First-ever monthly Android security updates

First-ever monthly Android security updates start to roll out

 

 

Nexus device images are out. Samsung, LG, and cell carriers, you're on the clock.

Stagefright was the scariest Android vulnerability to come along in some time. A bug in Android's "Stagefright" media library could, if fully weaponized, allow an attacker to execute malicious code just by sending an MMS message to a user. Luckily exploit mitigation techniques in newer versions of Android stopped the Stagefright vulnerability from becoming a pwning free-for-all, but the bug shined a bright light on Android's sub-par security situation.
The publicity got the Android device ecosystem—Google, OEMs, and carriers—to at least start paying attention to delivering security updates to users in a timely manner. Google, Samsung, and LG scrambled to get fixes out to their flagship devices and promised monthly security updates for their devices. That was 36 days ago.
Today, Google has posted the first of those monthly security updates for Nexus device owners. The Nexus system image page added Android 5.1.1 build "LMY48M" for the Nexus 4, 5, 6, 7, 9, and 10, along with build "LMY48N" for the Android TV-based Nexus Player. LMY48M hit Google's public AOSP repository yesterday (September 9).
Our friends at Android Police cobbled together a changelog, which contains a few security fixes, including a "Moderate severity vulnerability" that allowed apps to bypass the SMS short code notification prompt that warned users that short codes can cost them money.
Now that Google's fixes are out the door, how is everyone else doing? With no scalable update system, getting these security updates out to users is the responsibility of every OEM and carrier combo out there, and updates are unique for every individual device model. So far, we've seen the US carrier T-Mobile announce OTAs for the Nexus 4, 5, 6, 7, and 9—the company actually beat Google to the punch by a day. T-Mobile's support page says an update is coming for the Galaxy S6 and Note 5 on September 10, and a representative from the company told us the LG G4 will be updated soon as well.
Nexus devices, being directly from Google and being the devices Android is actually developed on, are of course going to have faster updates and therefore better security than everything else. The question is how much faster will they be?
Today the clock starts for everyone else. We've contacted Samsung, LG, HTC, Motorola, Sony, Verizon, AT&T, Sprint, and T-Mobile for update timelines to see how they're doing. We will also be contacting other major carriers from the UK and Europe, such as Vodafone, EE, Three, and O2. Hopefully enough of them will get back to us that we'll be able to put together a picture of what the current Android update landscape looks like.