Roger Fingas
A variety of wireless carriers and smartphone and tablet makers, including Apple, are reportedly being asked by U.S. regulators to explain how they review and push out security updates to their customers.
The issue is being examined by both the Federal Communications Commission and the Federal Trade Commission, Bloomberg said. The FCC has sent out letters to AT&T, Verizon, T-Mobile, Sprint, U.S. Cellular, and TracFone Wireless. The FTC, meanwhile, has issued orders to Apple, Google, BlackBerry, HTC, LG, Microsoft, Motorola, and Samsung.
At stake are the potential vulnerabilities left open by delaying a fix. While Google regularly updates Android, for instance, companies like HTC and Samsung often use custom skins and apps that can postpone those changes coming to their own devices — if they arrive at all, in the case of older hardware. Carriers can sometimes impose their own delays on when updates reach customers.
As an example the FCC made specific reference to Android's "Stagefright" vulnerability, which it said could be affecting up to a billion devices. Google has worked to patched the problem but many devices may still be at risk because of slow third-party support.
Both Apple and Google issue point releases to fix critical bugs and vulnerabilities, but will also sometimes hold off on less serious problems until code can be wrapped into a planned update.
The FTC said that the information it wants includes the factors used in deciding whether to patch a hole, details on devices sold since August 2013, and which vulnerabilities have impacted those products, as well as whether they've been solved.
Charles Martin
Malcolm Owen
William Gallagher
Christine McKee
Wesley Hilliard
12 Comments
Yesss! It's pitiable that Android handset manufacturers can get away with delaying critical security patches for months (that is months after Google patches Android which may take weeks or months as well) while raking in billions in revenue selling insecure devices. I have friends and family who will never own Apple devices, and while I think Apple devices are more secure, those who use Android shouldn't be made to suffer because their manufacturer is playing fast and loose with updates.
In the case of Android, they didn't a fuck about their customer when they set up their OS; and now they blame the OEM who makes 2% of their phones while being slaves to Google...
Google by not allowing OEM's to fork Android has removed the incentive for them to sell anything but new phones.
People like you keep getting Google off the hook when they're mostly responsible for this shit happening in the first place.
Wait... What? The government is investigating whether technology companies issue security patches in a timely matter, and then turns right around and demands back doors to get around those very patches so they can hack a device at will? Is that what’s going on here? And they want to know about any vulnerabilities and whether they have been solved? Isn’t that just giving the henhouse key to the fox?