7

Now that mobiles are being used for payment systems, I'm more concerned about the security on my Android device.

I would rather not be the first to be vulnerable to some malicious code that happened to get slipped into the firmware update that the carrier is installing on my Android mobile.

I'm presuming they occasionally are sending fixes/patches over the air (OTA) without me having to give approval before they are installed -- perhaps I'm wrong on that though.

Are firmware updates secure and I'm just being paranoid? Is there any way to block new firmware updates from getting installed right away when everyone else's is?

Improve this question

2 Answers 2

Reset to default
10

To detect tampering, firmware updates are signed and (if you're using the recovery program that shipped with the phone) the signature is verified before install. After a mandatory confirmation from you that the installation should start, after a reboot, the recovery program will first verify this signature and only then install the new firmware.

Note that you will always get a prompt for a ROM update. Besides allaying security concerns and giving you a bit more control over the proceedings, this gives you the opportunity to:

  • Make sure the battery is charged or that the phone is plugged into the mains.
  • Back up any data you fear may be lost should the upgrade go wrong.
  • Do a bit of research into the improvements in this firmware version, and decide whether it is worth your time.

So yes, firmware updates are secure and even if you are concerned, an update to the actual OS will not be installed without your confirmation.

Improve this answer
4
  • Ok, so I have the option whether or not I can install a binary with a signature that ensures it truly is from someone (LG, or the carrier?) That will at least keep me from being the first to discover a problem. My phone has Metro PCS branded apps and content on it. Does that mean Metro PCS's staff created the firmware image, or is the firmware coming from only the manufacturer (LG, in my instance)?
    – Stephen Gornick
    Apr 10, 2012 at 8:04
  • Yes. You will always have the option to install an update when its available for your phone. If you don't do anything funny (like unlock your boot loader) you will be installing an update directly from your phone company, so long as the existing firmware is from your phone company. I make that distinction because some phones like the Nexus One, Nexus S and the Galaxy Nexus get their updates directly from Google.
    – ctt
    Apr 10, 2012 at 10:10
  • I'm going to equivocally state then that I don't trust a binary from my mobile company. Blah. When will 100% open source come to mobile?
    – Stephen Gornick
    Apr 12, 2012 at 7:43
  • Actually, they are legally obligated to release the majority of the source code within short order (read: before the end of time :p). Also, you may want to check out xda-developers to see if your bootloader can be unlocked. If this is possible, with enough patience you should be able to write your own version of Android or patch in whatever fixes you feel are important. Note that it will never be 100% open source as it's actually illegal to allow some components in a phone (like its radios) to be programmed to do certain things. These parts are usually provided by manufacturers in binary form.
    – ctt
    Apr 12, 2012 at 9:42
2

The updates won't be installed automatically. The system will only notify you that the update is available. You can download and install them at your convenience.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .