Incident: Google's Discontinuation of Patches for Android 4.3 Exploits

Published Date: 2015-01-14

Postmortem Analysis
Timeline 1. The software failure incident regarding Google no longer providing patches for some exploits in early versions of Android software happened in 2015. [32472]
System 1. WebView technology in smartphones and tablets running Android versions up to and including Android 4.3 "Jelly Bean" failed [32472].
Responsible Organization 1. Security researchers Rafay Baloch and Joe Vennix [32472]
Impacted Organization 1. Android smartphone and tablet users running versions up to and including Android 4.3 "Jelly Bean" were impacted by the software failure incident [32472].
Software Causes 1. Lack of security patches provided by Google for exploits in the WebView technology in Android versions up to and including Android 4.3 "Jelly Bean" [32472].
Non-software Causes 1. Lack of security patches provided by Google for exploits in early versions of Android software [32472].
Impacts 1. The software failure incident impacted the security of smartphones and tablets running Android versions up to and including Android 4.3 "Jelly Bean" as Google stopped providing patches for some exploits in the WebView technology, leaving devices vulnerable to potential cyber attacks [32472]. 2. The incident created a controversy as Google's policy of not developing patches for versions before 4.4 and putting the onus on researchers or OEMs to provide patches could leave a significant number of Android devices permanently vulnerable to security threats [32472]. 3. The failure incident highlighted the potential risk for over 600 million active Android users who may have to choose between updating their software, purchasing a new device, or remaining less secure due to the lack of patches for older versions of Android software [32472].
Preventions 1. Regularly updating the software to the latest versions to ensure that security patches are applied promptly [32472]. 2. Encouraging OEMs to actively patch exploits in older versions of Android software to protect users [32472]. 3. Enhancing collaboration between security researchers and Google to address vulnerabilities in a timely manner [32472].
Fixes 1. Google could reconsider its policy and provide patches for exploits in older versions of Android software, including the WebView component, to ensure the security of users [32472].
References 1. Google's Android security team 2. Security researchers Rafay Baloch and Joe Vennix 3. Metasploit blog 4. Google's developer dashboard 5. Open source security researchers mentioned by Metasploit site 6. Google's announcement regarding active Android users

Software Taxonomy of Faults

Category Option Rationale
Recurring multiple_organization (a) The software failure incident related to the security of smartphones and tablets running Android is not explicitly mentioned to have happened again within the same organization (Google) or with its products and services in the provided article [32472]. (b) The article mentions that the security of smartphones and tablets running Android has come under scrutiny again due to the lack of patches for exploits in early versions of the software. This indicates that similar incidents related to software vulnerabilities have occurred before in multiple organizations or with their products and services [32472].
Phase (Design/Operation) design, operation (a) The software failure incident related to the design phase can be seen in the article where it is mentioned that Google is no longer providing patches for some exploits in early versions of the Android software, specifically versions up to and including Android 4.3 "Jelly Bean" [32472]. This decision by Google not to develop patches for older versions of the software can be considered a failure in the design phase, as it introduces a vulnerability due to the lack of ongoing support and updates for these versions. (b) The software failure incident related to the operation phase is evident in the article where it is highlighted that the onus is on researchers to supply their own patches for the exploits found in older Android software versions, or for OEMs to patch the exploits and push new software to device owners [32472]. This reliance on researchers or manufacturers to address security vulnerabilities in the operation of the system can lead to potential risks and failures in the operation phase of the software.
Boundary (Internal/External) within_system (a) The software failure incident discussed in the article is primarily within the system. Google's decision to no longer provide patches for exploits in early versions of Android software, specifically the WebView component in versions up to and including Android 4.3 "Jelly Bean," is a policy decision made internally by Google's Android security team [32472]. This internal decision has implications for the security of older Android devices and the responsibility placed on researchers and OEMs to address vulnerabilities within the system.
Nature (Human/Non-human) non-human_actions (a) The software failure incident in the articles is related to non-human actions. The failure occurred due to Google no longer providing patches for some exploits in early versions of Android software, specifically in the WebView component up to and including Android 4.3 "Jelly Bean" [32472]. (b) The failure was not directly caused by human actions but rather by the lack of action or decision by Google's Android security team to stop developing patches for older versions of Android software, leaving users vulnerable to exploits in the WebView component [32472].
Dimension (Hardware/Software) hardware, software (a) The software failure incident related to hardware: - The article mentions that Google is no longer providing patches for some exploits in early versions of Android software, specifically versions up to and including Android 4.3 "Jelly Bean" [32472]. - The article highlights that the onus is on researchers to supply their own patches or for OEMs to patch the exploits and push new software to owners of their devices [32472]. - It is noted that a significant percentage of Android devices in 2015 were still running older versions of the software, with 60.9% of them running versions like Jelly Bean, Ice Cream Sandwich, Gingerbread, and even Android 2.2 Froyo [32472]. (b) The software failure incident related to software: - The article discusses the controversy surrounding Google's policy of not developing patches for exploits in versions before Android 4.4 "KitKat" and the potential security risks this poses for users of older Android devices [32472]. - It is mentioned that security researchers have been actively looking for vulnerabilities in older Android software and publishing their findings, which could be exploited by cybercriminals if not addressed [32472]. - The article highlights the concern that when the upstream vendor (Google) is unwilling to patch vulnerabilities, users of older devices remain permanently vulnerable to security risks [32472].
Objective (Malicious/Non-malicious) non-malicious (a) The software failure incident discussed in the articles is non-malicious. It is related to the lack of security patches provided by Google for exploits in older versions of Android software, specifically the WebView component. The failure is attributed to the policy change by Google, which no longer develops patches for versions before Android 4.4 "KitKat" and puts the responsibility on researchers or OEMs to provide patches. This lack of patching leaves users of older Android devices vulnerable to potential cyber attacks [32472].
Intent (Poor/Accidental Decisions) poor_decisions (a) The software failure incident described in the article is related to poor decisions made by Google regarding the provision of patches for exploits in older versions of Android software. Google's decision not to develop patches for exploits in versions before Android 4.4 "KitKat" and instead rely on researchers or OEMs to provide patches has raised controversy. This decision leaves a significant number of Android users, who are still using older versions of the software, vulnerable to cyber threats [32472].
Capability (Incompetence/Accidental) accidental (a) The software failure incident mentioned in the article is not directly attributed to development incompetence. It primarily revolves around the controversy arising from Google's decision not to provide patches for some exploits in early versions of Android software, particularly versions before Android 4.4 "KitKat" [32472]. (b) The software failure incident discussed in the article is more aligned with accidental factors. The lack of patches for exploits in older versions of Android software, such as Jelly Bean, was not intentional but rather a result of Google's policy regarding the responsibility for providing patches for vulnerabilities in those versions [32472].
Duration permanent (a) The software failure incident discussed in the articles can be considered as a permanent failure. The issue arises from Google's decision not to provide patches for exploits in the WebView component for Android versions before 4.4 "KitKat." This lack of patching for older versions of Android software leaves users permanently vulnerable to potential cyber attacks, as Google is not taking action on reports affecting versions before 4.4 that are not accompanied by a patch [32472]. The situation is described as leaving regular users permanently vulnerable, indicating a long-term impact of the software failure incident.
Behaviour omission, value, other (a) crash: The software failure incident mentioned in the article does not specifically describe a crash where the system loses state and does not perform any of its intended functions. (b) omission: The failure in this incident can be related to omission as Google is no longer providing patches for some exploits in early versions of Android software, leaving older devices vulnerable to security risks [32472]. (c) timing: The incident does not involve a timing failure where the system performs its intended functions too late or too early. (d) value: The failure can be attributed to a value issue as the system is not performing its intended functions correctly due to the lack of security patches for older versions of Android software [32472]. (e) byzantine: The incident does not exhibit a byzantine behavior where the system behaves erroneously with inconsistent responses and interactions. (f) other: The other behavior in this incident is the lack of proactive patching and support for older versions of Android software, leading to potential security vulnerabilities for a significant number of users [32472].

IoT System Layer

Layer Option Rationale
Perception None None
Communication None None
Application None None

Other Details

Category Option Rationale
Consequence property, non-human, theoretical_consequence (a) death: There is no mention of people losing their lives due to the software failure incident in the provided article [32472]. (b) harm: There is no mention of people being physically harmed due to the software failure incident in the provided article [32472]. (c) basic: There is no mention of people's access to food or shelter being impacted because of the software failure incident in the provided article [32472]. (d) property: The software failure incident impacted people's material goods, money, or data as it left owners of old devices with a stark choice: update the software (if possible), buy a new device, or risk being less secure [32472]. (e) delay: People did not have to postpone an activity due to the software failure incident as per the information provided in the article [32472]. (f) non-human: Non-human entities were impacted due to the software failure incident as cybercriminals could take advantage of vulnerabilities in older Android software if details of findings are published by security researchers [32472]. (g) no_consequence: The article does not mention that there were no real observed consequences of the software failure incident. (h) theoretical_consequence: The article discusses potential consequences of the software failure incident, such as leaving users permanently vulnerable if the upstream vendor is unwilling to patch vulnerabilities in older versions of Android software [32472]. (i) other: There are no other consequences of the software failure incident mentioned in the article [32472].
Domain information (a) The failed system in the incident was related to the information industry as it involved the security vulnerabilities in smartphones and tablets running Android software [32472]. (b) The incident did not directly involve the transportation industry. (c) The incident did not directly involve the natural resources industry. (d) The incident did not directly involve the sales industry. (e) The incident did not directly involve the construction industry. (f) The incident did not directly involve the manufacturing industry. (g) The incident did not directly involve the utilities industry. (h) The incident did not directly involve the finance industry. (i) The incident did not directly involve the knowledge industry. (j) The incident did not directly involve the health industry. (k) The incident did not directly involve the entertainment industry. (l) The incident did not directly involve the government industry. (m) The incident did not directly involve any other specific industry.

Sources

Back to List