Ask Lemmy

The worst case risk is her entire financial net worth.

Criminals target the elderly, and an unpatched phone is a way for them to control a good percentage of what she experiences.

A vulnerable phone can result in an empty bank account.

The most common approach is to get control of an elder's incoming messages, and use it to manipulate their perception of reality to create a crisis - one that can only be solved be spending a sizeable portion of their savings. Then repeat until there's no more money left.

I'm not a fan of Wells Fargo, but they do have some good Guidance on preventing elder financial abuse.

The danger is essentially that anything being done on the phone is not secure.

If all she does with the phone is look at cat pictures and talk to friends and family, there's probably not much critical information there to worry about.

But does she use the phone for banking? tax records? health care? Does she use the phone for multifactor authentication to log in to her bank account &etc?

Anything involving financial or personal information could be used for identity theft and fraud. Even if she doesn't have much money personally, her identity has value on the black market for opening fraudulent credit cards and other accounts. If her phone is no longer getting security updates then her email may be exposed, and basically if you can get into someone's email then you can get into all of their other accounts (through "I forgot my password" links). Also keep in mind that the phone is a tracking device, so if it's not secure then anyone with the time and interest could use it to track her location.

It's worth noting that switching the phone to another OS like Lineage may not solve this problem. Android uses a core security feature of ARM processors called TrustZone to handle cryptographic functions like security keys. This depends on processor microcode that only gets updated by the manufacturer. If the device is no longer supported, then it will probably stop receiving updates. A third-party developer like Lineage won't have the capability to update this code.

The potential threat from this is not usually immediate. Just because a device might be vulnerable doesn't mean that it's worth anyone's time to actually hack it. But frequently what happens is that someone finds a vulnerability that can be exploited and then builds some software that can do the necessary steps automatically, after which any device with that vulnerability is not secure at all.

Deciding how critical all of this is for your mother depends a lot on context. Does she have financial assets that might make her a target? Is she politically active? Is she a member of a sociopolitical group that might be a target? Does she have a social media account with a lot followers? Does she have any close friends or relatives that someone might want to target through her? Does she know anyone who works in security for a large corporation, government or bank? Her own vulnerability might make someone else vulnerable by proximity.

There's no way to eliminate risk completely. The only way to answer the question "how dangerous is this?" is to assess the severity of possible losses and the likelihood of potential threats (threat modeling) and then make judgment calls based on priority.

If it is not getting updates then it isn't getting vendor security patches, it will still get Google Play Services and Android System Webview patches assuming those are enabled.

I wouldn't use any kind of banking or payment apps, so anything linked to an account from which money can be directly debited. That can be a lot of things from EBay to highway toll collection to paying for coffee.

I'm not trying to fear monger but it's time mom got a new phone. Use this one for streaming in the kitchen, or give it to a niece. Locked down of course.

Edit: that's if it's Android, if it's iOS it will not get any patches once it's end of life.

Let me know if I should post this in another community instead.

I'd guess that !android@lemmy.world or !cybersecurity@infosec.pub is probably going to be more-targeted.

With an out of date phone it will be easier to bypass it's security. Normally, cops and hackers have to use a series of exploits to bypass an Android's security. With a phone not receiving security updates this gets easier.

Installing LineageOS will not fix the security problem because Lineage requires the bootloader to be unlocked. With a locked bootloader, the phone checks to see if the OS has be altered, this is called "verified boot".

This video from TheHatedOne explains verified boot around the 10 minute mark https://invidious.nerdvpn.de/watch?v=WkQ_OCzuLNg

Lineage is good, but may not have updates for the particlar phone, but it may be newer than 2021. If she can afford a new phone at some point, get a Pixel, flash GrapheneOS on it, it can be setup to access all the google stuff if you like; main feature is 5 years of updates are guaranteed.