How Google FIXED Android's BROKEN Security

Android security was once described as a "toxic hellstew of vulnerabilities," where you'd never be as secure as your iPhone-owning friends. So is that still the case, and should you be worried about your Android phone not being 100% secure?
0:00 Intro
0:38 Brewing the Hellstew
4:04 Hindsight
5:06 Google Play Services
7:27 Security Scares + Fallout
11:56 Secure Today?
12:37 100 Percent Security
Check Out XDA on Social Media.
Twitter: / xdadevelopers
Facebook: / xda.developers
When you make a purchase using links in the description, we may earn an affiliate commission. See more: www.xda-developers.com/page/t...
Chernoby Photo: Wikimedia Commons/Hnapel
Tim Cook Photo: Wikimedia Commons/Austin Community College

[@mehdimido5270]

we went from 'scared of malicious apps' to 'scared of governments spyware'

[@ginkgouser]

Thats true

[@CISO_007]

😂😂😂😂

[@HossLow]

Yo big facts, governments, police forces are literally using bloatware against us and doing dirty cop work to get their info on their targets..

[@ShadyTahaetr]

Ahmed el tantay agrees

[@bharath2508]

Unfortunately

[@ArthurZakaryan23]

Completely agree. You can make the OS as secure as you'd like but if it requires a human to operate it and relies on their judgment in avoiding landmines then security problems will always occur.

[@reyynerp]

technically, anyone don't need any security programs. it's all on the user on whether can the user avoid such vulnerabilities

[@DrewTNaylor]

@@reyynerp Drive-by malvertising disproves this.

[@reyynerp]

how would a malware enters the system without the user interacting? even turning on a computer/electronic device is counted as interacting afaik.

[@Nahg345]

@@reyynerp thats a one of the most moronic statements I've seen.

[@-zerocool-]

Soon AI will prevent human error. It will stop you from clicking phishing links, connecting to malicious dapps etc

[@parshakamarsh]

Really interesting video, I didn't realise how much Google had improved the background security of android devices

[@XDAVideo]

It was a great journey doing the research

[@neur303]

Yes, Google Play services has a lot of tentacles. Some of them seem unnecessary and seem to try to reverse the openness of Android. For example for FIDO2, which will be essential for the web security, the browser does rely on calls into closed source Google services. Which means you can't use it on an ungoogled phone. More and more control goes back to Google.

[@aItaccount]

So browsers aren't as secure on degoogled phones?

[@neur303]

They aren't less secure in terms of vulnerability to malware. Some are even more secure in that sense like Vanadium on GrapheneOS. In terms of authentication, there is no open-source FIDO2 implementation for Android as far as I know. Until that happens you can just not use it. For example it allows to use secure login keys from external devices, that are specifically made for this use case. It hardens against ID theft. Some governmental IDs will be based on this standard or at least support it.

[@aItaccount]

@@neur303 thanks for replying. I was interested because I am planning to use my old phone without any Google services and this would have been a big issue. But fortunately I don't need FIDO2

[@Wojteq69]

​@@neur303firefox???

[@jiffonbuffo]

My bank, after so many years, is now asking to turn off developers options. Have to look for am alternative bank as this was a huge annoyance. Sadly, I expect others to do the same thing. Too bad this BS still won't protect those dumb enough to open phising links or entertain obvious scammers. 😢

[@RichardRatner.1972]

Thanks Alex, always a pleasure to watch you on XDA these days. Kindest regards, Richard U.K

[@EyesOfByes]

6:11 I like the McAfee roast

[@MarkusMaal]

Nexus 7 1st Gen actually got the Lollipop 5.0 update pretty late compared to other Nexus devices. Being the owner of that tablet in 2013-2016, I was pretty pissed. But since it was a pretty popular tablet, I did get a chance to try Android L early thanks to custom ROMs.

[@sodapone]

Nexus 5 got that same treatment too from what I remember. Some scandal involving Qualcomm, I think?

[@wandiletembe]

Nice editing. Well done

[@nivmhn]

Really informative video Alex. Look forward to more of the same.

[@sunewjenkuzo2835]

A big issue with security is user error plus most companies don't want to fork over the extra cash to be as secure as possible and most just don't see a huge need for it.

[@TheAJKahn]

Great video and nice editing. Thank you!

[@EdouardTavinor]

iOS has always had many times the critical vulnerabilities of android (just look at the CVEs)

[@Blackbeard914]

Other way around, ios has significantly less vulnerabilities than android even on CVEs

[@reubenpx1809]

@@Blackbeard914 I'd still not trust their ecosystem if shit goes down... One of the most easily manipulated tech in the market where u can't do anything except throw it away. Android u can skin the entire thing, cut it up and make it ur own meat atleast. Better whenever the fk I like.

[@vavrinajan]

​@@Blackbeard914well that's quite obvious since Android is open-sourced unlike Apple 😂

[@bandiddums]

When the Chernobyl sarcophagus was mentioned, my KZbin app crashed lol. I also didn't know how much the play services impact the security of even the most ancient of Android. It's definitely a big relief that I don't have to change my phone everytime a new Android gets released and it's not available for my current model

[@malcontent_1]

Excellent rundown, Alex

[@mr.mastermind4840]

I wish android phones could get security updates more frequently. It has improved a lot though👍

[@XDAVideo]

Yeah depends on your brand. Samsung and Google are crushing it

[@rkustanto]

Samsung and Google give monthly update..

[@cnhtol1586]

samsung giving 4 year security updates on $150 samsung A14. thats cheap.

[@user-qy2wf2lt6v]

@@GH0STST4RSCR34M It's true for all devices that connect over the network. The rest is just marketing.

[@aItaccount]

​@@GH0STST4RSCR34MI mean if the security updates arrive multiple times in a month, then yeah you're probably right

[@NitikSharma]

this was awesome, more like this please!

[@XDAVideo]

Yes sir

[@darkfrozen1860]

Really good video. The google play service update was a big news for me never knew this much happens behind the scenes.

[@ashuzzz151]

Great information mate.

[@malaysangoi8454]

This was such an informative video. Loved it! ❤️

[@kiwiinthesouthpacific]

Excellent presentation, thank you

[@realcartoongirl]

i bought iphone by mistake

[@XDAVideo]

Condolences

[@eric203kid]

I’m a happy iPhone user

[@eric203kid]

Be proud

[@giovannibucio]

i dont have problems with my S23Ultra but all my iphone friends say there phones slow down with apples updates.

[@karangupta2924]

Very informative

[@brianwalker7771]

My main gripe with android "security" is I am unable to do things like remove apps that came with my phone or manually update my OS after the manufacturer has decided it is done with it. At least without jumping through hoops to put it mildly. However some jackass in a basement somewhere can potentially gain complete control over my device by simply having my phone number!

[@MarkusMaal]

It's possible to remove apps, even if they don't have an uninstall button, using ADB, even if your device is not rooted

[@ArjunRavi]

I think with android 14 you would be able to remove them without adb

[@XDAVideo]

Fair point but the basement jackass probably wouldn’t be able to afford something like Pegasus 😬

[@aquaponieee]

The manufacturer decides which apps can or cannot be removed when shipping the device. You should probably not be allowed to delete system components off of the OS. It also has nothing to do with security. Unimportant system apps can be disabled from the settings, and if you know what you are doing you can use ADB to delete system apps. The manufacturer is responsible for updating the OS for your phone, and the chip maker also needs to update the OS for your chipset as well before that. The manufacturer decides for how long to provide images for your device. You cannot simply install any OS you want onto your device, because the image needs to be built specifically for your device's unique hardware. Custom ROMs are third party system images built for your device, so technically you can update your OS manually, but it's much more complicated than that. In the end, thanks to Android's modularity, you do not need to have the latest version of Android to stay secure. As long as you have a version from 4.4 KitKat and beyond, you are safe. No jackass in a basement can compromise your device. Only big groups of extremely sophisticated hired security experts continually researching security exploits targeting selected individuals can do such a thing, and the chance you'll get compromised in such a way is zero. (actually not 0 but you get the point yeah)

[@S.G.199]

@@aquaponieee ADB can’t delete system apps. They’re removed just from the user partition, they remain on the system partition but disabled as adb can’t modify the system which is read-only and can be modified only with root access.

[@BradleyLarcher]

And to think that the so called "competition" is mad that phones come with Google play services, calling it anticompetitive, and the poor EU is siding with them unaware of the danger they're putting users in

[@aquaponieee]

​@@luffywestwell, watch the video and you'll know

[@BradleyLarcher]

@@luffywest get rid of Google play services, say goodbye to Google's added security. If the user isn't aware of what they're doing they're in trouble

[@bot-h2h]

​@@BradleyLarcher sadly microg is still far from complete

[@AraibShafiq]

Hear me out on this, why do we need “Google” play services for security updates, why can’t it be “OEM” play services. The only thing Google play services does is gives back control of an open platform to Google when in fact the approach should’ve been to give it to OEM who sells you the device so you can choose who to share your data with. Google play services is anti competitive because there is no other app (from any OEM) that has the power Google play services does. Sure you can argue Samsung game services is bad but it doesn’t come remotely close to play services with the amount of privilege it gets. I’m all for android but not for Google specific android

[@brandonw1604]

@@AraibShafiq smaller Android OEMs are less likely to patch things is why. Google Play Services come from Google and make it easier to patch apps from the developer. This is why developing on Linux is a pain in the ass.

[@kind2de]

Both Google and Samsung drop frequent security updates each year, which is a night and day difference from ten years ago.

[@EmuEmuchu]

I dislike how they locked the app data storage and new Androids

[@TheRealGigaCat]

It is not locked yet. It's simply harder to access.

[@bigix9]

does google decide which android-manufacturer becomes the updates first, or does it depend on the manufacturer's capability to roll out the updates fast enough for their customers?

[@RafidW9]

The fearmongering from apple over Android security vulnerability was always overblown.

[@DeRussellMasina]

Such a great walk down name memory lane

[@rocko100able]

I definitely like custom roms with Google gaps that you can just flashlight on the phone and run whatever version Android you want, but manufacturers like Samsung or making customization so much better that you don't need custom roms, but I still believe there's room for custom roms, because nobody likes bloatware, unless there's a special custom ROM that does a better job on certain phones, and I still haven't Nexus 6 it's running on ground zero ROMs Tesla OS , tipsy OS, THERE'S NOTHING LIKE A CUSTOM ROM.

[@sly412]

Custom roms are definitely are better for the phone and its owner. Especially if you are privacy concerned. I would flash any rom on my phone without gapps. Instead of using gapps i'd use microg or nothing at all and if you can live without google services or apps.

[@bot-h2h]

​@@sly412 will most app break without any type of play services implementation?

[@sly412]

@@bot-h2h Usually banking apps and email push notifications require google services. Even proton mail push notification doesn't work with google services framework. Otherwise everything else working fine. Microg is a good option for play services and push notifications

[@reubenpx1809]

@@bot-h2h there are work arounds now to use banking apps on custom roms but for security use a normal phone and a degoogled phone separately.

[@CarciofoaPropulsione]

What about the libwebp 0-day vulnerability? will that be fixed on older phones without security updates? Nobody seems to be discussing this online

[@shinestargaming]

Well, there are many ways hackers can hack our devices due to the architectural problems of the cpu or by exploiting bugs in our device however every operating system and chip manufacturers are working on it to improve the situation that no one can steal our data but how much time it will take no one knows until then we have to protect our data own your own 😔

[@giraffefactory2905]

Its worth mentioning that "vanilla" Android before version 4 was barely usable. Only after they added a lot of features from vendors software it became any good

[@Austinredstoner]

If you flash custom ROM I'll fix all the issues depending on your phone and amount of updates you'll get before updates being discontinued.

[@XDAVideo]

True if you can do that and still keep Play Services etc!

[@BabuMosahi]

​@@XDAVideodon't want that if you value privacy.

[@tigerscott2966]

If I can't get a simple flip phone without a wifi modem, I may as well run a PBX server from home to handle phone calls and just get SMS when I'm away from home.

[@natashas5923]

Hmmm I should watch XDA more..

[@Happyworldneeded]

I don't know how good Google as a company is and how good they work, but the worst thing they did was removing food names from android versions. It was emotion 😢

[@karsnoordhuis4351]

Oh man i suddenly remember the anger of some classmates when a friend sent out a whatsapp message to our class group containing a certain emoji which crashed their iphone.

[@koukous95]

And we all know ios is secure... Oh wait, it's not really kernel wise, it's just that u can't do shit in it.

[@someoneyouneverknow7529]

Pegasus will put their so called security to shame

[@Anonnonon]

I’m trying to listen to what you are saying, but instead I hear slivers of background music ..

[@oneminutewonder77]

These days I'd argue that Android is more secure than the iPhone in some ways.

[@melsbacksfriend]

Android used to not be secure enough. Now it's too secure. The sweet spot was Marshmallow to Oreo.

[@Provocateur3]

Still on Android 9. Versions ≥10 are not always backwards compatible (e.g. ClipStack.)

[@ZeroHourProductions407]

Bro I just want to be able to root again. I want removable batteries again. I miss those old days because you could get four *days* from a single charge with an extended battery where now you can't even get 10 minutes without the damn sealed battery either whinging for a charge like on an iPhone or exploding in your palm like a Samsung.

[@jiffonbuffo]

We're losing microsd cards too alomg with headphone jacks. And surprisingly, not only are consumers OK with this, they also heavily defend the corporations that do this. Specifically Samsung witht the amount of backtracking that they did with said features.

[@MoffieGirl]

You can’t fix your security when you give yourself a back door to Hoover up everyone’s data

[@TheRealGigaCat]

You got a brain?

[@Stricks823]

Looooooooool did Tim actually said that updates on Android are slow? What is he going to say next, that Android doesn't listen to their users?

[@aaliyahunsung832]

It's slow because it doesn't release globally. A few regions first then the rest. That's his point.

[@Stricks823]

@@aaliyahunsung832 I don't see a problem in that unless you are totally excluded or ignored like it happens in other small matters like for example in Google Translate (I live in the country were the 5th most spoken language in the world was born and G.T can't translate for tens or hundreds of languages but not to mine why, because the population of the biggest country in the world who speak it is 150k and we only have 10k .... 🤑 ...💲...💰)

[@funkam0nkey]

@@aaliyahunsung832 and manufacturers. Some are slower than others and even some models get this updates later than others.

[@BroAriq]

Android is a stolen product

[@sportsnews2940]

@@Stricks823With iPhones the updates go out to all supported devices right away. It’s a different story with android.

[@slob5041]

The Android feels like you’re using a blanket to stop a fire

[@kokop1107]

Truth is it never was insecure and it was all fearmongering and apple marketing

[@malcontent_1]

We should all certainly update our personal _bullsh!t detectors_ -- learn how to recognize the most common *_logical fallacies_* which are used to influence your thinking and decision-making

[@pugster73]

I'm waiting for the day where you can update the OS like what Microsoft and linux is doing for its OS without the consent of the manufacturer.

[@AndrewHahaLee]

My making the OS as confusing and cluttered as they can until fewer people want to actually use them

[@kiradotee]

14:32 best compliment someone ever gave me.

[@shlokshah5379]

I think rooting also may be a big thing. Rooted phones are very easy to hack(from what I have heard. So banking apps dont work in them. Now almost no body roots thier device.

[@Ghfvhvfg]

A reason to root is wanting freedom looking at android bloatware….

[@PerpetualPreponderer]

Does this mean that Android security is now on par, or better, than iOS?

[@EdouardTavinor]

Android security was always better than iOS when it comes to critical vulnerabilites. Have a look at the CVEs for both platforms.

[@qwerty6789x]

Google Android: Security? I AM YOUR MALWARE/SPYWARE

[@DooDootGaming]

The carriers issue is US specific i guess

[@subieasunayuuki]

No device is safe, whether it has android, ios, windows, apple, Linux among many other platforms. Nothing is 100% safe. Threat actors always find a way into a device. So matter what brand or platform, a device will always have vulnerabilities. It's what the tech companies and manufacturers do to combat or fight back these threat actors that contributes to a platform being safer than another but it can never be 100% safe of course. Should you live in paranoia? No, but be careful with everything you do online or on your device but even then, you can still slip up amd let your guard down without even realizing it. So, also get a trusted anti-virus and anti-malare software installed on your devices (but then again, these softwares, well any software aren't perfect, they can pick up false positives, leaving you vulnerable in the case of an attack) and use trusted ad-blocker extensions on your browsers for additional security and privacy.

[@junostr]

„Fixed“ with that amount of malware that’s still out there corrupting even the latest Android 13/14

[@gauravsingh6837]

I am thankful to XDA for making this video. Absolutely correct 👍. Old Android is far more better than the new ones in terms of EVERYTHING. Sorry for caps, but it does really make sense. I myself am writing this on top of Android Nougat in Q1 last 2023 & I can say I face zero difficulty while doing anything be it payments, camera or battery, rather my 3k mAh battery lasts longer because of the customisations I learnt from XDA. I love my Nougat.

[@v1shalyt]

which phone?

[@Ghfvhvfg]

Graphen os does take security to another level it and it doesn’t collect your data…..

[@123370]

Google Play Services basically breaks the original open source dream of Android. It's why blackberry and amazon couldn't fork it and be successful. It's a BAD idea.

[@okaro6595]

Nobody cares about such open source dreams.

[@123370]

@@okaro6595 I do. I worked on the original open source android project and fixed the horribly bugged USB Host interface, unpaid (back in the ICS days). People still herald Android as being a "superior" and "more open" platform, but every modern app is handicapped by needing Google Play services to run.

[@almond-lol]

I miss my Lumia

[@user-ju1dl3ov3u]

It never made any sense to me that Android has to deal with Providers adding CRAP to their operating system but Apple doesn't seem to have that issue.

[@Lazy943]

cause android is trash apple don't play that

[@ParoXXIV]

Because with Android u can do whatever u want, but with Apple not

[@FlammableB]

I agree with the video, but still... Why do we need a new Android version every year and then have the forced need to update so often for no reason? Also, all of this crap added to the Android OS makes the phone look "unique" and, at the same time, hard to update quickly when everyone complains about this. We do not need any of this, but manufacturers do so by adding a lot of junk and reskin. And about the phones, even if you use an outdated Android version, you should be fine if you have common sense and a brain. In the app store, something is rarely infected, and most of the time, apps you DO NOT need are the bad ones. Never had or at least never noticed any security/virus issues on my phones.

[@NaveenSingh-js6ts]

When do you see, Google is fixing Android's volume rocker problem?

[@jtedd57]

Apple (PROPRIETARY) LOCKED NO TINKERING NO FUN ITS JUST A TOOL ✌️ A GOOGLE PHONE IS A TOOL BUT HAS FUN AND MORE ENTERTAINING✌️

[@lesleyhaan116]

95 precent of people don't know how to root there phone or install custom roms

[@aquaponieee]

​@@lesleyhaan116and when exactly did the comment you're replying to or the video mention custom ROMs

[@lesleyhaan116]

@@aquaponieee the original comment says you can do more with android and i said 90 precent of smartphone user will do those things like installing launchers custom roms

[@eivis13]

I once heard a driving instructor say "the dumbest part of any vehicle is the biological mass behind the steering wheel". I can say the same thing about any devices security - the most insecure part of any device is the user. So unless you are Uncle Joseph or dadda Hitler it's best not to prioritize a lock down of a platform. God knows you're doing it for the wrong reasons.

[@mind-of-neo]

Google Play services. So that's why things keep changing on my phone without my permission.

[@HAWXLEADER]

iphone user: "Android is so unsecure". Same iphone user: "oh i got an sms saying my bank account is having a problem, i better log in using that link they gave me because it says it's urgent!"

[@uhohwhy]

only cia and nsa are allowed to snoop into your phone :D

[@chandrawibowo9923]

Android is secure enough. It's mostly the user's fault if it got hacked.

[@disruptceo]

Bought an android my mistake 😅

[@J-my6qj]

Zee Dee Net? It's ZedNet FFS

[@robodd4694]

Now can I get an Android phone secure against Google?

[@chench1lla]

I can't be patched so please recycle me.

[@XDAVideo]

🤣🤣

[@maxsens_7374]

Android’s security depends on its user. And for iOS? Lmao you can’t even sideload. Anyway if you download fishy bs then what do u think? Get hacked. Heck even macs also suffers from this issue.

[@maxsens_7374]

@@L-ananas-De-La-Fete agreed, and not everyone can do it either, unlike android.

[@Oystein87]

Funny thing is that iOS has had more security issues last years than Android🤔 Always a comical fact to pull put when someone is stuck in 2013 about Android

[@camelotenglishtuition6394]

Serious question: What's the obsession with you tubers recently adding tons of loud sound effects to their videos? They know some people use earphones right?

[@XDAVideo]

roblox_oof.wav

[@samrockwell940]

Buying iphones doesn't feel like you own the phone Unlike Android Personal experience

[@sabbirsorker4648]

they all talk about experience not price.price matter for experience😢😢

[@sachin.hota1]

Meanwhile me using custom roms.

[@MegaLokopo]

No device is %100 secure, if any device has ever been connected to any device that was at any point connected to any device that was connected to the internet, you should assume all of the data on your computer is publicly available on the internet.

[@iAfroTech]

Living in France 🇨🇵, i don't buy phone by carriers since 12 years at least and i trust Samsung since then, so no issues for me. Samsung give long term support and improve that regularly. I only use app of PlayStore and i don't care about Custom Rom or Gcam or others : i don't have time for that. I don't have any Security issues with Android : it's just a complete OS. In 2023, Samsung, Nothing and Google are the way.

[@wildstorm74]

Funny thing is, even if the (perfect) security was a thing. Only possible way, will be tricking people to click on something. Thats why (cyber space) wouldn't ever be (perfect). Just because not everyone would be learning about it.😑

[@robertheron7017]

I think android is fine I've never had any problems.

[@user-jm9iw6mm9o]

Hery

[@mubaraknative]

My letv le 2 brick i only has last hope on XDA forums can you send me link to unbrick the phone forum

[@Lazy943]

android is tuna

[@KevinMillard68]

andriod has always sucked we cant even get a signal with them out in the country we had to go iphone also android security is junk and most of them get 2 years of updates or maybe 5 years mabey none also most all android phone we get in canada and the usa that are so called new have already been out for 5 years alaredy in china and where ever elese they are built.. not all of the phone even come with the same new verison of android OS so again junk.and nothing has changed either with them Apple Rules

[@BluedragonLeo]

Talk being on point... You are like talking shit half of the time which was not even in the title...

[@andyvitz]

That's not true, we had the Android store before Google whips off Android store. And that's how they got what they got. They basically stole the software from Android. What are you talking about?

[@Dosenwerfer]

iOS is closed source and Apple based in the US, therefore it is the most insecure option of all. End of discussion.

[@paulbailey6251]

Did he say Google may have ended up 'saving lives during the pandemic'? LMAO

[@andyvitz]

Once again, not true to get updates, you went to called Android store. What the heck are you getting? Your information from

[@TallEdge90]

Mine is safer than iphones. no pegaSUS

[@Oystein87]

WRONG! The smartphones that did excist before Android and iOS was actually more advanced than the first iPhone in most ways😂 The absolute ONLY thing the forst iPhone did was to lerge multitouch AND glass screen on the same device. Litteraly everything else we already had for quite awhile actually. But seels that people forget that fact or are just too young to remember. The first IPhone(s) actually lacked alotbof very basic features that even "dumb phones" had at the time. So yeah... Smartphones before the iPhone was actually alot better than you give them credit for...

[@andyvitz]

An Android worked better without Google. What are you talking about? I was one of the original Developers I know it worked better Actually google screwed it up and it's been screwed up ever Sense

[@tahirmagray3129]

First

[@chillinJohnny]

Poor ppl buy iPhones to pretend they are not poor Just like with avry other "luxury" brand Most of their income comes from poor ppl