s initiatives to improve the up- (arguably, among the most important metrics of the update pro- dating ecosystem, we find that carriers and manufacturers roll out cess) are affected by these players and other factors influencing security updates an average of 7 days faster for Treble [48] models this process. Moreover, we also track a recent OS upgrade. Sim- compared to non-Treble models. We also observe Android One [1] ilar to security updates, an OS upgrade also increases a device’s and Treble devices receiving a higher number of security updates security posture [39]. The findings from our study may benefit as well as being more up-to-date. However, these initiatives do not security-conscious consumers in making informed decisions re- necessarily demonstrate faster OS upgrades or solve the delayed garding their mobile devices, and also provide policy makers and security updates as the manufacturers and carriers still influence software vendors with a deeper understanding of the current An- the release process. Project Mainline [4], announced in May 2019, is droid security landscape. More generally, our study sheds light on in its early stages of adoption. Since it does not support OS versions the actual rollout process of Android security updates. prior to Android 10, its adoption rate is also directly impacted by Our study is made possible by leveraging multiple data sources. manufacturers and carriers OS upgrade decisions. We gathered information from the monthly Android Security Bul- letins [38], as well as 1,953 public security update announcements Our main contributions can be summarized as follows: available from the top four U.S. carriers (AT&T, Verizon, T-Mobile, • We perform an extensive quantitative study, at scale, on the and Sprint1) covering 274 unique device models across 25 man- impact manufacturers, carriers, and end-users have on the rollout ufacturers for the same time period. Both of these datasets span of Android security updates and OS upgrades. from August 2015 (when the Android Security Bulletins started) to • We aggregate and correlate data from different data sources December 2019, allowing us to analyze longitudinal update behav- resulting in novel measurements on carrier and manufacturer- ior over a period of four years. We complemented these datasets related factors and on user-incurred delays. with 684 security update announcements specific to locked and un- locked models from Samsung. Additionally, we analyzed 152,156,934 • We evaluate the current effectiveness of Android initiatives such HTTP requests associated with 9,163,277 unique user identifiers as Android One and Project Treble, and provide a very early and 4,800,228 unique user-agent strings from a U.S.-based social assessment on the more recent Project Mainline. network, which allows us to empirically observe update behavior The rest of the paper is organized as follows. We first provide by end users and correlate with the carrier/manufacturer announce- background on Android security updates and OS upgrades, and the ments. The collection, storage, and processing of all datasets follow datasets analyzed for this study. We then describe the findings from strict ethical and privacy considerations as detailed in Section 4.5. our analysis and discuss implications for the Android ecosystem. To the best of our knowledge, given the fragmented nature of the Android landscape, this is the first study to adopt a comprehensive 2 BACKGROUND approach that results in unique quantitative insights into the An- droid security update ecosystem. Our findings confirm assessments, Android security updates and OS upgrades are impacted by various such that manufacturers and carriers tend to update older phones entities [5]. This section overviews this fragmented structure and with lesser frequency, and complement these assessments with the interactions between the involved entities.

Load more