1

I've a many-years-old android phone on which I've never updated the OS, never logged in to Google Play. I haven't had any google accounts for years.

I deleted nearly all apps that came preinstalled on the phone, and have never installed any apps (other than firefox directly from mozilla, with some privacy plugins/addons). Further I've never logged into any website (i.e. no email, no banking, no purchasing, etc). Further, my address phone book doesn't contain any sensiteve contacts, such as my financial institutions.

I never connect to wifi other than my home. My online phone activity is limited to checking the weather forecast and reading mainstream newspapers (and that is only at home. I don't have any data on my phone subscription plan).

What harm am I open to?

user312990
  • 11
  • 2
  • i don't aggree with @Robert and would not spread fear. the practical consequences may: 1. battery life (updates can have negative impact, consuming more power, battery drains faster) 2. apps like google maps stop working one day (even old previously working apk) 3. https websites unreachable (outdated ssl certificates) – alecxs Jan 11 '20 at 14:42

1 Answers1

2

Even if you don't use the phone for many things you may still get a victim of an attack.

The first security problem are apps that are no longer updated because your Android version is too old and is no longer supported. App updates some times not only add new features but also fix vulnerabilities. Not getting the update can make your device even more vulnerable to attacks.

Especially an up-to-date web browser app and WebView component is crucial, because malware was even found on large well known web sites - or to be precise it was found in advertisements shown on these pages. Nowadays ads are are sold via real-time auctions, therefore the owner of the web page has only limited influence on what ads are being displayed. The ad companies try to prevent such "malvertising" (malware advertising) campaigns but in such a dynamic market you can't filter out 100% and one banner with malware may be enough.

A second problem may be the Android Media Service which automatically processes every file you download. In history this service has shown dozens of vulnerabilities that enable root access. Now again Google has managed to put some more vulnerabilities in this service. Therefore from my point of view this service is one of the major risks on your device - but you cant disable or remove it and even if you could so apps would stop working like the USB PC connection or the photo album app.

Once an attacker has managed to take over your Android device the attacker can scan your home network for other vulnerable devices such as Smart TVs (often contain microphones), webcams, and so on. Depending what you have installed the effects of an attack can have an significant impact on your life.

Robert
  • 20,025
  • 6
  • 47
  • 66
  • It's your last paragraph that I'm wondering about. I keep firefox uptodate, and all sites are toggled 'restricted' in ghostery, and all sites in privacy badger are blocked. My only intentional download has been firefox, direct from mozilla. Only thing on the network are the phone, a couple printers, a win7 and linux computer. No smart TVs or webcams. So I am still wondering what harm I am open to. – user312990 Jan 09 '20 at 18:15
  • I just looked into my version. Although it's quite old, it was the final release before the major version number incremented. – user312990 Jan 09 '20 at 19:50
  • @user312990 Firefox currently requires Android 4.1+ but earlier or later this limit will rise and your device will not be able to install newer Firefox versions. Additionally the effects of a vulnerability in Firefox (e.g. a 0-day exploit) are more severe on your device as the attacker can modify the system because of existing vulnerabilities and therefore directly escape the app and compromise the whole Android system. – Robert Jan 10 '20 at 10:00