Google recently informed OEMs of greatly reduced security support for older releases of Android. For the vast majority of discovered vulnerabilities, only Critical severity issues deemed to be an imminent risk will be backported at all and only to the most recent 2 major yearly releases (16 and 17).
Externally reported vulnerabilities will currently still follow the same policy for backports as before. High and Critical severity vulnerabilities reported to Google by external parties will be backported to releases going back around 3 years (currently 14, 15, 16 and the current latest stable 17).
Android Security Bulletins already omit Moderate and Low severity patches. They're already dated 2-4 months after the vulnerabilities were disclosed to OEMs and allowed to be shipped. Only Samsung flagships and Pixels ship any of it 'early' on practice. Only GrapheneOS ships the full set 'early'.
The vast majority of vulnerabilities are now being discovered internally by Google for Android and Chrome. These are largely being discovered with AI. The subset deemed Critical severity and an imminent risk will be backported to 16 and 17. Bare minimum security support for older releases is over.
Bare minimum Android security patches now require being on Android 16, 16 QPR2 or 17 and quickly moving to Android 18 when it's released. Once Android 18 is released, it will be the only release with current High and Critical severity patches. Serious support for older Android releases has ended.
Android 17 is the only Android release with the current set of disclosed Moderate and Low severity patches. Android 16, 16 QPR2 and 17 will soon be the only releases with the current set of disclosed Critical and High severity patches too. Once Android 18 is released, it will be the only one.
Vast majority of Linux kernel vulnerabilities aren't covered by Android Security Bulletins, externally disclosed patches are backported very slowly and Android Security Bulletins come 2-4 months later than when Android patches can be shipped. If you want bare minimum patches, use iOS or GrapheneOS.
We're going to need to do a lot of work with Motorola and Qualcomm to provide serious patches for GrapheneOS devices. We're going to need more developers. After the launch of the new devices with GrapheneOS support, we want to repeatedly port to the latest Linux LTS branch among other major changes.
Google is completely overwhelmed by the massive torrent of vulnerabilities discovered by AI models. They've done repeated cycles of layoffs and buyouts crippling their ability to handle it. The change to the schedule for Android Security Bulletins is also extremely at odds with this new reality.
Google switched to a performative Android Security Bulletin system with vulnerabilities listed 2-4 months after they're shipped. They're pretending as if not open sourcing patches protects people from OEMs not patching them. Our community has people successfully reverse engineering binary patches.
Google needs to start open sourcing QPR1 and QPR3 releases again along with open sourcing security preview patches shortly after disclosure to OEMs. Otherwise, we'll just hire people to start doing reverse engineering work in an official capacity to start publishing the changes as open source early.
@GrapheneOS You guys should just deviate from depending on Google & go standalone.
@mortal_engine @GrapheneOS that's nonsensical (without imagining structural changes at large scale)
Google's investment in Android and Pixel is pivotal to Graphene's value proposition. Another way is possible but it'll be terribly expensive and risky.
I would wager nearly everyone using GrapheneOS is running play services sandboxed at least part of the time.
@brett @mortal_engine @GrapheneOS
so what?
slightly less shit is still better.
@jvnebnunny @brett @mortal_engine @GrapheneOS With all due respect, are these your last words before you download something sus from the Internet?
@dasmatus @brett @mortal_engine @GrapheneOS
graphene is fully audited. the idea that it sus is bullshit
@jvnebnunny @brett @mortal_engine @GrapheneOS I meant a random APK
@dasmatus @jvnebnunny @brett @mortal_engine @GrapheneOS unlike desktop OSs, Android and iOS have a robust security model which mean that it is in fact safe to download random apps.
On Windows, Linux or macOS, if an app does malware-y stuff like encrypting your files, stealing passwords, or listening through the microphone in the background, that's your fault for installing an untrusted app. On Android and iOS it would be a security vulnerability in the OS itself.
@anselmschueler @dasmatus @jvnebnunny @mortal_engine @GrapheneOS
We all know that historically there’s never been any flaws in mobile OSes. 🙄
@brett @mortal_engine @GrapheneOS Or in another profile.
@brett @mortal_engine That's definitely not the case. GrapheneOS didn't have the sandboxed Google Play compatibility layer until mid-2021 and was started in 2014. Many of our users still avoid using it. Many people only use it sparingly in a secondary profile, often even a whole secondary user rather than an easier to use nested profile (work profile or Private Space). It's likely around 70% of GrapheneOS users are using sandboxed Google Play in some form but many of those in dedicated profiles.
@GrapheneOS yes please!! Google is just ruining android
@GrapheneOS another layoff should fix it.
@GrapheneOS You'd think that google, having developed ai itself, would've been more prepared for this. Additionally, will moving to Motorola allow you to circumvent part of the issues with the security patches or will you guys have to start reverse engineering them regularly?
@damnedd We have full access to the security preview patches providing the Android Security Bulletin patches 2-6 months ahead. We ship the full set of relevant patches in our security preview releases. Each of our regular releases has a corresponding security preview releases. Our release notes provide a list of the included security preview patches. You can see how many patches are added in our security preview releases in our release notes listing those at the bottom:
@damnedd GrapheneOS is already the only way to get all of the Android security preview patches early. Samsung flagships and Pixels ship a subset early but much more slowly than we do and they don't ship all of them. We get all of the security preview patches integrated and tested quite quickly. It's already a unique feature of GrapheneOS giving it yet another major privacy and security advantage over every other Android variant. We strongly recommend everyone uses the security preview releases.
@damnedd We aren't happy about it because we want to be able to quickly provide the full set of patches in our regular releases. It's ridiculous having the patches not disclosed as open source for months. It should be a week at most, ideally significantly less than that. Our plan is to start having people reverse engineer patches from binary which can then be merged into the regular releases if it's done correctly. We aren't quite ready to get started on shipping them that way but we plan to.
@GrapheneOS Oh wow I forgot about that security preview setting, I didnt realize it was so advantageous lol, that's really neat! Do you have any idea why they chose to stagger open sourcing this material? It seems like an odd choice, the patches are extremely small. Its pretty disingenuous for an open source project to limit security patches of all things.
@damnedd It's done because OEMs are so terrible at shipping patches. They started off giving them 30 days of early embargoed access but it wasn't enough and OEMs found it too difficult to ship patches each month. It also put users at risk from having it broadly disclosed for 30 days.
The new system allows every OEM to ship the patches without an embargo as GrapheneOS does while papering over OEMs taking many months to ship it. It's more secure when used well and covers up the failures.
@damnedd The system would be fine if it was open sourced after a week instead of typically taking 2-4 months and sometimes longer.
It's worth noting security preview patches include patches to external projects. These patches aren't only for things Android uses. Some are publicly disclosed elsewhere already while others are not. There have been patches from Android security previews for projects used outside Android shipped in GrapheneOS according to the rules prior to disclosure elsewhere.
@GrapheneOS
Me and the son want graphene moto phones. We have android now and are fed up with cyber privacy invasion. Count me in for QA
@GrapheneOS That seems like... a bit of an issue for most other Android based OSes...
That will become interesting, as that probably clashes with the EU requirement to provide at least 5 years of updates after end-of-sales.
I guess we'll see waves of litigations bc of unmatched smartphones in the future ...
@vampirdaddy No, those EU standards don't require providing reasonable security patches. We've been pointing out how flawed those standards are for years. Android was already only backporting High and Critical severity patches to older releases which was in full compliance with the regulations. Further reducing how much gets backported is still in compliance. The regulations only require OEMs to do what Google defines as the bare minimum and Google has heavily watered down the standard patches.
@GrapheneOS holy shit. That's a security apocalypse for most Android devices in use today.