{"id":39392,"date":"2021-02-01T15:52:04","date_gmt":"2021-02-01T15:52:04","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31975\/How-Google-Is-Toughening-Up-Android-Security.html"},"modified":"2021-02-01T15:52:04","modified_gmt":"2021-02-01T15:52:04","slug":"how-google-is-toughening-up-android-security","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/how-google-is-toughening-up-android-security\/","title":{"rendered":"How Google Is Toughening Up Android Security"},"content":{"rendered":"
\"Woman<\/span>
<\/p>\n

As many as 59% of security vulnerabilities affecting Android are memory issues.<\/p>\n

<\/span> Image: Getty Images\/iStockphoto <\/span><\/figcaption><\/figure>\n

Google has explained how it is trying to improve Android security, and the steps it is taking to tackle common threats. <\/p>\n

It revealed that 59% of the critical and high-severity security vulnerabilities affecting its Android operating system are memory issues, such as memory corruption and overflows. <\/p>\n

Memory safety issues were by far the top category of security issue, followed by permissions bypass flaws, which accounted for 21% of those that Google security engineers fixed in 2019. <\/p>\n

SEE: <\/strong>Security Awareness and Training policy<\/strong><\/a> (TechRepublic Premium)<\/strong><\/p>\n

Memory issues are generally the top category of security flaw on major platforms like Java<\/a>, Windows 10, and Chrome. Google engineers last year said 70% of Chrome security bugs are memory safety issues<\/a>. Prior to that Microsoft engineers said 70% of all the bugs its fixed in its products were memory safety problems<\/a>, or issues in software that allow access to memory in excess of the memory and addresses that were allocated by the operating system. <\/p>\n

Google today says it is encouraging developers to move to memory-safe program languages such as Java, Kotlin, and Rust, but is also attempting to improve the safety of C and C++. These are part of its efforts to harden Android and protect the OS against malware and exploits.  <\/p>\n

“C and C++ do not provide memory safety the way that languages like Java, Kotlin, and Rust do. Given that the majority<\/a> of security vulnerabilities reported to Android are memory safety issues, a two-pronged approach is applied: improving the safety of C\/C++ while also encouraging the use of memory safe languages,” Google says in a blogpost from the Android Security & Privacy Team<\/a>.<\/p>\n

<\/section>\n

Amazon Web Services (AWS) and Microsoft are also pushing the adoption of Rust for the same security reasons<\/a>. Mozilla created Rust to deal with C++ memory-related security issues in its Gecko engine for Firefox. Version 1.0 of Rust launched in 2015, but adoption is still relatively low. Microsoft is eyeing it for systems programming rather than application development. AWS used Rust to build Bottlerocket<\/a>, its Linux-based container OS. <\/p>\n

In terms of Android, the vast majority of bugs Google has fixed in the past year have been in the media, Bluetooth and NFC components<\/a>. The media library was the key component affected by the critical and remotely exploitable Stagefright bugs in Android that Google disclosed in 2015<\/a>. <\/p>\n

\"image-1.png\"<\/span>