Pulser_G2 · Nov 2, 2013 at 02:30 pm

Android 4.4 KitKat Security Enhancements

In addition to the many user-facing improvements in the latest incarnation of Android announced yesterday, there are a number of interesting security improvements, which seem to indicate that Google have not totally neglected platform security in this new release. This article will run through what’s new, and what it means for you.

SELinux in Enforce Mode

In Android 4.4, SELinux has moved from running in permissive mode (which simply logs failures), into enforcing mode. SELinux, which was introduced in Android 4.3, is a mandatory access control system built into the Linux kernel, in order to help enforce the existing access control rights (i.e. permissions), and to attempt to prevent privilege escalation attacks (i.e. an app trying to gain root access on your device).

Support for Elliptic Curve Cryptography (ECDSA) Signing keys in AndroidKeyStore

The integrated Android keystore provider now includes support for Eliptic Curve signing keys. While Eliptic Curve Cryptography may have received some (unwarranted) bad publicity lately, ECC is a viable form of public key cryptography that can provide a good alternative to RSA and other such algorithms. While asymmetric cryptography will not withstand quantum computing developments, it is good to see that Android 4.4 is introducing more options for developers. For long-term data storage, symmetric encryption remains the best method.

SSL CA Certificate Warnings

Many corporate IT environments include SSL monitoring software, which adds a Certificate Authority (CA) to your computer and/or browser, to permit the corporate web filtering software to carry out a “man in the middle” attack on your HTTPS sessions for security and monitoring purposes. This has been possible with Android by adding an additional CA key to the device (which permits your company’s gateway server to “pretend” to be any website it chooses). Android 4.4 will warn users if their device has had such a CA certificate added, such that they are aware of the possibility of this happening.

Automated Buffer Overflow Detection

Android 4.4 now compiles with FORTIFY_SOURCE running at level 2, and ensures all C code is compiled with this protection. Code compiled with clang is also covered by this. FORTIFY_SOURCE is a security feature of the compiler, which attempts to identify some buffer overflow opportunities (which can be exploited by malicious software or users to gain arbitrary code execution on a device). While FORTIFY_SOURCE doesn’t eliminate all possibilities of buffer overflows, it certainly is better used than unused, to avoid any obvious oversights when allocating buffers.

Google Certificate Pinning

Expanding on the support for certificate pinning in earlier versions of Jellybean, Android 4.4 adds protection against certificate substitution for Google certificates. Certificate Pinning is the act of permitting only certain whitelisted SSL certificates to be used against a certain domain. This protects you from your provider substituting (for example) a certificate provided to it under an order by the government of your country. Without certificate pinning, your device would accept this valid SSL certificate (as SSL allows any trusted CA to issue any certificate). With certificate pinning, only the hard-coded valid certificate will be accepted by your phone, protecting you from a man-in-the-middle attack.

It certainly appears that Google have not been resting on their laurels with Android security. This is in addition to the inclusion of dm-verity, which could possibly have serious consequences for people who like to root and modify their devices with locked bootloaders (i.e. which enforce kernel signatures).


_________
Want something on the XDA Portal? Send us a tip!

Pulser_G2

Pulser_G2 is an editor on XDA-Developers, the largest community for Android users. Developer Admin at xda-developers, interested in everything in mobile and security. A developer and engineer, who would re-write everything in C or Assembler if the time was there.
Mario Tomás Serrafero · Mar 27, 2015 at 04:13 pm · 2 comments

Should You Get Wear? Wearer’s Practical Observations

Wear is said to not offer enough for mass adoption, even though its been in the market for over 9 months. I personally have a Gear Live which I purchased 8 months ago, and my experience with it has had its ups and downs throughout my time with it. For the longest time, I was not able to recommend the platform to anyone. Since then, a lot of updates have hit Wear watches, some improving battery life, others changing the...

XDA NEWS
GermainZ · Mar 27, 2015 at 01:15 pm · 2 comments

SlimRoms: Updates on the Horizon

SlimRoms' website has been experiencing technical difficulties for the last month or so, but it's good to know the team is working hard and is still on top of things. The SlimRoms GitHub repos are getting updated with some major changes showing up. Most notably, some projects are getting a new 5.1 branch: lp5.1! A new, revamped and open source website is also in the works, with a look inspired by material design. We also got a tip about an...

XDA NEWS
Emil Kako · Mar 27, 2015 at 12:47 pm · 3 comments

Your Favorite Wireless Charger?

Wireless charging is becoming more and more common as many OEMs are now starting to include this feature in their flagships. There are already dozens of wireless chargers to choose from on the market today, but quality definitely varies. For those of you who charge your devices wirelessly, let us know which charger is your favorite and why.

DISCUSS
Share This