Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Cellphones Android Security

Ask Slashdot: How To Safely Use Older Android Phones? 133

Posted by timothy from the nest-of-vipers-jump-right-in dept.
An anonymous reader writes: Like many people reading this site, I have several older phones around as well as my newest, fanciest one; I have a minimal service plan on one of these (my next-to-most-recent), and no service plan (only WI-Fi, as available) on the others. Most of them have some reason or other that I like them, so even without service I've kept them around to act as micro-tablets. Some have a better in-built camera than my current phone, despite being older; some are nice on occasion for being small and pocketable; I like to use one as a GPS in the car without dedicating my phone to that purpose; I can let my young relatives use an older one as a camera, etc. Besides, some people have only one phone at all, and can't reasonably afford a new one -- and that probably means a phone that's not cutting edge. So: in light of the several recent Android vulnerabilities that have come to light, and no reason to think they're the last of these, what's a smart way to use older Android phones? Is CyanoGen Mod any less vulnerable? Should I be worried that old personally identifying information from online transactions is still hanging around somewhere in the phone's recesses? I don't want to toss still-useful hardware, but I know I won't be getting any OS upgrades to 3-year-old phones. How do you use older phones that are not going to get OTA updates to address every security issue?
This discussion has been archived. No new comments can be posted.

Ask Slashdot: How To Safely Use Older Android Phones? More

Ask Slashdot: How To Safely Use Older Android Phones?

Comments Filter:

  • CyanogenMod has nightly updates (Score:1)

    by Anonymous Coward

    I still have my galaxy s3, which is running CyanogenMod equivalent to Android 5.1.1

    I'd imagine that gets security patches.

  • C'mon, at some point you're just hoarding junk.

    • Re:Therapy? (Score:4, Insightful)

      by FudRucker ( 866063 ) on Sunday August 09, 2015 @03:50PM (#50280693)
      if it is good hardware why not put a new operating system on it and make it work for a few more years, no sense in filling the landfills up just because the software became obsolete,

      the computer i am typing this on was built by me in 2000, i used to dual boot a copy of windows 2000 and Linux Slackware-8 when it was new, today windows is gone and i am running Debian Jessie on it, the hardware is old but it works good so why not put a new operating system on it

      • Re:Therapy? (Score:4, Insightful)

        by NatasRevol ( 731260 ) on Sunday August 09, 2015 @03:57PM (#50280727) Journal

        Because time is a real cost. Sometimes more than throwing out something old & buying something new.

        And time can encompass a lot of issues - build, install, security, speed, opportunity cost.

        • Hardware hasn't advanced that much, especially on the desktop side, in the last 5 years. You could easily have a zippy Core2 Duo with 8GB of ram and run linux on it, no problem, especially if you aren't doing anything cycle-intensive like model rendering, or video encoding.

          It might run hotter than a haswell corei7, but that's about it. What cost are you talking about?

          • Around the time CPUs hit 1GHz, I came to the conclusion that almost everything I did on a computer fit into one of two categories:
            • Stuff that was already fast enough.
            • Stuff that would basically never be fast enough, no matter how much CPU power I throw at it.

            Big compile jobs are in the second category. When I'm doing a test build of FreeBSD, I generate around 50GB of object code (for LLVM it's only about 10GB for a debug build). The LLVM build system is nicely parallelised and so could happily consume

        • Because time is a real cost. Sometimes more than throwing out something old & buying something new.

          And time can encompass a lot of issues - build, install, security, speed, opportunity cost.

          True - but into this yo uhave to factor the time spent on having to replace applications that are no longer available on newer versions. I know of several places that hold on to HW from the 80es, simply because there is no strong reason for replacing it. Some of these systems have uptimes running into years, even 10 - 15 years. My personal record so far has been an old Solaris box, which had run for 7 years - it was rebooted because we need to rewire the server room.

          Of course, if you're talking smartphones,

      • Re: (Score:2)

        by RR ( 64484 )

        if it is good hardware why not put a new operating system on it and make it work for a few more years, no sense in filling the landfills up just because the software became obsolete,

        the computer i am typing this on was built by me in 2000, i used to dual boot a copy of windows 2000 and Linux Slackware-8 when it was new, today windows is gone and i am running Debian Jessie on it, the hardware is old but it works good so why not put a new operating system on it

        Because you can’t.

        The computer I built in 2003 has 1.5GB of RAM and 200GB of storage. This is enough to run Windows 7, though not Windows 8 or 10 because it doesn’t have SSE2 nor NX. With Linux and BSD and various strange options, I have endless choices of what OS I get to run on it.

        The typical phone of 2007 has less than 128MB of RAM. You are not running a modern OS on less than 128MB of RAM. Furthermore, while the PC was relatively open, most phones have depressingly closed drivers. Just look

  • install another operating system (Score:4, Interesting)

    by FudRucker ( 866063 ) on Sunday August 09, 2015 @03:47PM (#50280681)
    hopefully some clever x-google employee or a current google employee will so do some work on the side at home and build a customized debian or slackware port that is easily installed in any android device, most are locked down so this cant happen but i bet somebody has the key to unlocking these android phones that have so far been uncrackable at the firmware/hardware level

    • Like Linux on Android! ;-)

      http://linuxonandroid.org/ [linuxonandroid.org]

    • I doubt this will happen with the many proprietary chip drivers and dead batteries after 3 years.
      Come to say, why not get a lithium battery standard fitting modern devices.
      You know in the old ages, like AAA, AA , C etc.

    • There is also the problem all the different phones, even the ones that use the same system-on-chip, are configured differently.
      Different cell radios, different wifi/bluetooth chips, different touch controllers, different screens, different flash interfaces, multiple sim cards, sd cards, etc.

      eg: You might have two phones with the same chipset, but one has a NAND flash chip, the other has eMMC.
      It might have the sd card on mmc3 instead of mmc2.
      The pinmuxes for the LCD interface may be in a different configurat

    • "hopefully some clever x-google employee or a current google employee will so do some work on the side at home and build a customized debian or slackware port that is easily installed in any android device"

      That won't happen. It's not an OS problem but a drivers' one.

  • Install Firefox OS on it. (Score:1)

    by Anonymous Coward

    Install Firefox OS on it. Based on this review [arstechnica.com], it'll be extremely secure, because you probably won't actually be able to do anything at all with it. Apparently there will be a good chance that the phone's GPS, camera, and other functionality won't work, and if they aren't working then they can't be abused.

  • It's unlikely you can keep anything running a version of Android 4.4 truly secure, and even that won't be secure for much longer. The best idea if you're worried these still have some sensitive personal information on them would be a factory wipe (from the phone's recovery mode, not within the OS as this will leave internal storage in-tact). This should protect you from what most malicious parties are looking for, though if the phone is on your local network there's always the opportunity for them to use th
    • Prior to 4.4*

    • Re:Old phones (Score:5, Interesting)

      by AmiMoJo ( 196126 ) on Sunday August 09, 2015 @04:56PM (#50280979) Homepage Journal

      Actually, the security issues have been vastly over-stated by click-bait driven media. Ever notice how we don't see stories about vast Android bot-nets or millions of people being the victims of exploits? The only successful malware relies on the user enabling installations from other sources and ignoring all the warnings, and even then on any 4.x version the OS will scan the app for known vulnerabilities.

      The OP unfortunately doesn't say what version he is running, but my advice would be to install Cyanogen if available (simply to get the latest possible features and minimal bloatware) and not worry about it. If the OP is really paranoid there are anti-virus products for Android, but they are not really necessary.

      • To be fair, some large-scale exploits do not require the installation of non-store apps or ignoring any warnings, in the case of Stagefright I believe all you needed was to have SMS messages routed through Hangouts. Obviously this kind of exploit is patched ASAP on newer devices, but pre-4.4 you're pretty much on your own.

        • Re: (Score:3)

          by AmiMoJo ( 196126 )

          Sure, but Stagefright was not very severe. That's my point - it was made out to be this huge problem, but actually all Android versions since 2.0 have had ASLR enabled in the kernel and it mitigates Stagefright. At worst an attacker could perform a really expensive DOS on your MMS app, but taking over your phone is virtually impossible because every MMS only has a one in tends of thousands chance of guessing the right address.

          • Re: (Score:1)

            by Anonymous Coward

            Actually, ASLR in a 32 bit device with 2-3 GB of RAM is not that hard to defeat with ROP.

            You are going to pop out somewhere recognisable 50-75% of the time.

            ASLR on a 64 bit device is a different story. Lots of wilderness in a 64 bit address space.

            The real mitigation is not the ASLR, its that only 0.0001% of the population can write ROP exploits....

            • ASLR on a 64 bit device is a different story.

              Well, sort of. The blind ROP stuff works by realising that exec triggers re-randomisation, but fork does not. Server processes like nginx are vulnerable because they fork children to replace any that have crashed and each child has the same layout. Even with a 64-bit address space, it's possible to probe (some things, like PLTs, are relatively easy to find and full of gadgets). Unless it's changed recently (I've not been paying attention, so it's possible), Android reduces app startup time by having a z

  • It would be nice if phone vendors didn't treat old phones as if only good for landfills. I know I'll never go back to Android because there's no assurance that even a brand new phone will be upgradable to the latest software even a month later (it's already happened to me). So the idea of just installing the latest OS and installing some specific apps doesn't seem doable.

    The inability to upgrade Android phones is a HUGE problem.

    Perhaps some enterprising people will create dedicated OS images for various hardware that remove all the cruft and just run specific things. For instance, I'd love to use an old phone as just a navigation system for my car - nothing else. I'd pay for that software if it existed.

    Now only if Android vendors and developers knew about software portability...

    • Re: (Score:2)

      by AmiMoJo ( 196126 )

      The inability to upgrade Android phones is a HUGE problem.

      It's only a huge problem to people who don't understand it.

      Google delivers updates via Play. Those include the ability to detect and remove apps, even installed outside the Play store, that are malicious. Heavy sandboxing and other preventative measures limit the damage malicious apps can do anyway. It's like the recent Stagefright issue - from the way it was presented you might have expected vast botnets of phones to appear, but in reality it was next to useless as an exploit unless your goal was to do a r

  • micro-tablets (Score:3)

    by flacco ( 324089 ) on Sunday August 09, 2015 @04:19PM (#50280795)

    I want a micro-tablet. I want a cell phone without the phone to hold my shopping list, music, and podcasts. I don't want the phone.

    Why doe this not exist?

    • Re: (Score:2)

      by Ecuador ( 740021 )

      I can lend you my Dell Axim from 2004. Still works great, but I don't use it since my cellphone is a superset of its functionality. Or you can remove the SIM from an android phone. The reason they are cheaper than the PDAs were is that the chipsets are produced in massive volumes since they are now found in everybody's phone. So you aren't actually paying extra for the phone part - on the contrary it discounts the hardware that you can still use as a PDA.

    • Re: micro-tablets (Score:5, Informative)

      by ganjadude ( 952775 ) on Sunday August 09, 2015 @04:38PM (#50280885) Homepage
      it does. ipod touch

      • Re: (Score:3, Interesting)

        by Bing Tsher E ( 943915 )

        An ipod touch costs 3-4 times as much as a non- contract cheap Android phone for Virgin or Boost or whomever that you never activate. The Android phone also has an SD slot, and you can even skip registering it with Google and sideload or use the Amazon app store if you like. The lonely little niche in the store with the ipod display is an "are you kidding?" deal. Apple probably pays the stores for wasting the space.

        My first mobile device was a 32g iPod touch. I would NEVER do that again.

        • im not saying its a GOOD idea, but it fits the specs he was asking about. I had a 1st gen 8 gig ipod touch before the touch screen takeover of cell phones. like you, never again

      • Re: (Score:2)

        by antdude ( 79039 )

        What about Android? :P

    • ...and it was called a Palm Pilot.

    • Why doe this not exist?

      Not only does it exist, but there's no functional difference between buying that, and buying a GSM phone and not slotting a SIM card except that a small tablet may actually not have the right speaker arrangement to play phone, so if you ever want to use it for VoIP, you may get really pissed off at it.

      I think most of the reputable companies have stopped making them for lack of demand, but there's still assloads of el cheapie models straight outta china. Check DX.com or similar.

      • Re: (Score:2)

        by jaa101 ( 627731 )

        there's no functional difference between buying that, and buying a GSM phone and not slotting a SIM card

        Except that a GSM phone with no SIM can call 911 (and/or 112).

        • Except that a GSM phone with no SIM can call 911 (and/or 112).

          Yes, that's true. Say, in that case, is the call not encrypted? Since there's no SIM involved? Or is there some kind of fallback in there?

    • I want a micro-tablet. I want a cell phone without the phone to hold my shopping list, music, and podcasts. I don't want the phone.

      Why doe this not exist?

      It does [liliputing.com]. But most devices include the phone anyway because the cost is trivial and it's not worth it to create the tooling and manufacturing to produce a separate product which is basically the same thing without the phone.

    • Buy a phone. Don't put a simcard in it.
      Switch it to flight mode if you're worried about making emergency calls.

    • Re: (Score:2)

      by mcrbids ( 148650 )

      I have used my "previous generation" phone in exactly this capacity every time I upgrade to a new phone. Around these parts on Craigslist, a used Samsung Galaxy S3 costs about $50 to $100. There's nothing preventing you from buying one, setting up the wifi, and using it exactly as you mention.

      You could even get a MagicJack or Nextiva VOIP or something and use it as for phone service over wifi for very cheap.

    • Why doe this not exist?

      Wait what? Which bits of the phone do you *not* want. There's the microphone and speaker parts (then again I often speak with people using skype over wifi on a tablet). There's the modem, but that also gives you data access away from wifi.

      In any case, the 3G chipset and microphone and speaker are super cheap. It's unlikely to be profitable for them to split the product line ust to leave off one component.

      If you want a mini tablet, buy a phone and nuke the sim card. You can also switch

  • Make the device read-only .. (Score:3)

    by nickweller ( 4108905 ) on Sunday August 09, 2015 @05:29PM (#50281149)
    Is it possible for the hardware manufacturers to put a read-only switch on the device that would protect certain core files from being overwritten?

    • Re:Make the device read-only .. (Score:4, Interesting)

      by drinkypoo ( 153816 ) <drink@hyperlogos.org> on Sunday August 09, 2015 @06:25PM (#50281401) Homepage Journal

      It's not just possible, it's easy. It does, however, cost a little bit. You'd need to have the system and the user data area on separate flash devices, so that you could use the hardware write protection on the device. Android already sees these as separate things, even when they're just separate partitions of the same flash, so there's little to no software work to be done there.

      • It also wouldn't work:

        "ATTENSHION! Important massage from http://scamsite.ru/yourbank/lo... [scamsite.ru] u r device is insecure and u need to flip the swich so u can upgrayedd u r files!1"

        And plenty of people would flip the switch. "it has my bank name. Must be legit, right?"

        True story from my last place of work: there was a persistent fishing emailbeing sent round asking for passwords. The IT department sent out a warning message that they never, ever ask for passwords and never send them by email. And if you see a mes

        • Well, far too many people read the example scam in the email and replied with their passwords.

          This is one of those cases where you can't prevent someone shooting themselves in the foot, but you can protect them from being shot by someone else. I think that's worth a switch, but obviously I'm in the minority or it would be a standard feature.

          • Yes, I think you (we, actually, since I'd like one too) are very much in the minority.

            Having a switch could actually decrease security. Sure, it prevents critical files getting overwritten, so a reboot would clear out problems. It would also probably stop people upgrading, which means the apps at runtime would remain vulnerable, and they'd just get re-pwned every time they went online.

  • Time is being wasted with too much microscopic detail. "In light of the several recent Android vulnerabilities..." is where the question starts. From the first word, all the way down to "...a phone that's not cutting edge" is 148 words (60% of the post) describing trivial concerns and working too hard to explain (thereby only begging the question) why someone would keep old gear. That's why people are saying the problem is trivial and accusing you of holding on to old junk. Me, I applaud old junk, but anywa

  • Turn off wifi and cellular. That should keep you safe.

  • Older smartphones don't have enough available memory to host the apps released today. Chrome simply won't run right, or even fit on an 8 MB phone, with Cyanogenmod installed and all vendor crap removed.
    If you want to do the right thing, donate the phones to any of the countless charities that accept them, take a tax deduction, and donate that amount to another charity.
    Making them work for the intended purpose is their problem.
    Wipe it (all phones have a factory reset option), remove the SIM, and mail it

  • Unless you're using it for banking or some other financial activity does it really matter? If using it as a GPS or like I do as a pocket ebook reader then who cares? I've got an old Samsung Media Player 5 that I use to read books while listening to FM radio through earbuds (It has an FM chip in it!) That way I run the battery down on it instead of my phone. I have wi-fi so if I have a hotspot available I can e-mail if I like or even browse the web and youtube. If it gets hacked so what? I don't use it

    • Sensible advice.

      The problem is not about the phone getting hacked, it's about what exposure that gives you. If you don't have any information on the phone that leads back to the owner, their finances, their location or that gateways into a network that does - then who cares? There would be nothing usable that a hacker (and from what I have read hackers are like dragons: those people who want to see them will do so, they may even exist - but are probably an incorrect explanation for something more mundane,

      • My phone is new enough to get security updates and I still don't do any online banking, social media, Amazon shopping, etc... on it for the same reason. I make phone calls, send and receive texts, turn on location services when I need navigation, play casual games, and browse news websites.

  • Safe use of old phone? (Score:4, Funny)

    by dbIII ( 701233 ) on Sunday August 09, 2015 @10:59PM (#50282377)

    Safe use of old phone?

    Externally.

  • Find a site that supports your device. You can get rooting information and the real answers your looking for, as CyanoGen isn't the only ROM out there; many are made by users who will access that site.

    Once rooted (jail broken) you can add a HOSTS file, programs to change the permissions of a program (as any game is going to want your info and out), just a lot more freedom to do what you want.

    Older Android devices you need to access your developers options, newer devices you need to get it to show by opening

  • How I use them...... (Score:1)

    by Anonymous Coward

    1. I have KODI media server and use them as WiFi remote controllers for controlling KODI.
    2. I have an older laptop dedicated to the Van and use them with it as PLEX viewing/listening devices for passengers. The Laptop acts as server and the built in WiFi becomes an Access Point for the phones to connect to. Passengers love it for music or photos or listening to music via headphones for privacy.
    3. I own TriggerTrap photo device. Older phones can control camera via Wifi from one phone in my hand to another p

  • I have a BUNCH of older phones - somewhere in the neighborhood of (cough, 60, cough) I have started using the oldest of the bunch as wifi security cameras with an app called Alfred (android only) and every time the device senses motion it sends a screen capture to my viewer device (which is a couple phones I actually use with cell/data service.) basically I put one in my front window, on each side of the house and, in my entry way into my home, I plan on putting one more in the garage window, and will put

Slashdot Top Deals

Our OS who art in CPU, UNIX be thy name. Thy programs run, thy syscalls done, In kernel as it is in user!

Close