this post was submitted on 25 Jul 2023
45 points (100.0% liked)

Ask Android

30 readers
1 users here now

A place to ask your questions and seek help related to your Android device and the Android ecosystem.

Whether you're looking for app recommendations, phone buying advice, or want to explore rooting and tutorials, this is the place for you!

Rules
  1. Be descriptive: Help us help you by providing as many details as you can.
  2. Be patient: You're getting free help from Internet strangers, so you may have to wait for an answer.
  3. Be helpful: If someone asks you for more information, tell us what you can. If someone asks you for a screenshot, please provide one!
  4. Be nice: Treat others with respect, even if you don't agree with their advice. Accordingly, you should expect others to be nice to you as well. Report intentionally rude answers.
  5. No piracy: Sharing or discussing pirated content is strictly prohibited. Do not ask others for a paid app or about how to acquire one.
  6. No affiliate/marketing links: Posting affiliate links is not allowed.
  7. No URL shorteners: These can hide the true location of the page and lead people to malicious places.
  8. No lockscreen bypasses: Please do not comment, link, or assist with bypassing lock screens or factory reset protection.
  9. No cross-posting: Please take the time to make a proper post instead of cross-posting.
Other Communities

founded 1 year ago
MODERATORS
ijeff@lemdro.id
ladfrombrad@lemdro.id
45
How insecure are Android phones once they stop getting security updates? (lemmy.one)
submitted 1 year ago by NightOwl@lemmy.one to c/askandroid@lemdro.id
21 comments fedilink hide all child comments
 

Is it still safe to use as long as apps continue to be updated and is supported by the play store?

How long would you say someone could safely use an Android phone that no longer gets security updates for?

you are viewing a single comment's thread
view the rest of the comments
[โ€“] henfredemars@lemdro.id 1 points 1 year ago (1 children)

True that many potential RCEs are found, but I think there are a few points to keep in mind.

  • RCE classification is often conservatively assumed when it is theoretically possible even if it is not been demonstrated. Android bulletins appear to assume any memory corruption could be an RCE.
  • Remote code is no longer sufficient for privileged control. Next, you have to use it to break out of a restrictive sandbox for whatever service or application you have compromised.
[โ€“] argv_minus_one 2 points 1 year ago

Plenty of RCEs are in privileged components, like the operating system or the baseband firmware.

And yes, it is correct to assume that any attacker-controlled memory corruption is likely an RCE vulnerability.