Out of all the Android vulnerabilities so far, and out of all the devices that are not running an up-to-date versions of Android, what's your theory as to why we have yet to discover a large Android botnet?
* No one has really tried.
* Google will remove malicious apps from devices via Play Store if they spread too wide.
* A phone botnet would be pretty lame for ddos, which is what botnets seem to be all about these days. Their connections are unreliable, and utilizing the botnet for more than a few hours would kill it's batteries.
Phone exploits seem to be more about harvesting personal data[1], ransomware[2], and/or adware[3].
1. http://www.zdnet.com/article/this-bank-data-stealing-android...
2. http://www.zdnet.com/article/this-nasty-new-android-ransomwa...
Every day I pass by a couple dozen open wifi networks.
sensors. lots and lots of them, and many of them don't require an explicit permission to access.
if you pay the developers of a few nigh-ubiquitous mobile app dev libraries to let you phone home sensor data while their apps are on, you can probably get some really interesting novel information, and you might be able to find somebody willing to buy a dataset constructed from sensors on 50% of all smartphones.
I can't remember any that were like some of the Windows vulnerabilities of the bad old days, of fully owning the device just from it being on the network. The OS is a lot more locked down too, no install of non-store apps by default, and heavy restrictions on app permissions.
Probably also helps that since they're phones, anything doing the usual botnet activities would result in rapid battery death and the user getting their phone fixed or replaced.
You'd think the Broadcom wifi bug would be an extremely lucrative worm target, but in reality it takes a great deal of effort to make a reliable exploit targeting a single version of a single device.
Until there's a more basic bug that doesn't involve kernel addresses and exact memory layouts etc it's far more profitable for bad actors to deliver their malware via malicious .APK files that users will happily install.
GMS includes the Google Play Store, which they reported this year had 2B monthly active users. The most notable AOSP derivatives that do not run GMS are Amazon's Fire OS and whatever Chinese companies are doing. Whenever you see somebody trying to implement "Android without Google", they are (misguidedly) replacing GMS.
Anyway, GMS on the device auto-updates and works with cloud services to detect and act on malware the user may have installed. This year Google branded this "Google Play Protect". Because GMS doesn't require firmware, kernel, or platform updates to work, Google is able to police the ecosystem effectively.
Also, because all apps are signed by the developer and Google controls the Play Store, its also able to work with developer community to mitigate libraries / sdks that are harmful. The overall end result is harmful apps are only on 0.05% of devices that only install apps from the Play Store (the most common scenario, and the default).
If an Android device has access to the store, Google can check and remove malware from the device. Incidentally, these checks are how Google has a pretty comprehensive view of active vulnerabilities and in devices as well as active exploits being used.
The result is if a user does not enable unknown sources and only installs apps from the Play Store (the default and by far the most common configuration) they have a vanishingly small chance of being infected by malware.
Expect the same rate of updates with Treble certified devices.