Key takeaways:
– Android OS versions up to and including version 10 are in end-of-life status, meaning they are no longer receiving security patches/updates.
– Unpatched vulnerabilities can lead to unauthorized access to sensitive security information, denial of service (DoS) attacks and ransomware.
– Security patches also improve the stability and performance of devices, which is crucial to physical access control systems (PACS) that require fast and reliable authentication to ensure security of secured areas.
In today’s world, technology is an indispensable tool that makes our personal and professional lives easier and more convenient. We rely on our smartphones, tablets, and other mobile devices to stay connected, access information, and perform a wide range of tasks. However, as technology evolves rapidly, so do the risks associated with it. While visibility of this issue has improved significantly for workstation computers in recent years, security on mobile devices remains a frequently overlooked topic. In this post, we will explain the security risks associated with unmaintained Android software when used by Maritime Transportation Security Act and Chemical Facility Anti-Terrorism Standards regulated facilities for physical access control and how to mitigate them.
Physical access control systems are used to regulate and monitor access to secured areas, assets, and buildings. PACS use technologies such as smart cards, biometric readers, and mobile devices to authenticate and grant access to authorized individuals. With the increasing use of mobile devices in PACS, it is essential to have up-to-date applications and operating systems, especially for Android devices.
Android is one of the most widely used mobile operating systems in the world, with more than 2.5 billion active users. With such a large user base, the platform provides an appealing target for those looking to infiltrate vulnerable systems through cyber-attacks. These vulnerabilities can be exploited by attackers to gain unauthorized access to a PACS, which can lead to severe security breaches. To mitigate these risks, it is essential to ensure that devices are running actively maintained operating systems, and that they are receiving patch updates on a regular basis.
The Importance of Android Security Patches
Security patches are released periodically by device vendors to address vulnerabilities and bugs that are found in the operating system. These patches are critical in ensuring the security of the Android operating system, and failure to install them can leave the device vulnerable to attack. For example, Android OS 7.1.2 and 8.0 have been in end-of-life status since 2019 and 2021 respectively. From the standpoint of cybersecurity, that is a very long time and each version has accumulated a large number of unpatched security bulletins that can provide a significant attack surface.
Unpatched vulnerabilities can create several problems for a device. First, attackers can exploit these vulnerabilities to gain unauthorized access and steal sensitive data from the device. Second, running outdated Android versions can make the device vulnerable to denial-of-service (DoS) attacks and ransomware. A DoS attack involves flooding the device with traffic to overwhelm the system and prevent legitimate users from accessing the system. Ransomware, on the other hand, selectively blocks access to critical functionality or information until the device owner has paid a ransom to the attacker. Either attack can be particularly problematic for PACS, which requires fast and reliable authentication processes.
Finally, patches can also improve the overall performance of the Android operating system. These updates often include bug fixes and stability improvements that can enhance the effectiveness of the device. This can be crucial for PACS, which requires fast and reliable authentication processes to ensure the security of the secured area.
Mechanically, attacks leveraging such vulnerabilities can take several forms. In the simplest cases, an attacker may be able to exfiltrate data from the PACS, compromising operational security and providing the attacker with valuable information on a facility. In the most complex cases, an attacker may attempt to fully take control of a device, actively making the device complicit in a broader cyber or physical attack on the organization. In the case of the Android 7.1.2 and 8.0 versions mentioned earlier, there are 8 and 38 (respectively) documented[1] exploits that can be used for remote code execution – which is typically a precursor to the most sophisticated attacks.
Best Practices for Android Operating System Updates
To ensure the security of a PACS, it is essential to follow best practices for Android operating system updates. Here are some tips to help ensure that the device is up-to-date and secure:
– Ensure the Android devices used in your PACS are running supported versions of the operating system. As of today, currently supported versions are Android 11 and higher. If your device cannot be updated to a supported Android Operating System, it is recommended that you upgrade your equipment as soon as possible.
– Enable automatic updates: One of the easiest ways to ensure that the device is up to date is to enable automatic updates. This will allow the device to automatically download and install the latest security patches and updates as they become available. If this is done through your service provider, you should ask them what their policy is on updating your deployed equipment.
– Check for updates regularly: If automatic updates are not enabled, it is essential to check for updates regularly. This will ensure that the device is up to date with the latest security patches and updates.
The bottom line is: if you are using a PACS at your facility, it is imperative for security that you know what operating system is running on your equipment, and what the patching/updating policy is for those devices. Collaborate with your IT staff, reach out to your contracted service providers and do not overlook the importance of keeping your security software and hardware up to date.
[1] Based on MITRE CVE Database; https://cve.mitre.org/