After months of anticipation, both the Samsung Galaxy S6 and HTC One M9 have finally been unveiled. Now that we have all seen both of the devices in all their glory, many of us have some decisions to make. Which of the two beasts do you prefer: the Galaxy S6 or the One M9? Let us know which device you plan on buying and why!
Android 4.4 KitKat Security Enhancements
In addition to the many user-facing improvements in the latest incarnation of Android announced yesterday, there are a number of interesting security improvements, which seem to indicate that Google have not totally neglected platform security in this new release. This article will run through what’s new, and what it means for you.
SELinux in Enforce Mode
In Android 4.4, SELinux has moved from running in permissive mode (which simply logs failures), into enforcing mode. SELinux, which was introduced in Android 4.3, is a mandatory access control system built into the Linux kernel, in order to help enforce the existing access control rights (i.e. permissions), and to attempt to prevent privilege escalation attacks (i.e. an app trying to gain root access on your device).
Support for Elliptic Curve Cryptography (ECDSA) Signing keys in AndroidKeyStore
The integrated Android keystore provider now includes support for Eliptic Curve signing keys. While Eliptic Curve Cryptography may have received some (unwarranted) bad publicity lately, ECC is a viable form of public key cryptography that can provide a good alternative to RSA and other such algorithms. While asymmetric cryptography will not withstand quantum computing developments, it is good to see that Android 4.4 is introducing more options for developers. For long-term data storage, symmetric encryption remains the best method.
SSL CA Certificate Warnings
Many corporate IT environments include SSL monitoring software, which adds a Certificate Authority (CA) to your computer and/or browser, to permit the corporate web filtering software to carry out a “man in the middle” attack on your HTTPS sessions for security and monitoring purposes. This has been possible with Android by adding an additional CA key to the device (which permits your company’s gateway server to “pretend” to be any website it chooses). Android 4.4 will warn users if their device has had such a CA certificate added, such that they are aware of the possibility of this happening.
Automated Buffer Overflow Detection
Android 4.4 now compiles with FORTIFY_SOURCE running at level 2, and ensures all C code is compiled with this protection. Code compiled with clang is also covered by this. FORTIFY_SOURCE is a security feature of the compiler, which attempts to identify some buffer overflow opportunities (which can be exploited by malicious software or users to gain arbitrary code execution on a device). While FORTIFY_SOURCE doesn’t eliminate all possibilities of buffer overflows, it certainly is better used than unused, to avoid any obvious oversights when allocating buffers.
Google Certificate Pinning
Expanding on the support for certificate pinning in earlier versions of Jellybean, Android 4.4 adds protection against certificate substitution for Google certificates. Certificate Pinning is the act of permitting only certain whitelisted SSL certificates to be used against a certain domain. This protects you from your provider substituting (for example) a certificate provided to it under an order by the government of your country. Without certificate pinning, your device would accept this valid SSL certificate (as SSL allows any trusted CA to issue any certificate). With certificate pinning, only the hard-coded valid certificate will be accepted by your phone, protecting you from a man-in-the-middle attack.
It certainly appears that Google have not been resting on their laurels with Android security. This is in addition to the inclusion of dm-verity, which could possibly have serious consequences for people who like to root and modify their devices with locked bootloaders (i.e. which enforce kernel signatures).
Want something on the XDA Portal? Send us a tip!
Samsung's Unpacked Event has now come and gone through Mobile World Congress 2015, and we've got a good look at what could be the most advanced phone of the year thus far. The event started shortly after its scheduled time at 12:30PM today and the only devices shown were the Galaxy S6 and its Edge variant, both of which pack an impressive amount of features, spectacular internals and an all-new beautiful design. The show began with a quiet voice whispering to...
Each year, smartphone makers attempt to one-up each other in features and specs, but time and again these improvements feel incremental rather than revolutionary. Samsung hopes to break this trend with a new hardware and software design philosophy, and press details of the new-and-improved cameras shared by the S6 and S6 Edge show that they are off to a great start. Once you get past the curved displays and wraparound Gorilla Glass 4, the most striking feature on these slabs is the...