Who's left behind?

Abstract

This work presents a large-scale, longitudinal measurement study on the adoption of application updates, enabling continuous reporting of potentially vulnerable software populations worldwide. Studying the factors impacting software currentness, we investigate and discuss the impact of the platform and its updating strategies on software currentness, device lock-in eects, as well as user behavior. Utilizing HTTP User-Agent strings from end-hosts, we introduce techniques to extract application and operating system information from myriad structures, infer version release dates of applications, and measure population adoption, at a global scale. To deal with loosely structured User-Agent data, we develop a semi-supervised method that can reliably extract application and version information for some 87% of requests served by a major CDN every day. Using this methodology, we track release and adoption dynamics of some 35,000 applications. Analyzing over three years of CDN logs, we show that vendors' update strategies and platforms have a significant eect on the adoption of application updates. Our results show that, on some platforms, up to 25% of requests originate from hosts running application versions that are out-of-date by more than 100 days, and 16% more than 300 days. We nd pronounced dierences across geographical regions, and overall, less developed regions are more likely to have out-of-date software versions. Though, for every country, we nd that at least 10% of requests reaching the CDN run software that is out-of-date by more than three months.

50 Shades of Support: A Device-Centric Analysis of Android Security Updates

“…Wu et al [82] analyzed Android system vulnerabilities and the patching behavior through code pattern analysis. Finally, the studies in [23], [36], [43], [55] focused on the app update behavior of Android users.…”