Android
DROID DOES
Welcome to the droidymcdroidface-iest, Lemmyest (Lemmiest), test, bestest, phoniest, pluckiest, snarkiest, and spiciest Android community on Lemmy (Do not respond)! Here you can participate in amazing discussions and events relating to all things Android.
The rules for posting and commenting, besides the rules defined here for lemmy.world, are as follows:
Rules
1. All posts must be relevant to Android devices/operating system.
2. Posts cannot be illegal or NSFW material.
3. No spam, self promotion, or upvote farming. Sources engaging in these behavior will be added to the Blacklist.
4. Non-whitelisted bots will be banned.
5. Engage respectfully: Harassment, flamebaiting, bad faith engagement, or agenda posting will result in your posts being removed. Excessive violations will result in temporary or permanent ban, depending on severity.
6. Memes are not allowed to be posts, but are allowed in the comments.
7. Posts from clickbait sources are heavily discouraged. Please de-clickbait titles if it needs to be submitted.
8. Submission statements of any length composed of your own thoughts inside the post text field are mandatory for any microblog posts, and are optional but recommended for article/image/video posts.
Community Resources:
We are Android girls*,
In our Lemmy.world.
The back is plastic,
It's fantastic.
*Well, not just girls: people of all gender identities are welcomed here.
Our Partner Communities:
view the rest of the comments
Depends on your risk surface. If the program in question that doesn't get any updates is isolated from the network completely. air gapped. Then it's probably fine. It's working.
The trouble is the internet is constantly evolving, and so as soon as an exploit is discovered it's added to a bunch of exploit scanners which look for things online that they can exploit. So if you have a piece of software that's not getting updates, and it's attached to the network. You could get in trouble.
And not just the software itself, any libraries it used, any build environment objects that pulled in. All of those are part of the ecosystem. So while the code itself may not have somebody looking at it for an exploit, it could use a standard library which now has an exploit which is in metasploit with somebody's just scanning the internet to find your little phone.
So I have an older phone lying around and I've always wondered how risky would it be to connect it to Wi-Fi. Just because it has lost software updates a while back does that automatically open a gap in my network? Or would someone have to put in a lot of effort to get through like my routers firewall
Your router's firewall only blocks access to unauthorized ports. If your device is talking to the Internet, then that device is exposed to that connection. Your router's firewall does not prevent your device from using an outdated and exploitable software on the Internet.
Theoretical example, your device is stuck using an old web browser for whatever reason, that browser does not have a recent patch for an exploit involving loading infected pictures. You use that device to load a website with those infected pictures and your device loads malware because of that. Now your device could become a conduit for somebody to tunnel into your home network and look for any other things to exploit, whether those devices connect to the Internet themselves or not.
Obviously, you can often update web browsers on older devices, use a fork specifically designed for older devices, etc. But there are oversights. Old Android versions can't update Webview outside of OS updates. Webview is what apps use to load web pages inside the app, and if you're using an old app, which uses the old Webview, to load a webpage that the owner abandoned and has been taken over by a malicious third-party, your device could be exploited just by that app loading that webpage without you meaning to.
Wow that makes a lot of sense thank you for taking the time to explain it!
just adding that one can achieve that using an app like NetGuard: https://f-droid.org/en/packages/eu.faircode.netguard/