LineageOS will only patch Android. It will not patch hardware vulnerabilities after the device no longer has support from the manufacturer.
Both of these OSes are dangerous for privacy and security.
What’s your suggestion for hardware patches after the manufacturer ends support?
There is no option. There is too much variation in the various phone chips for the hardware hacking community to reverse engineer more than a bare handful. And as soon as the hardware has been reverse engineered, it will never be used again by a manufacturer making the exercise largely pointless.
Add to that, the fact that Qualcomm actively discourages long term support of their chips….
That’s why Fairphone choose a QCM6490 for the fairphone 5. It’s far from being the best, but it has longer term support than mainstream oriented SOC.
Since the SOC will probably be enough for most of users, it’s not a bad option I guess.
Get a new phone the vendor does support.
Firmware patching is applying low-level firmware to the modem or baseband, similar to a BIOS update on a desktop or server. These binary libraries are (a) proprietary, and (b) opaque to the user (meaning they’re not documented like normal software)
Once a vendor drops support for a platform, that’s it, that’s the end of the line. The device will still work, but any, glitches, firmware vulnerabilities, or updates for network-side changes will no longer be addressed.
This is just not realistic though, as the support is so short. You cannot buy phones ever few years. Only thing you can realistically do is apply at least Lineage and exercise caution.
Although using an up to date Android userspace is still less bad than stopping all the updates once the vendor jumps the ship.
It’s not going to stop a dedicated attacker, but having a somewhat secure webview that’s not going tu crumble under the first piece of malicious javascript goes a long way towards the peace of mind.
If a rootkit is hiding at the hardware level, it may not matter what operating system or web browser you’re using on your phone. A rootkit at this low level could potentially evade detection by the OS and modify files or memory without the operating system’s knowledge. It may also be able to disrupt secure boot processes and monitor radio transmissions like Bluetooth, WiFi, and NFC.
Once an exploit is found that works on a particular device model, and attackers know the device manufacturer will never release firmware updates again, they could start searching for any users of that phone model. A rootkit installed this way may remain on the phone permanently since firmware updates are no longer being provided. The phone user may be unaware their device has been compromised.
LineageOS does not employ a dedicated security engineer for each phone model. Maintainers with LineageOS typically take the latest firmware from the original device manufacturer and import it into their build process. But if the latest firmware release from the manufacturer is already three years old, it’s possible there may now be several undiscovered vulnerabilities in that outdated code.
So for the average users that only want to go on with their lives and not buy brand new phones every 2-3 years (or don’t live in places where fairphone and pixel phones are available) what would be the solution?
If a person is not some POI, don’t you think that wouldn’t be better to flash something that at least includes some relatively up to date security patches?
And how those rootkits are being loaded to phones with outdated firmware? Bundled with the last OS that was flashed or remotely by exploiting security flaws? Not a dev, but curious about it.
100% you are correct.
Shame on the down voters.
Running a phone without firmware and driver security patches is a huge risk, that goes up geometrically the longer the phone is out of support.
Lineageos is great for making older devices useful but they are not secure, and they shouldn’t be used for anything sensitive like money
For the down voters. Imagine I have a time machine and bring a precontact native American to present day. I know this is dangerous, so I make them read every modern medical textbook first. Chances are they are going to catch a fun modern disease rapidly and die. Not because they didn’t have the knowledge, but because their immune system didn’t co-evolve with the threats. Being stuck out of time is in anachronism, but that’s exactly what we’re asking our cell phones to do. We prevent them from co-evolving with current threats, and then expect them to match all the threats in the future…
