Take the 2-minute tour ×
Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. It's 100% free, no registration required.

Now that mobiles are being used for payment systems, I'm more concerned about the security on my Android device.

I would rather not be the first to be vulnerable to some malicious code that happened to get slipped into the firmware update that the carrier is installing on my Android mobile.

I'm presuming they occasionally are sending fixes/patches over the air (OTA) without me having to give approval before they are installed -- perhaps I'm wrong on that though.

Are firmware updates secure and I'm just being paranoid? Is there any way to block new firmware updates from getting installed right away when everyone else's is?

share|improve this question

2 Answers 2

up vote 9 down vote accepted

To detect tampering, firmware updates are signed and (if you're using the recovery program that shipped with the phone) the signature is verified before install. After a mandatory confirmation from you that the installation should start, after a reboot, the recovery program will first verify this signature and only then install the new firmware.

Note that you will always get a prompt for a ROM update. Besides allaying security concerns and giving you a bit more control over the proceedings, this gives you the opportunity to:

  • Make sure the battery is charged or that the phone is plugged into the mains.
  • Back up any data you fear may be lost should the upgrade go wrong.
  • Do a bit of research into the improvements in this firmware version, and decide whether it is worth your time.

So yes, firmware updates are secure and even if you are concerned, an update to the actual OS will not be installed without your confirmation.

share|improve this answer
    
Ok, so I have the option whether or not I can install a binary with a signature that ensures it truly is from someone (LG, or the carrier?) That will at least keep me from being the first to discover a problem. My phone has Metro PCS branded apps and content on it. Does that mean Metro PCS's staff created the firmware image, or is the firmware coming from only the manufacturer (LG, in my instance)? –  Stephen Gornick Apr 10 '12 at 8:04
    
Yes. You will always have the option to install an update when its available for your phone. If you don't do anything funny (like unlock your boot loader) you will be installing an update directly from your phone company, so long as the existing firmware is from your phone company. I make that distinction because some phones like the Nexus One, Nexus S and the Galaxy Nexus get their updates directly from Google. –  ctt Apr 10 '12 at 10:10
    
Hey Stephen. Also, don't forget to accept an answer if it answers your question. –  ctt Apr 10 '12 at 11:02
    
I'm going to equivocally state then that I don't trust a binary from my mobile company. Blah. When will 100% open source come to mobile? –  Stephen Gornick Apr 12 '12 at 7:43
    
Actually, they are legally obligated to release the majority of the source code within short order (read: before the end of time). Also, you may want to check out xda-developers to see if your bootloader can be unlocked. If this is possible, with enough patience you should be able to write your own version of android –  ctt Apr 12 '12 at 9:36

The updates won't be installed automatically. The system will only notify you that the update is available. You can download and install them at your convenience.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.