Security and Android Lollipop

By now people have heard that the next version of Android, up to now being called "L" has a name and version number:  5.0 Lollipop.  It should be going out now to Nexus devices, no idea the schedule for others.

And with any new version of Android, we have to wonder about the security features of it.  Over the last few versions, we've seen Google make Android more secure and more "enterprise ready".  The biggest part of this was integration of some of Samsung's Knox product.  (which is kind of disappointing, as Google had the opportunity to integrate 3LM's work, which came from former Google engineers).

Apple's TouchID on the iPhone 5S

Since the Apple iPhone 5S has come out, I've read a few articles on one new feature of the phone, the TouchID fingerprint recognition system.  This is not the first time that fingerprint systems have been used in either smartphones or in technology devices, but I think this is the first time to put it in a system of more mass consumer use.

I recall that several laptops over the years have included a fingerprint system.  My current laptop has one, tho I don't use it.  With smartphones, the Motorola Atrix 4G has it.  I used the phone for awhile, and it seemed to work ok, tho when a new version of Android was rolled out, it no longer worked.  That was part of the problem.  With the iPhone 5S, fingerprint recognition is actually built into iOS7, and is not an add-on service or like with the Atrix 4G or with various laptop.

But people will keep trying to added fingerprint systems to devices.  I even have a USB thumbdrive that has a fingerprint system in it.

Thing is, fingerprint recognition is tricky.  There are a lot of potential issues, especially as the finger can get dirty, which can affect the effectiveness of the scanner.

Why people want to use them is pretty clear.  When it comes to authentication, there are 3 factors that can be used:

• "what you know" (passwords, other information)
• "what you have" (hardware tokens)
• "what you are" (biometrics: fingerprint, handprint, iris scan)

A system that uses more then one factor is considered more secure.  Thus, your basic login system which uses username & password is actually using "what you know" twice.  Whereas if you had a "what you have" such as a hardware token or a one-time code sent to your phone is considered more secure.

Biometrics is more tricky.  But its getting better.  I recall at a college I was at tried a handscan system for the cafeteria, but due to issues dropped it for an ID card.  I think the face scanner ideas are interesting.

Another factor that people are really considered about is the privacy issues.  People are concerned that Apple will be able to pull their fingerprints from their phones.  Something to look into further.

This is a work in progress, and I plan to return to this topic.

Currently reading: Android Application Security Essentials

I wouldn't ordinarily do this, but I am currently reading Android Application Security Essentials by Pragati Ogal Rai and published by PackT Publishing.

(you can check out the book here:   http://bit.ly/15mnEus)

Seeing as how more and more people are moving the mobile devices (smartphone and tablets) not just as a secondary device but sometimes a primary device, security applications on these devices becomes more and more important.  This book aims to address it.  I am still reading it, but what I've read it pretty good.  Even if your focus is not application development, this will help your understanding of Android security.

Once complete, I hope to do a full review here.  In the meantime, check out the publishers other works.  I've seen several that have caught my eye.

The new version of Android- 4.4 Kit Kat

By now, I think most people know that the new version of Android is 4.4, and is called "Kit Kat".  Yes, the candy.  Most people thought the next version would be 5.0 and that it would be called "Key Lime Pie".  For those not aware, major versions of Android have been named after deserts, and in alphabetic order.  The next letter would be "K", and the rumors was it would be "Key Lime Pie".

Now that Google has released it, we now more about it.  It seems we don't have a lot of new flashy features, but more fundamental improvements.

Filling the void of Blackberry

By now, I think more people are aware of what's going on with RIM/Blackberry.  For most people, it was a matter of who they would be bought out by and when.

When RIM rolled out the Blackberry many years back, its focus was on the business user.  This user needed something relayable and SECURE.  But when the iPhone hit (and later Android), even tho these devices were less secure than Blackberry, they had features that Blackberry lacked and was hard to catch up: the array of applications.

Now, some tried to bring iPhones and Androids up to the level of Blackberry, to be able to compete for the business user.  For a period of time, Motorola Mobility had an array of products that made their phones more acceptable to the business user.  They had bought out 3LM (mentioned in a prior posting) to make Android more secure.  Their "webtop" on their high end phones was another addition aimed at the business user.  This was a stripped down Linux OS with added features that would turn the phone into a "laptop" if connected to an HDMI device and keyboard (say thru one of their docking stations) or plugged into one of their "lapdocks" which gave a netbook-sized screen and keyboard.  Sadly, when Google bought Motorola Mobility, all that would be dropped as Google wanted the new division to instead focus on the larger consumer market.

Thus, it was left to others to step into the field.  Samsung has already done so to a degree with their Knox security add-on to Android (again, see my prior posting).  Now they seem to have extended this with their SAFE (Samsung for Enterprise) effort.  As higher security for such devices is important, this bearing watching.

See article HERE.

New Security features of Android 4.3

The new version of Android rolled out, 4.3 Jelly Bean, also brings new security features.

By most count, it seems there are 7 security features rolled out.

1.  First off, we have Restricted Profiles.  This is a feature ONLY for tablets, as these are devices that are often shared among people, especially family members.  This allows for different profiles to be setup, some with restrictions, for, say, children.   More on this HERE.

2.  Next there is strengthening of encryption.  This includes tools to make sure neither hackers or other malicious entities can access the keys.  There are a new set of APIs for this, known as the Keychain/Keystore system API.

3.  There is a Nousid command that makes sure no program can obtain root privileges by setting the setuid bit.  The /system partition is also better secured as part of this.

4.  The new Find My Phone app (Android Device Manager) can be used to find/locate a lost or stolen device.  And the user can use this to remotely manage, lock, or wipe clean the device.  This I find interesting, as this is a service that many obtain thru MDM systems.  For a corporate user, this is usually part of such a corporate MDM system, run by their company admins.  For the individual user, one can obtain their own such service from third parties.  So I would think this would compete against that more so then the corporate MDM.  But could this be a competition for the corporate MDM systems?  Here is more info on this feature.

5.  Again, something that is not actually in Android, there is the Verify Apps feature that is part of Google Play.  I already blogged about this in a previous posting.  This should extend the protection of Bouncer, but we've already see Bouncer failing (see my previous postings).  So while Google seems to feel that such things (Bouncer and probably Verify Apps) negates the need for anti-malware apps on Android, I am a bit skeptical of this.

6.  They have activited within Android SELinux.  Now, many may not realize that Android is actually built on Linux.  SELinux is "Security Enhanced Linux", which adds mandatory access controls (MAC) to the Linux kernal.  For more on SELinux, go to the project page HERE.

7.  Finally, there is new WPA2 Wi-Fi security capabilities.  This isn't something the end user can use, but only programmers.  It allows for the use of the new WPA2 (Wi-Fi Protected Access 2) features of Wi-Fi.

These are pretty nice set of additions.  I would like to see how the security of Android 4.3 compares to the latest versions of iOS and Windows Phone.  Not seen a side-by-side comparison.  If any know of one, I'd like to know.

On a related note, I came across THIS article at the Official Google blog on securing your Android phone. They basically give 3 tips:  1) screen lock, 2) be secure on apps you install, but Bouncer & Verify Apps will protect you, and 3) used Find My Phone to be able to find and/or wipe your phone.


I used this article for the source of this posting: HERE  Another good resource I found is HERE.

Google's new "Verify Apps" service makes Android more secure

Along with the recent release of a new version of Android, 4.3, Google also rolled out a new service that promises to make Android more secure.

The Verify Apps service was originally rolled out as part of Android 4.2.  But now its been pulled out of Android itself and made part of the Google Play Store service, along side the already existing Bouncer service.  By doing so, all versions of Android can take advantage of this.

I learned about this thru THIS posting at Computerworld.

So, what DOES this new service do?  Its a universal app-scanning system.  It watches for new apps on your system, even those loaded directly from outside the Google Play Store ("sideloaded"), and instantly checks that app for malicious or potentially harmful code.

While I think this is great, I'm not sure I buy into the views of this writer of the blog posting that this somehow eliminates the need of anti-malware apps on Android.  While, yes, there is a bit of fear mongering on the part of the anti-malware field (true of a lot within the security field), the fact is we've seen an increase in Android malware.  Plus, one can get a large number of free anti-malware apps, so its not like you have to pay a lot of money to protect yourself.

On a practice point, we've seen failures with Bouncer.  Who's to say that similar issues won't been seen with Verify Apps?  Plus, like I think most security professionals, I prefer multi-level security measures.  It's a mistake to rely on one or a limited number of tools to protect our systems.  It would be like a company thinking that since they have firewalls, they need not worry about anti-virus or the like.

I do like the idea of "Android deconstruction" mentioned by the writer (further covered in THIS posting), with Google pulling out certain elements from Android itself, and making them available as separate apps, thus avoiding the issue of Android upgrading.  There are limits to this, as not everything can be an app, but maybe this will help make Android be a more core OS, that can be more easily upgraded.

New version of Android out

I don't think I will surprise anyone by saying that there is a new version of Android out there:  4.3.

And so, we will have everyone all worked up about it, and wondering when they will get this on their phones.  (which I can understand.  Both my phone and tablet are still at 4.1.2).

I guess its a good idea to perhaps review all this.

UPDATE: Android "Master Key" Security issue

Some updates on the Android "Master Key" issue brought up by Bluebox Security.

Per THIS article at TechCrunch, Google has patched the issue.

HOWEVER, before anyone starts to think this is over, keep in mind this means that Google has created a patch and given it to their partners.  THEY then need to test this patch with their released versions of Android for their devices (and realize that this issue goes back to earlier versions of Android which most manufacturers are no longer patching).  And THEN they will release the patch to the carriers so they can test it before its released.  This isn't like Windows Update.

As noted, most of the manufacturers are only maintaining the newer versions of Android they've released (usually just Jelly Bean), so who knows what this means for those stuck at prior versions.

Also, Bluebox has created a scanner that will tell you if you Android device is vulnerable.  I thought THIS article was a pretty good response to that news.

New Android Security hole

So am not the first to bring this to others attention.  I've seen several articles on it over the last week on the Android "Master Key" vulnerability.

Basically, researchers at Bluebox Security have found this security hole that has been present in all version of Android since v1.6.  The firm informed Google about this in February.  The Samsung Galaxy S4 supposedly has been patched for it.  No word on any other Android device.

More information on it will be forthcoming at the Black Hat Security Conference.  But for right now, you can check out their blog posting HERE on it.

Now, a basic thing about this issue is that it is exploited by malicious apps.  And malicious apps, despite tools like Bouncer in the Google Play Store, can still be put up there.  Patching Android is always a tough thing, because the process has to include both the manufactors and the carriers.  According to a recent item on CIO, Google has already updated Play Store to block apps that take advantage of the issue.  But I hope people see that as only a stop gap to getting the Android OS itself patch.

For those interested, here are the articles I've see so far on this:

Bluebox Blog
Techcrunch
Android Central
CIO

Android malware disguised as anti-malware software

Something I don't think a lot of security professions are aware of is the trend of users being tricked by fake anti-virus/anti-malware software that is really malware!  (apparently we now have a term for this: scareware)  People are so concerned about getting infected, that they install software they think will protect them, when, in fact, its infecting your system.

A recent presentation I was at said that the largest vector for Macintosh malware is via such fake anti-malware apps.  And, per another article, there is way more fake anti-malware on Windows then on Mac.  Big surprise.

And it shouldn't be a big surprise that the bad guys are doing the same on smartphones as well.

HERE is a great posting at Sophos' Naked Security blog on a deep examination of one such fake anti-malware on the Android platform.  Check it out.  A good read, with some great information.

Failure of Bouncer

In a previous posting, I mentioned Bouncer, Google's service within the Google Play Store that is supposed to keep out malware.  This is important, because the Play Store does not vet new apps to the level that Apple's App Store does, meaning that Google Play becomes one of the biggest vectors for malware to get into Android phones.

Well, per a recent article at ArsTechnica, someone figured out how to get around this.  I discovered this thru an article at TechRepublic.

Apparently how they did it was upload an app to Google that was ok, which was checked by Bouncer.  Then they uploaded a new version of that app, this one with the malware.  Now, I have to wonder why Bouncer didn't re-check it.  Wouldn't that malware app be different (different size, atleast a new update date), and thus Bouncer would re-examine it?  Seems its not setup that way.  Certainly a new upload, if its not a new size, should trigger a recheck.

Apparently some 9 million user got it.  Upsy.

Check out the article at TechRepublic.  I thought it had some pretty good points, similar to what I've been saying, on the need for better security stance when it comes to Android.  A big part is that we need to get more people to install AV software (ok, they are really anti-malware, but still) on their phones.  Stop giving people the impression these devices are totally secure, and take practical security in mind.

Review: Android Security

I recently picked up a new book on Android security.  Looks to be the only (so far) book on the topic, so they have kind of set the bar for subsequent works.  The book is Android Security: Attacks and Defenses by Anmol Misra and Abhishek Dubey (CRC Press, ISBN 978-1-4398-9659-4).  They have an accompanying website and blog, www.androidinsecurity.com where there is also resources from the book.  (but there's not much traffic on the blog, hope this changes.)

Having read over it, I have to give it an overall grade of B+.  (or if you prefer, 4 out of 5 stars).

3LM- what could have been

This posting may be a little different from what you might expect on a security blog.  One subject I've loved is history.  This means that often times I am interested in the history or development of technology or ideas in other areas I am involved in.  So this posting will take a look at the history and what could have been with one company.

3LM, 3 Laws Mobility, is (or I guess now was) a small firm involved in the overall Android MDM marketplace.  The name, an alusion to Asimov's "Three Laws of Robots", stood for the guiding principles of the company:

Protect your user. A mobile device may not harm its user or, through inaction, allow its user to come to harm though malicious code or content.

Protect yourself. A mobile device must protect itself and the integrity of its data and secured communications.

Obey. A mobile device must let the user use the device freely, as long as such usage does not conflict with the First or Second Law.

The company's product was not something that was sold to the end users or to enterprises.  It made changes to the Android OS, and so would be something the device manufactorers would encorporate into their builds of Android on their devices.  This would extend and enhance Android, making it easier to be managed by other products.

Frankly, stuff that probably should have been in Android in the first place.

Mini Android PC

In a previous entry, I pointed out some of the interesting mini-computers that are now out there.  The most well known of these are the Rasberry Pi and the BeagleBoard.  These mainly run Linux, tho there is work being done to put other OSs on them.

I think from a research perspective, these give some interesting avenues of investigation for security matters.  Especially at such low cost, one could have several devices to test against.  Instead of having a rack of full blown PCs, one could have several such mini PCs.

For those wanting to research Android security, things seem kind of slim.  I don't like the idea of using my own smartphone for such work, tho I could see using a separate pre-paid Android phone for this.  But that could still get costly.

Android security books, finally

Ok, I will admit to being a bibliophile.  I love books.  When it comes to systems support, I like having the official manual and materials, alongside the best "unofficial" works.  These, I find, usually help me find the answers I need.  On-line resources are great, but it can be a bear to have to search thru so much to find an answer.

In the area of Android, there has been several books on developing apps for Android, but nothing (so far) on Android security.

Well, what seems to be the first of what looks like several works, we finally have an Android security book. I haven't gotten a copy yet, but hope to.

Google Glass security

I think for any IT person, you have probably heard about Google Glass, Google's latest hi-tech gadget.

Not yet on the market, its now out in the hands of several, for lack of a better term, beta testers.  (heck, considering who I worked for, I had hoped that group I was in might be able to test it out as well, and I might be able to try it out.  Won't happen now.) 

I've seen a lot of articles on Glass, how useful it will (or won't) be.  I've even seen stuff on Glass 'etiquette'.  (hey, you're basically strapping a video camera to your face!)

What I haven't seen much about is security.  Why should I not be surprised?

ACLU sues carriers over updates for Android

I came across this item from last month that made me go "say what?!?"

ACLU sues carriers over Android updates.

Wow.

So why care about this from a security standpoint?  Well, delays in updates leave Android phone vulnerable to hackers.  It also leads to some taking matters into their own hands to update their phones themselves, which also makes their phones vulnerable.   Neither option is good.  Damned if you do, damned if you don't.

As an Android user, I can understand this.  My phone is still at 4.1.2, when the latest is 4.2.2.

And the process of updating Android phones is complex.  More so then some people think.  It's not like when MS has an update to Windows.   Google releases a new version (after its been released for Nexus phones) to manufacturers, who must modify and test it on their phones, then turn it over to the carriers for their testing and verifying before it gets released to user's phones.  The whole process delays things longer then most people would like.  And there is no guarantees that a new, official, version will be provided for your particular phone.

It remains to be seen if this improves things or not.

We'll have to keep an eye on this.

Smartphone security

Smartphone security is a topic I've had an interest in for several years.

It doesn't help that for my entire IT Security career I've worked for a major cell phone company.  During that time, I've seen the emergence of smartphones.  I had one of the early Windows-based phones, which was nice (tho limited).  Later I moved to an Android phone, which was even better.  (so far I've gone thru 3 Android phones)

And I've watching how things have changed.  Early on at the company, we saw our executives make use of smartphones not just as a companion item (like the early PDAs), but almost as a replacement for their desktop/laptop computer.