Recently, many people have been bombarded by an advertisement: “Safety first in life and work, Gionee M6 Secure Phone, with built-in encryption chip.” Typically, digital products endorsed by Feng Xiaogang are sure to have short-term business opportunities, just like the e人e本 from years ago. Therefore, the concept of secure phones must have already gained some traction.
(Security, photography, and reliability have always been the three major advantages of iPhone over Android)
With the recent revelations of various major security vulnerabilities in Android and iPhone phones, from the leak of Jennifer Lawrence’s nude photos to the exposure of selfies from Ma Rong’s phone, public skepticism about the security of smartphones, especially iPhones, has reached unprecedented heights. The three major advantages of iPhones: photography, reliability, and security, are being overtaken one by one by Android flagship devices.
In terms of photography performance, iPhones have not even made it to the top five in Dxomark’s rankings; regarding reliability, according to Blancco’s latest mobile performance testing report, iPhones have been crushed by Android in both the North American and Asian markets.
As for security, Apple’s last remaining stronghold is also being reversed by Android, as Android is an open-source system while iOS is not, which is a genetic issue.
Since the Snowden incident, secure Android phones have been rapidly catching up to iPhones. Back in 2014, Silent Circle’s Blackphone was awarded the annual phone at that year’s Mobile World Congress:
The backdrop was that after the Snowden incident, two major German political parties passed a resolution prohibiting government employees from using iPhones. Western governments, including Russia, rushed to purchase customized “secure government phones.” Secure phones became one of the hottest startup projects in the security field, and even Boeing jumped on the bandwagon to launch an Android secure smartphone code-named Black, with the biggest selling points being support for call encryption and hardware self-destruction. This means that any attempt to open the phone’s casing will lead to the phone automatically deleting all data and self-destructing.
In 2014, domestic manufacturers were also not idle. Companies like Coolpad, Huawei, Hisense, and 360 were all eyeing the secure phone market, but they mainly targeted the industry and government sectors.
Looking back at the Gionee M6, which focuses on the business market, it has not disclosed more technical details and security standards of its security chip apart from its vague and suggestive advertising copy. From the advertising alone, it seems that the Gionee secure phone does not possess the two major features of Black: call encryption and hardware self-destruction.
In the current policy environment, domestic manufacturers face issues with implementing call encryption in civilian phones, and this type of hardware encryption is limited to similar types of phones. Compared to Silent Circle’s encrypted communication apps, its applicability is limited. Moreover, apart from government and military institutions, there seems to be no necessity for hardware self-destruction.
Below is the description of the security technology of M6/M6 Plus on Gionee’s official website, which is quite succinct:
In summary, the Gionee phone uses hardware encryption to encrypt the data stored on the phone (the hardware generates the key), but it does not specify what encryption standards or implementation methods were used (though this information can still be found online).
To avoid going off-topic and causing unnecessary trouble, I did not choose to call my former colleagues at the National Cybersecurity Laboratory or several domestic hacker experts, but decided to share some basic principles of phone security based on my intuition and experience:
1. For ordinary users, the most important factor in enhancing security is not the encryption chip but timely software updates. If we were to score the security of Android phones with KPIs, the highest weight would be on the timeliness of security patch updates. However, due to the rift between the Chinese market and Google, most Android smartphones from domestic manufacturers have not passed Google’s official Android security certification!!! The speed of security patch updates is much slower than that of international manufacturers like Samsung and LG.
2. Simply encrypting local “static data” does not guarantee the security of personal data and privacy. Currently, there is no solution that can globally encrypt the Android system without affecting performance. Therefore, the so-called secure encryption chip is merely a defense against unauthorized access to local “stock” data, and offers no protection for dynamic data (many of which exist in plaintext in memory) during the operation of various applications such as WeChat, online banking, and browsers. In fact, the security of dynamic data is the greatest challenge for secure phones, as it is a systemic engineering issue, and the phone’s hardware is just one part of it. In recent years, instances of phone data leaks have invariably occurred through network and application vulnerabilities. Just look at how Apple recently rushed to update iOS version 9.3.5 due to a vulnerability that could allow hackers to fully control your iPhone just by clicking on a link in a phishing text message. Such application-layer attacks that lead to privacy leaks cannot be solved by an encryption chip; it is akin to having a high-security vault for your gold while the transport truck carrying it gets robbed.
Alright, after rambling on, let’s get back to the main topic of recommending some reliable Android smartphones with good security.
As mentioned earlier, the speed of producing and distributing patch updates is the most critical indicator of assessing the security capabilities of Android phone manufacturers. If you can’t promptly fix the “God Mode” vulnerabilities, how can you talk about security?
Not far back, at the beginning of this month, four “God Mode” vulnerabilities in Qualcomm’s LTE chips were exposed at the global hacker conference DEF CON, allowing hackers to fully control Android smartphones, affecting up to 900 million users, marking it as one of the most serious Android security vulnerabilities ever. This includes flagship models like Google’s Nexus 5X, 6, and 6P, Samsung’s S7 and S7 Edge, HTC 10, and even the industry benchmark secure phones Blackphone 1 and 2 were not spared.
Then, unlike Apple, which can patch vulnerabilities with a single button for all iPhone users globally, Android’s ecosystem is too fragmented. As a result, apart from Google’s Nexus, which pushes patches promptly, other major Android manufacturers have experienced varying degrees of delays, and smaller manufacturers are even worse. As for those smart TVs, refrigerators, washing machines, and security cameras that use Android, don’t expect home appliance manufacturers to push updates.
The fragmentation of the Android system has reached such an extent that the following image illustrates it well (data source: OpenSignal)
Each manufacturer is customizing its ROM, and over time, the market has turned into a patchwork. Fragmentation leads to vast differences in the speed of producing and distributing security patches, with many models failing to receive timely updates and falling behind the pace of vulnerability disclosures, becoming riddled with holes. (Of course, some argue that more fragmentation is better as it can confuse hackers.)
How bad is the update situation for Android system security patches? Let’s take a look at the Android security statistics report from the renowned security organization Duo Labs:
In May this year, two months after Google released an important patch for the Android full encryption vulnerability, 57% of Android phones still had that vulnerability. In terms of model statistics, Samsung’s Galaxy S6/S6s and Google’s “child” Nexus had a patching rate of about 75%, leading other models, while the S5 only had 45%.
It is worth noting that in the security scoring rankings conducted by Oxford University at the end of 2015, Samsung ranked below LG and Moto (the data for this ranking comes from monitoring apps in Google’s official app market, so domestic manufacturers did not make the list). However, given Samsung’s significant progress in Android system updates this year, Duo Labs rated Samsung’s latest flagship models and Google’s Nexus as the two Android phone models with the best security this year.
For domestic users, if you have high security requirements, especially considering the severe issues of personal data privacy leaks in the country and the rampant “whale fishing” activities targeting high-end business people, 24Ker recommends that you purchase an Android phone and try to overcome the difficulties of accessing Google Play’s official app market (the domestic Android app market remains the primary distribution center for mobile malware). You can refer to Duo Labs’ recommendations for product selection or keep an eye on domestic brands like OnePlus and Huawei, which have made a name for themselves in the European and American smartphone markets (but it is recommended to install the international version ROM). It is important to note that data shows that the newer Samsung models have better security performance, for example, the S6 has a much higher patching rate than the S5 (the latest S7 and Note7 are expected to perform even better), while the Nexus series does not seem to have this problem. The key issues can be summarized as follows:
1. Flagship products from international manufacturers such as Nexus, Samsung, and LG have higher security; for domestic Android manufacturers, the further they are from the Android ecosystem core, the less secure they are. Phones are consumer products, but phone security is not.
2. Pay attention to the security of the phone supply chain, and try to purchase from legitimate channels like Amazon or official websites.
3. Insist on using Google’s official app market.
4. Avoid using public WiFi in airports, hotels, scenic spots, and buses; if unavoidable, it is best to use a VPN.
For users purchasing non-flagship phones, 24Ker recommends avoiding the following five models with poor reliability (the reliability here also includes the reliability of physical components and software systems, in short, the failure rate): according to the famous mobile testing company Blancco’s performance assessment report for the second quarter of 2016, Lenovo (K5 Plus, K3 Note, P1m) and LeEco (1S, 1S Eco) jointly contributed to the five Android models with the worst reliability, as shown below:
Finally, it should be noted that relatively secure phones are just a small part of the personal information security defense system. Whether it is a smart flagship or a so-called secure phone, improving personal information security awareness and skills is the fundamental approach. Those interested can refer to this article: A Comparison of Security Awareness Between Security Novices and Hacker Experts.
If you prioritize security performance when purchasing an Android smartphone, then the information in this article may be helpful to you.
Image credit for the article: Family O’Abé/Flickr (CC BY 2.0)
Please clickRead the original article to see the detailed content.
