Android's Update Problem

Wowzers! Why is that?

That's a really big question. Let's start at the beginning, shall we? Yeah, I know, it sounds like you're in for a long read. It's really not that long and a little history is always interesting.

How did Android come about anyway?

A very brief history of smart phones

Back in June 2007, Apple caught the mobile phone world flat-footed when they released the iPhone -- a time when most people used "candy-bar" phones or flip-phones like the Motorola Razr. The closest thing to a smartphone -- and it wasn't very close at that -- was the Blackberry. A phone that could do email and had a rudimentary browser.

The iPhone was singularly revolutionary -- nothing less than a tectonic shift in mobile technology. The hype was so loud and relentless that it was dubbed the "Jesus Phone" for its promised humanity-shifting influence. Turns out that hype was right, it is indeed humanity-shifting. A majority of the world's population owns a smartphone today. Consider how different the world would be today had the smartphone never been invented. But I digress...

Anyway... People bought the iPhone like crazy with long lines snaking around the stores that sold them. There was nothing else even close to it. Apple had the entire smartphone market pretty much to themselves for a good two years at least. Other manufacturers scrambled to develop their own smartphone and OS to compete with Apple but they were all wildly casting about and floundering. It was a pivotal moment in the mobile industry and an existential threat to manufacturers, driving many out of business and others to be swallowed-up.

With competitors trotting out various devices, all doomed to fail, the competitive bloc needed a savior to unify their response to Apple. Certainly, no existing phone manufacturer could be trusted to develop the needed OS. Competition was cutthroat and besides they lacked the skill to do so.

Google was probably the only non-device-aligned company large enough to quickly pull-off the development of a device-agnostic OS that all the phone makers could get behind. Microsoft was a nonstarter as they were very late to the mobile game and, indeed, have since officially abandoned it. This continues to be probably Microsoft's greatest corporate blunder.

To sweeten the deal, giving bickering manufacturers added incentive to use Android, Google opened Android and gave the phone makers and wireless carriers wide latitude over modifications to Android. And it was free. It was the easiest way to get widespread adoption even though the manufacturers had no real alternative. And that was the deal with the devil -- the fateful decision that led to today's Android security nightmare.

So herein lies the problem

Phone manufacturers are in the phone-making business. The wireless carriers are in the wireless signal, bandwidth, and tower/antenna business. The modifications that phone makers and carriers perform on Android aren't done to make Android better or more secure. They are done to sell their ancillary services and for marketing-centric differentiation, period. So they aren't particularly interested in testing and deploying non-revenue-generating security updates coming from Google. They'd rather you just buy a new phone.

And since the manufacturers and carriers are an (uncooperative) integral part of the update process, well then, updates are very slow in coming, if at all.

Here's the pipeline of steps that an update, such as a security patch, traverses on it's way to your phone.

Apple:

Apple Update > Your phone

Android:

Google Update > Phone Maker > Wireless Carrier > Your phone

The Phone Maker and Wireless Carrier steps shown in red is where those updates, including critical security updates, languish and sometimes die. Phones that have not reached end of life (more on this below) may receive these updates or they may not. Even if they do, those updates can sometimes take months to make its way through the update pipeline and onto your phone.

Getting timely updates is pretty dang important because bad actors are always on the search for device vulnerabilities they can exploit.

It's not that Android itself is necessarily less secure although there is some discussion on that. The problem is lack of updates. On the present course, there could eventually be an Android security Armageddon. A day of reckoning where the sloppy practices of today and years past will come home to roost, unless phone makers and carriers decide to embrace proper security update protocols. They may yet do that if their survival instinct ever kicks in. But so far they haven't and there's little indication that will change any time soon. C-Suite executives rarely give security concerns proper attention.

Apple is very different in this regard. Since Apple both manufactures their devices and develops the OS, they have total control top to bottom and are able to deploy security fixes whenever necessary -- without needing any cooperation from phone makers and only minor cooperation from wireless carriers. This is a critical advantage to iPhone (and iPad). It's enough of a reason all by itself to avoid Android in favor of iPhone.

Malware Malaise

Malware can be designed to do any number of nefarious tasks: Pilfer your passwords, steal sensitive data, add your device to a botnet, track everything you do including recording your phone calls, text messages, track your location using the GPS receiver, spread to other devices using yours as a springboard (Typhoid Mary), "brick" your phone by overwriting the phone's firmware, encrypt your data (ransomware), and really any number of other things of the bad actor's choosing.

Mind you, this risk is fairly low, especially on Apple devices. But it's not zero.

Fragmentation -- A big problem you've never heard of

Fragmentation is when there are multiple hardware and/or software versions and inconsistencies in the installed user base (people with phones). As of this writing, the Android ecosystem has over 4,000 distinct device models (hardware) across many dozens of brands. And there's numerous major versions of Android OS (software) as well, making for even more distinct combinations. This aggravates timely deployment of updates because of the QC (Quality Control) needed to ensure patches don't break something else.

Fragmentation also makes it difficult for developers to take advantage of hardware features that aren't common. It's one of the bigger complaints that developers have regarding the Android ecosystem. That means if your shiny new Android phone has a relatively uncommon hardware feature (that you may particularly like) there's a good chance that feature won't be fully realized to its potential.

It's not uncommon for the installed base of Android phones to be on older versions of Android OS. Indeed, the Android version that ships on any particular phone may well never to upgraded to the next version.

Again, here is where Apple is very different. As of this writing, Apple has released less than a hundred iPhone models (not counting things like various amounts of storage or color of device) since its introduction way back in 2007 thus fragmentation is essentially non-existent. And when iOS is upgraded, the rate of uptake to already-sold and eligible iPhones is nearly universal.

This lack of fragmentation makes it easier to develop for iOS devices since developers can expect certain hardware features to be present and for most Apple devices to be on the latest iOS version. For example, all iPhones from the 5S onward have a fingerprint sensor*. This also makes it easier for Apple and developers to update and support older devices.

* Most newer iPhones have FaceID and eliminated the home button which housed the fingerprint sensor in earlier models. Instead, these models employ facial recognition using a new advanced camera. But app-writers don't have to worry about that as it's handled by the operating system.