(credit: Guardian Project)
A startup on a shoestring budget is working to clean up the Android security mess, and has even demonstrated results where other “secure” Android phones have failed, raising questions about Google’s willingness to address the widespread vulnerabilities that exist in the world’s most popular mobile operating system.
“Copperhead is probably the most exciting thing happening in the world of Android security today,” Chris Soghoian, principal technologist with the Speech, Privacy, and Technology Project at the American Civil Liberties Union, tells Ars. “But the enigma with Copperhead is why do they even exist? Why is it that a company as large as Google and with as much money as Google and with such a respected security team—why is it there’s anything left for Copperhead to do?”
Copperhead OS, a two-man team based in Toronto, ships a hardened version of Android that aims to integrate Grsecurity and PaX into their distribution. Their OS also includes numerous security enhancements, including a port of OpenBSD’s malloc implementation, compiler hardening, enhanced SELinux policies, and function pointer protection in libc. Unfortunately for security nuts, Copperhead currently only supports Nexus devices.