Is your smartphone secure? Federal regulators want to know
Do smartphone makers and wireless carriers fix security bugs and other聽vulnerabilities fast enough?聽聽
The Federal Trade Commission (FTC) and Federal Communications Commission (FCC) want聽the largest smartphone聽manufacturers, software聽developers, and聽wireless carriers in the United States to answer this question.听聽
The聽federal regulators both聽聽Monday requiring the聽12 companies to explain how they issue updates to address security vulnerabilities, as聽questions linger about聽how a security flaw聽in Google Android's聽Stagefright聽multimedia playback engine were resolved.听聽
"There have recently been a growing number of vulnerabilities associated with mobile operating systems that threaten the security and integrity of a user鈥檚 device," reads the FCC statement, which references the聽Stagefright聽bug.听聽
The letter praises software developers, manufacturers, and carriers' responses in developing patches, or fixes, to address these vulnerabilities.听聽
"There are, however, significant delays in delivering patches to actual devices 鈥� and that older devices may never be patched," reads the letter.听聽
The FCC sent letters to the four largest wireless carriers in the US 鈥� AT&T, Sprint, T-Mobile, and Verizon Wireless 鈥� writing it wants to better understand "their processes for reviewing and releasing security updates for mobile devices." The FTC, meanwhile,聽, including Apple, Google, and聽Microsoft, to complete a report that explains their "policies, procedures, and practices" for聽developing聽security updates and聽delivering them to customers.听聽聽聽
The regulators' concerns are聽.听聽More Americans聽own聽smartphones聽than ever before.听Sixty-four percent of Americans own a smartphone, according to a 2015 study by the Pew Research Center, with 85 percent of 18 to 29 year olds owning a phone, and 79 percent of 30 to 49 year olds owning one.听And many Americans聽conduct聽online banking or look聽up government services or information on their phone, perhaps聽typing in confidential information in the process, the study found.听聽
It wouldn't聽be far-fetched to guess聽these percentages have increased since the survey was conducted in 2014, as smartphones and applications聽have become more affordable and聽user-friendly. It's聽no wonder regulators want to ensure a scenario like聽Stagefright聽doesn't repeat itself.听聽
The聽flaw in聽Google's Android mobile operating system allowed聽attackers to take control of someone's device just by sending a text message, 海角大神 reported in July.
An attacker could gain聽control over聽Bluetooth, video, audio, and the microphone 鈥� enough to turn a phone into a聽spycam, and on聽many phones, the attacker could gain complete control of the device.听
Security professionals have聽long been critical of Google聽over its Android update practices, wrote Joe聽Uchill聽in聽the聽Passcode聽article.听聽
"When bugs affect Android versions that Google still supports, the company writes a patch, sends it to phone manufacturers, and counts on companies such as Samsung or Motorola to update their customers' phones. But many manufacturers do not treat updates with urgency. If a bug affects a version of Android that Google no longer supports, phone manufacturers can develop patches on their own, but few ever do."聽聽
As these two federal聽agencies step in, others in聽Washington聽have聽criticized聽the government聽having "back doors" in devices that would allow them (and hackers)聽to break into a device.听
