At least 600 million Samsung users are still at risk due to a major security flaw that opens up photos, messages, phone calls and a slew of other personal data to attackers.
The company has still not issued a fix (though it says one is coming soon) for the vulnerability, which stems from the way the company used third-party software.
The fact that the biggest Android manufacturer in the world put its users at risk for so long highlights a much bigger problem within the Android ecosystem: bloatware.
So, what is bloatware? Bloatware refers to software that comes preloaded on a device that often can’t be manually removed by the device owner. This includes carrier apps from Verizon, T-Mobile, AT&T and others, as well as those directly from the device manufacturer, like HTC, Samsung and LG.
Like much of smartphone software, bloatware began on the PC. PC makers have been bundling everything from anti-virus software to media players, games and other types of software for years.
For manufacturers, the goal of all this, of course, is to increase their bottom line. As PCWorld points out, each time someone pays for a pre-installed antivirus program or plays an ad-filled game, it increases the manufacturer’s margins on that device and, ultimately, their bottom line. The most egregious example of this type of PC bloat is Lenovo with Superfish, which injected malicious spyware into some of the company’s laptops.
On smartphones, primarily Android, bloatware is a far worse problem than PCs for a number of reasons. To start, those preinstalled apps are impossible to remove without rooting your device, a not so simple process that usually voids the manufacturer’s warranty as well. Additionally, smartphone users are often inundated with unwanted apps from both device manufacturers and their carriers. A Samsung handset from AT&T, for example, may come with messaging and navigations apps from Samsung, Google and AT&T.
Though Samsung has toned done much of its bloatware in recent devices —perhaps after realizing many of its offerings were unpopular — the company has also eschewed the microSD slot in its latest pair of flagships. This means users can no longer add extra storage when their device fills up which, as others have noted, makes the problem of unnecessary resource-hogging apps all the more egregious.
And as evidenced by Samsung’s faulty implementation of SwiftKey’s software, all of these extra apps are not just annoying data hogs but a potential security vulnerability, says Andrew Hoog, CEO of NowSecure, the company that initially reported Samsung’s vulnerability.
Hoog tells Mashable in an email, referring to other pre-loaded apps having major security flaws. “We find in our research that 48% of the apps in the stores have at least one high risk vulnerability.”
“We believe users should have more control over apps, but security issues can appear even on apps that are essential to the phone’s operation,” he writes. “The more important issue is that apps need to be more thoroughly tested before they are released.”
Though he makes a fair point — security is all too often an afterthought — the risk from Samsung’s security flaws could be easily sidestepped if users were able to fully remove the offending software themselves. At least then affected users would be able to take steps to protect themselves from potential attacks, rather than wait for Samsung to issue a fix.
The fact is, we’ve put up with crap on our phones for too long. It’s time for carriers and manufacturers, especially Samsung, to finally take a stand on bloatware. We can, and should, have full control over the apps on our phones. Read more…