Yahoo Japan buys a minority stake in a Tokyo cryptocurrency exchange

Yahoo Japan has gotten its hands on 40 percent of a Tokyo-based cryptocurrency exchange set to launch this fall.

The investment, made in BitARG Exchange through a Yahoo Japan subsidiary gives the company a minority stake with BitARG parent company CMD Laboratories still maintaining 60 percent ownership of the exchange. A source told CNBC the deal went for about 2-3 billion yen or around $18-28 million.

In a translated announcement, BitARG said the exchange would benefit from the “service operation and security expertise of the Yahoo Japan Group, which will make it easier for customers to prepare for the start of the exchange service… and to improve the operation after the commencement.”

Last month, Nikkei Asian Review reported the deal was in progress, further noting that Yahoo Japan planned to use BitARG’s technology to launch its own cryptocurrency exchange in 2019.


Source: Tech Crunch

Apple details its crackdown on leakers…in a leaked memo

In an internal memo to employees, Apple threatened severe consequences for leaking confidential company information – reminding staff that those who leak can lose their jobs, have difficult finding future employment, and even get arrested. Last year, Apple claimed to have busted 29 leakers, 12 of whom were arrested.

The memo itself was leaked, and its content was published by Bloomberg this afternoon.

Apple has always cultivated a culture of confidentially about its work, as a means of maintaining a competitive advantage over the competition.

Given how large Apple has grown over the years – the memo says there are “135,000 people” working there – it’s become more difficult to keep things under wraps. By the time a new iPhone launches, for example, people already know what to expect. That can give rivals a head start on catching up with Apple, ahead of an actual public unveiling of the device. Leaks can also impact sales of current devices, as consumers hold off on buying as they know something better is soon to arrive.

Apple more recently has had problems with leaked iOS source code, as well as leaked details about the iPhone 8 and X, Apple Watch Series 3, Apple TV 4K, HomePod, and more. And that was just in 2017.

The new memo is not the first time Apple has tried to plug its leaks. Last year, the company held a meeting with employees where it discussed how it plans to prevent leaks, talked about how leakers were caught, and answered employees’ questions.

That meeting was secretly recorded and leaked to the press too.

In reality, some leaks can be harder to track or stop. A company-wide meeting or email, for instance, could be leaked by anyone.

The new memo begins by informing Apple employees that the person who leaked details about Apple’s software roadmap earlier this year was caught and fired last month:

Last month, Apple caught and fired the employee responsible for leaking details from an internal, confidential meeting about Apple’s software roadmap. Hundreds of software engineers were in attendance, and thousands more within the organization received details of its proceedings. One person betrayed their trust.

The employee who leaked the meeting to a reporter later told Apple investigators that he did it because he thought he wouldn’t be discovered. But people who leak — whether they’re Apple employees, contractors or suppliers — do get caught and they’re getting caught faster than ever.

The memo then goes on to stress how damaging leaks are to the company itself, those who worked on a project, and other employees.

It reminds employees that when they’re approached by press, analysts and bloggers they’re “getting played.”

The establishment of a very us-versus-them culture when dealing with outsiders is notable because it means Apple employees may fear becoming whistleblowers. Employees will likely also fear leaking to correct inaccurate information being passed around publicly. Today, there are reports that Apple’s own comms teams won’t respond to, when asked by press – unless the report reaches a critical mass, or worse – is unflattering to Apple.

But unlike at other companies where a PM or staffer may reach out to privately correctly a detail or give background outside of official channels, Apple staff would be fired for crossing that line.

The memo also points to more examples of how Apple’s internal security has caught people who believed they could get away with it – including the person who leaked the link to the gold master of iOS 11, and those who leaked within the supply chain.

It concludes by sharing the news that 12 of the leakers in 2017 were arrested.

“Leakers do not simply lose their jobs at Apple. In some cases, they face jail time and massive fines for network intrusion and theft of trade secrets both classified as federal crimes,” the memo read. “These people not only lose their jobs, they can face extreme difficulty finding employment elsewhere.”

There’s a certain kind of person who will find language like this a challenge. But the majority will likely take heed.

The memo was published as an internal company blog post.

The full memo can be read on Bloomberg’s site.


Source: Tech Crunch

Elon Musk says Tesla will be profitable in Q3 and Q4

Tesla is one of the more interesting companies for Wall Street that had an interesting couple of months this year — and it seems even tweets from Elon Musk, who said that the company will be profitable in the back half of the year, may be enough to swing its stock.

The Tesla and SpaceX founder sent a tweet very early this morning that the company would be profitable and cash-flow positive in the third and fourth quarter this year. Tesla is known for setting ambitious targets and forecasts, especially as it looks to ramp up Model 3 production to around 2,500 vehicles per week. Musk said he took direct control of Model 3 production earlier this month in a note to employees, also sent out at around 3 a.m. pacific time. Tesla’s shares were up slightly, gaining around 2% in trading today.

Tesla saw a small bump in its stock throughout the day. While it could be for a variety of reasons, Musk’s data point may have offered a small amount of clarity (and optimism) around whether the company will be able to eventually turn a profit. The tweet was fired off as a response to a story by The Economist that said the company may have to raise additional capital at some point, according to banking firm Jeffries. (It was also quite snarky.)

On Tesla’s last call to discuss the company’s quarterly results with Wall Street analysts, Musk said that the company would begin generating “positive quarterly operating income on a sustained basis,” and said he was “cautiously optimistic” that the company would be GAAP profitable. Musk said the company wanted to hit a production target of 5,000 Model 3 vehicles per week at some point in 2018, though did not give a specific time frame. The tweet, while fired off as a response to a story by The Economist, appears to offer another small data point as to when it might happen.

Earlier this month, Tesla fell back behind Ford in terms of its market cap as some pressure has hit the stock. Tesla has had to address a fatal crash involving its autopilot, in addition to a voluntary recall of 123,000 Model S vehicles. There is some skepticism around whether Tesla will hit its production targets from Wall Street (making cars is hard, it seems).


Source: Tech Crunch

Facebook shouldn’t block you from finding friends on competitors

Twitter, Vine, Voxer, MessageMe. Facebook has repeatedly cut off competitors from its feature for finding your Facebook friends on their apps… after jumpstarting its own social graph by convincing people to upload their Gmail contacts. Meanwhile, Facebook’s Download Your Information tool merely exports a text list of friends’ names you can’t use elsewhere.

As Congress considers potential regulation following Mark Zuckerberg’s testimonies, it should prioritize leveling the playing field for aspiring alternatives to Facebook and letting consumers choose where to social network. And as a show of good faith and argument against it abusing its monopoly, Facebook should make our friend list truly portable.

It’s time to free the social graph — to treat it as a fundamental digital possession, the way the Telecommunications Act of 1996 protects your right to bring your phone number with you to a new network.

The two most powerful ways to do this would be for Facebook to stop, or Congress to stop it from, blocking friend finding on competitors like it’s done in the past to Twitter and more. And Facebook should change its Download Your Information tool to export our friend list in a truly interoperable format. When you friend someone on Facebook, they’re not just a name. They’re someone specific amongst often many with the same name, and Facebook should be open to us getting connected with them elsewhere.

Facebook takes data it won’t give

While it continues til this day, back in 2010 Facebook goaded users to import their Gmail address books so they could add them as Facebook friends. But it refused to let users export the email addresses of their friends to use elsewhere. That led Google to change its policy and require data portability reciprocity from any app using its Contacts API.

So did Facebook back off? No. It built a workaround, giving users a deep link to download their Gmail contacts from Google’s honorable export tool. Facebook then painstakingly explained to users how to upload that file so it could suggest they friend all those contacts.

Google didn’t want to stop users from legitimately exporting their contacts, so it just put up a strongly worded warning to Gmail users: “Trap my contacts now: Hold on a second. Are you super sure you want to import your contact information for your friends into a service that won’t let you get it out? . . . Although we strongly disagree with this data protectionism, the choice is yours. Because, after all, you should have control over your data.” And Google offered to let you “Register a complaint over data protectionism.”

Eight years later, Facebook has grown from a scrappy upstart chasing Google to become one of the biggest, most powerful players on the internet. And it’s still teaching users how to snatch their Gmail contacts’ email addresses while only letting you export the names of your friends — unless they opt-in through an obscure setting, because it considers contact info they’ve shared as their data, not yours. Whether you should be allowed to upload other people’s contact info to a social network is a bigger question. But it is blatant data portability hypocrisy for Facebook to encourage users to import that data from other apps but not export it.

In some respects, it’s good that you can’t mass-export the email addresses of all your Facebook friends. That could enable spamming, which probably isn’t what someone had in mind when they added you as friend on Facebook. They could always block, unfriend or mute you, but they can’t get their email address back. Facebook is already enduring criticism about how it handled data privacy in the wake of the Cambridge Analytica scandal.

Yet the idea that you could find your Facebook friends on other apps is a legitimate reason for the platform to exist. It’s one of the things that’s made Facebook Login so useful and popular. Facebook’s API lets certain apps check to see if your Facebook friends have already signed up, so you can easily follow them or send them a connection request. But Facebook has rescinded that option when it senses true competition.

Data protectionism

Twitter is the biggest example. Facebook didn’t and still doesn’t let you see which of your Facebook friends are on Twitter, even though it has seven times as many users. Twitter co-founder Ev Williams, frustrated in 2010, said that “They see their social graph as their core asset, and they want to make sure there’s a win-win relationship with anybody who accesses it.”

Facebook went on to establish a formal policy that said that apps that wanted to use its Find Friends tool had to abide by these rules:

  •  If you use any Facebook APIs to build personalized or social experiences, you must also enable people to easily share their experiences back with people on Facebook.

  • You may not use Facebook Platform to promote, or to export user data to, a product or service that replicates a core Facebook product or service without our permission.

Essentially, apps that piggybacked on Facebook’s social graph had to let you share back to Facebook, and couldn’t compete with it. It’s a bit ironic, given Facebook’s overarching strategy for years has been “replicate core functionality.” From cloning Twitter’s asymmetrical follow and Trending Topics to Snapchat’s Stories and augmented reality filters, all the way back to cribbing FriendFeed’s News Feed and Facebook’s start as a rip-off of the Winklevii’s HarvardConnection.

Restrictions against replicating core functionality aren’t unheard of in tech. Apple’s iOS won’t let you run an App Store from inside an app, for example. But Facebook’s selective enforcement of the policy is troubling. It simply ignores competing apps that never get popular. Yet if they start to grow into potential rivals, Facebook has swiftly enforced this policy and removed their Find Friends access, often inhibiting further growth and engagement.

Here are few of examples of times Facebook has cut off competitors from its graph:

  • Voxer was one of the hottest messaging apps of 2012, climbing the charts and raising a $30 million round with its walkie-talkie-style functionality. In early January 2013, Facebook copied Voxer by adding voice messaging into Messenger. Two weeks later, Facebook cut off Voxer’s Find Friends access. Voxer CEO Tom Katis told me at the time that Facebook stated his app with tens of millions of users was a “competitive social network” and wasn’t sharing content back to Facebook. Katis told us he thought that was hypocritical. By June, Voxer had pivoted toward business communications, tumbling down the app charts and leaving Facebook Messenger to thrive.
  • MessageMe had a well-built chat app that was growing quickly after launching in 2013, posing a threat to Facebook Messenger. Shortly before reaching 1 million users, Facebook cut off MessageMe‘s Find Friends access. The app ended up selling for a paltry double-digit millions price tag to Yahoo before disintegrating.
  • Phhhoto and its fate show how Facebook’s data protectionism encompasses Instagram. Phhhoto’s app that let you shoot animated GIFs was growing popular. But soon after it hit 1 million users, it got cut off from Instagram’s social graph in April 2015. Six months later, Instagram launched Boomerang, a blatant clone of Phhhoto. Within two years, Phhhoto shut down its app, blaming Facebook and Instagram. “We watched [Instagram CEO Kevin] Systrom and his product team quietly using PHHHOTO almost a year before Boomerang was released. So it wasn’t a surprise at all . . . I’m not sure Instagram has a creative bone in their entire body.”
  • Vine had a real shot at being the future of short-form video. The day the Twitter-owned app launched, though, Facebook shut off Vine’s Find Friends access. Vine let you share back to Facebook, and its six-second loops you shot in the app were a far cry from Facebook’s heavyweight video file uploader. Still, Facebook cut it off, and by late 2016, Twitter announced it was shutting down Vine.

As I wrote in 2013, “Enforcement of these policies could create a moat around Facebook. It creates a barrier to engagement, retention, and growth for competing companies.” But in 2018, amongst whispers of anti-trust action, Facebook restricting access to its social graph to protect the dominance of its News Feed seems egregiously anti-competitive.

That’s why Facebook should pledge to stop banning competitors from using its Find Friends tool. If not, congress should tell Facebook that this kind of behavior could lead to more stringent regulation.

Friends aren’t just names

When Senator John Neely Kennedy asked Zuckerberg this week, “are you willing to give me the right to take my data on Facebook and move it to another social media platform?”, Zuckerberg claimed that “Senator, you can already do that. We have a Download Your Information tool where you can go get a file of all the content there, and then do whatever you want with it.”

But that’s not exactly true. You can export your photos that can be easily uploaded elsewhere. But your social graph — all those confirmed friend requests — gets reduced to a useless string of text. Download Your Information spits out merely a list of your friends’ names and the dates on which you got connected. There’s no unique username. No link to their Facebook profile. Nothing you can use to find them on another social network beyond manually typing in their names.

That’s especially problematic if your friends have common names. There are tons of John Smiths on Facebook, so finding him on another social network with just a name will require a lot of sleuthing, or guess-work. Depending on where you live, locating a particular Garcia, Smirnov or Lee could be quite difficult. Facebook even built a short-lived feature called Friendshake to help you friend someone nearby amongst everyone in their overlapping name space.

When I asked about this, Facebook told me that users can opt-in to having their email or phone number included in the Download Your Information export. But this privacy setting is buried and little-known. Just 4 percent of my friends, centered around tech savvy San Francisco, had enabled it.

As I criticized way back in 2010 when Download Your Information launched, “The data can be used as a diary, or to replace other information from a hard drive crash or stolen computer — but not necessarily to switch to a different social network.”

Given Facebook’s iron grip on the Find Friends API, users deserve decentralized data portability — a way to take their friends with them that Facebook can’t take back. That’s what Download Your Information should offer, but doesn’t.

Social graph portability

This is why I’m calling on Facebook to improve the data portability of your friend connections. Give us the same consumer protections that make phone numbers portable.

At the very least Facebook should include your friends’ unique Facebook username and URL. But true portability would mean you could upload the list to another social network to find your friends there.

One option would be for Facebook’s export to include a privacy-safe, hashed version of your friends’ email address that they signed up with and share with you. Facebook could build a hashed email lookup tool so that if you uploaded these nonsensical strings of characters to another app, they could cross-reference them against Facebook’s database of your friends. If there’s a match, the app could surface that person as someone with whom you might want to reconnect. Effectively, this would let you find friends elsewhere via email address without Facebook ever giving you or other apps a human-readable list of their contact info.

If you can’t take your social graph with you, there’s little chance for a viable alternative to Facebook to arise. It doesn’t matter if a better social network emerges, or if Facebook disrespects your privacy, because there’s nowhere to go. Opening up the social graph would require Facebook to compete on the merit of its product and policies. Trying to force the company’s hand with a variety of privacy regulations won’t solve the core issue. But the prospect of users actually being able to leave would let the market compel Facebook to treat us better.

For more on Facebook’s challenges with data privacy, check out TechCrunch’s feature stories:


Source: Tech Crunch

Is Android Popsicle next?

Barring any sort of major shakeup at Google’s mobile division, there are two things we know for sure about the next Android’s name: it will start with the letter “P” and it will be a dessert food. That already narrows things down quite a bit — you’ve got pudding, pecan pie, peanut brittle…

Then, of course, there’s Popsicle — a fact the company might well be alluding to in its new Spring Wallpaper Collection. 9to5Google noted a colorful array of frozen confections in amongst the selections. Granted, it’s not thematically too far from the rest of the outdoor, sunshine-themed offerings.

Google’s never shied away from such cheeky suggestions — and it’s certainly teased us before, including in the lead up to Oreo. Though that could just as easily mean it’s a bit of a red herring — remember Android Pocky?

It’s worth noting that Popsicle is, in fact, still a trademarked name — like Kleenex and Xerox and Frisbee. Of course, that hasn’t stopped Google in the past. See such recent examples as Kit-Kat and Oreo. And while Popsicle-owner Unilever has flexed its muscles maintaining its ownership of the name, it’s hard to imagine a better/cheaper promotion than stamping your name across the latest build of the world’s most popular mobile operating system.

There is, of course, the issue of the fact that the Popsicle name isn’t as globally synonymous with the ice pop as it is here in the States. You may know it, perhaps, as an ice lolly, ice block or ice drop, depending on where you happen to be reading this.

Whatever the case, Google’s probably just happy that we’re talking about it at all.


Source: Tech Crunch

Volkswagen’s CEO is out following diesel scandal

Matthias Müller is out as Volkswagen CEO, amid a diesel emissions scandal that shook the world’s largest car maker. The company confirmed the move today, naming Brand Chief Herbert Diess to the top job in his stead.

Müller had only been in the top role for three years, and while the chief executive was never charged in the scandal, many in the industry believe that he didn’t impose changes quickly enough after information came to light.

This time last year, the company was hit with a $2.8 billion penalty in the U.S., bringing its costs for the scandal up to around $30 billion, according to NBC. Volkswagen was one of a number of automakers caught adjusting emissions during laboratory testing, in order to meet environmental standards.

Earlier this week, the company announced that it was considering replacing its CEO. Today the company issued a statement thanking Müller for his time during what it referred to as “the greatest challenge in its history.”

Board member Hans Dieter Pötsch adds, effusively, “Together with his team, he also fundamentally realigned the Group’s strategy, initiated cultural change and, with great personal commitment, made sure that the Volkswagen Group not just stayed on track but is now more robust than ever before. For that, he is due the thanks of the entire Company.”

VW’s new CEO, Herbert Diess, joined the company in 2015 after spending time at BMW. As The BBC notes, Diess has already proven a divisive character for the company due to battles with the unions and attempts to cut costs at the company.


Source: Tech Crunch

Subscription biller Zuora soars 43% following IPO

Subscription biller Zuora was well-received by stock market investors on Thursday, following its public debut. After pricing its IPO at $14, the company closed at $20, valuing the company around $2 billion.

It was also much higher than expected. The company said in its filings that it planned to price its shares between $9 and $11, before it raised that range to $11 to $13.

Founder and CEO Tien Tzuo told TechCrunch that he believes “a bet on us is really a bet on an entire shift to a new business model, to a subscription economy.” He is optimistic that subscriptions are the “business model of the future.”

Zuora sees itself as an early pioneer in a growing category. The company believes that more businesses will shift their business models to subscriptions, across sectors like media and entertainment, transportation, publishing, industrial goods and retail.

It helps its 950 customers manage subscriptions, including billing and revenue recognition. Zuora touts that it has 15 of the Fortune 100 businesses as clients.

Zuora’s revenue for its fiscal 2018 year was $167.9 million. This was up from $113 million in 2017 and $92.2 million the year before. Losses remained constant in this timeframe, from $48.2 million in 2016 to $47.2 million in 2018.

“We have a history of net losses, anticipate increasing our operating expenses in the future, and may not achieve or sustain profitability,” warned the requisite risk factors section of the filing.

It also acknowledged a competitive landscape. Oracle and SAP are amongst the companies offering software in the ERP (enterprise resource planning) category. It also competes with other startups like Chargebee.

The largest shareholders are Benchmark, which owned 11.1% prior to the IPO . Founder and CEO Tien Tzuo owned 10.2%. Others with a significant stake included Wellington Management, Shasta Ventures, Tenaya Capital and Redpoint.

The San Mateo, California-based company previously raised over $240 million, dating back to 2007.

Zuora listed on the New York Stock Exchange, under the ticker “ZUO.” Goldman Sachs and Morgan Stanley worked as lead underwriters on the deal. Fenwick & West and Wilson Sonsini served as counsel.

After a slow start to the year for tech IPOs, there has been a flurry of activity in recent weeks. Dropbox and Spotify were amongst the recent public debuts. We also have DocuSign, Pivotal and Smartsheet on the horizon.


Source: Tech Crunch

Tesla says it willingly withdrew from NTSB investigation

Tesla says it willingly withdrew from the party agreement with the National Transportation Safety Board, adding that the NTSB is more concerned with “press headlines than actually promoting safety,” a Tesla spokesperson told TechCrunch via email.

“Last week, in a conversation with the NTSB, we were told that if we made additional statements before their 12-24 month investigative process is complete, we would no longer be a party to the investigation agreement,” a Tesla spokesperson said in a statement to TechCrunch. “On Tuesday, we chose to withdraw from the agreement and issued a statement to correct misleading claims that had been made about Autopilot — claims which made it seem as though Autopilot creates safety problems when the opposite is true.”

This comes after the NTSB said it revoked Tesla’s party status in the investigation regarding the fatal crash involving one of Tesla’s Model X cars. The NTSB said it did so because Tesla, without permission from the NTSB, relayed information to the public regarding the investigation.

Tesla went on to note the prevalence of automotive fatalities in the United States in comparison to fatalities involving cars with Autopilot. Tesla says for every 320 million miles cars equipped with Autopilot drive, there is one fatality, including known pedestrian fatalities. That’s compared to one fatality for every 86 million miles driven for all vehicles, Tesla said.

“If you are driving a Tesla equipped with Autopilot hardware, you are 3.7 times less likely to be involved in a fatal accident and this continues to improve,” the spokesperson said.

Tesla also alleges its “clear in our conversations” with the NTSB that it cares less about safety and more about press headlines.

“Among other things, they repeatedly released partial bits of incomplete information to the media in violation of their own rules, at the same time that they were trying to prevent us from telling all the facts,” the spokesperson said. “We don’t believe this is right and we will be making an official complaint to Congress. We will also be issuing a Freedom Of Information Act request to understand the reasoning behind their focus on the safest cars in America while they ignore the cars that are the least safe.  Perhaps there is a sound rationale for this, but we cannot imagine what that could possibly be.”

Tesla also took time to note how the NTSB is an advisory body, rather than a regulatory one, and how Tesla has a “strong and positive relationship” with the National Highway Traffic Safety Administration (NHTSA)

“When tested by NHTSA, Model S and Model X each received five stars not only overall but in every sub-category,” the Tesla spokesperson said. “This was the only time an SUV had ever scored that well. Moreover, of all the cars that NHTSA has ever tested, Model S and Model X scored as the two cars with the lowest probability of injury. There is no company that cares more about safety and the evidence speaks for itself.”

I’ve reached out to the NTSB and NHTSA. I’ll update this story if I hear back.


Source: Tech Crunch

Watch the new trailer for the 15-year Rooster Teeth documentary

Being an online video star might seem cool or even glamorous these days, but Burnie Burns, co-founder and chief creative officer at Rooster Teeth, can remember when that wasn’t the case.

Rooster Teeth, which is behind the popular web series Red vs. Blue, is turning 15 years old this month. (The studio was acquired by Fullscreen a few years ago.) And Burns has been looking back at its history as part of the upcoming documentary Why We’re Here: 15 Years of Rooster Teeth.

He acknowledged that nowadays, anyone in the business is competing with “an enormous noise,” but at the same time, Burns said, “There’s the misconception that because no one was doing this when we got started, that made it easier. It’s really difficult to go into a place where no one else is and no one else cares what’s going on there.”

He recalled that in the studio’s early days, he would tell people about his work and realize, “Home video was a dirty word, and online video was beneath it.”

The documentary was directed by Mat Hames, and it allows Burns and his co-founder Matt Hullum to revisit many of their old haunts, including the bedroom where Burns uploaded the first episode of Red vs. Blue, “Why Are We Here?”

For Rooster Teeth fans, Burns promised footage that has never been seen before, as well as a recounting of the history that’s as honest as they could make it without violating nondisclosure agreements.

“I think we almost have an obligation to show what things were like back then,” he said.

And even if you haven’t been following the company through the years, Burns said the film provides an overview of how online video has evolved. After all, when Red vs. Blue launched, YouTube didn’t exist, and Burns said the documentary process has helped him understand “how short the memory of the Internet is.”

Rooster Teeth published a teaser for Why We’re Here last week, and today it’s launching the official trailer. The documentary will be released exclusively on the studio’s subscription video service FIRST on April 20.


Source: Tech Crunch

Are hardware makers doing enough to keep Android phones secure?

For all the good of Android’s open-source approach, one of the clear and consistent downsides is that the onus to issue software updates falls on the manufacturer. That can mean frustration for those waiting for the latest and greatest feature updates — and in some cases, it can put your phone at risk with delayed or missed security updates.

A pair of researchers at Security Research Labs recently shared a study with Wired highlighting some of these risks. The team’s findings are the result of testing 1,200 Android handsets from all the major manufacturers over the course of two years, examining whether manufacturers had offered the security patches as advertised.

According to SRL, missed security patches were discovered on a wide range of different handsets across manufacturers. Sony and Samsung were both flagged as having missed some security patches — in some cases in spite of reporting that they were up to date. “It’s almost impossible for the user to know which patches are actually installed,” one of the researchers told the site.

Xiaomi, Nokia, HTC, Motorola and LG all made the list, as well, while TCL and ZTE fared the worst in the study, with, on average, not having installed more than four of the patches they claimed to have installed on a given device.

In a statement provided to TechCrunch, Google pointed to the importance of various different means used to secure the Android ecosystem. The company believes that the SRL findings might not tell the full story when it comes to keeping devices secure.

“We would like to thank Karsten Nohl and Jakob Kell for their continued efforts to reinforce the security of the Android ecosystem,” the company writes. “We’re working with them to improve their detection mechanisms to account for situations where a device uses an alternate security update instead of the Google suggested security update. Security updates are one of many layers used to protect Android devices and users. Built-in platform protections, such as application sandboxing, and security services, such as Google Play Protect, are just as important. These layers of security—combined with the tremendous diversity of the Android ecosystem—contribute to the researchers’ conclusions that remote exploitation of Android devices remains challenging.” 

The company also pointed us to this year in review post, which sheds a bit more light on the matter.


Source: Tech Crunch