“There will be an active marketplace for exploits forever,” he added, pointing out the still-vibrant market for Windows XP exploits. “In five years, the situation will be better, but it still won’t be 100%,” Beardsley argued. “There are reasons why users are on older Android,” Beardsley, ticking off the usual, ranging from no money to buy a more up-to-date smartphone with a later version of Android to the foot-dragging by most carriers, who prefer to sell new hardware rather than update old devices. And Lollipop’s share remained under the 0.1% cutoff for the listing. Jelly Bean, for instance, powered 36% of all Android devices, almost as much as KitKat (with 39.1%). Google and the mobile carriers that sell Android devices may be getting better at updating the operating system in a more timely fashion, but the progress has been slow, as Google’s own statistics show: More than six out of every 10 Android devices ran Jelly Bean or earlier as of 5 January, the last time the numbers were refreshed. “With the advances in Android 4.4, the number of users that are potentially affected by legacy WebKit security issues is shrinking every day as more and more people upgrade or get new devices,” Ludwig asserted.

Ludwig claimed that Android users were being updated to KitKat and Lollipop from the vulnerable Jelly Bean and earlier. I don’t know how this solves the problem for people who are stuck on 4.3.” There are plenty of apps that do nothing but render ads, and I doubt that many HTTPS,” Beardsley said. As for the rest? “That’s a little unrealistic. “That’s some good advice and some weird advice,” countered Beardsley, agreeing that developers should take Ludwig’s heed on security practices.

“Using an updatable browser will protect you from currently known security issues, and since it can be updated in the future, it will also protect you against any issues that might be found in the future,” Ludwig said.Īpp developers, said Ludwig, should follow security best practices, load only trusted content – that on the device or via HTTPS – or write their own renderer. Google’s Ludwig recommended that users run Chrome or Mozilla’s Firefox, which are updated regularly.

Mozilla firefox for android 4.4.2