Collaborate Disseminate
Posted by Jon Markoff and Sean Smith, Android Security and Privacy Team Integrating security into your app development lifecycle can save a lot of time, money, and risk. That’s why we’ve launched Security by Design on Google Play Academy to help develo… Continue reading Introducing Security By Design
Application development security is a key task when it comes to looking to the future of cybersecurity. A recent industry study shows it is the fastest-growing cybersecurity skill for the year ahead. Demand is expected to increase by 164% over the next five years. Such growth would bump up the total number of job openings […]
The post Why the Demand for Application Development Security Skills Is Exploding appeared first on Security Intelligence.
Continue reading Why the Demand for Application Development Security Skills Is Exploding
On December 11, 2017, Platinum Edge Media and its founder CJ Thompson created National App Day as a way to celebrate how apps have inspired us and changed our culture. The Registrar at National Day Calendar went on to proclaim National App Day to be ob… Continue reading 3 Mobile App Security Recommendations for National App Day
DevOps is a mindset as well as a business tactic. It’s a cultural shift that merges operations with development and employs a linked toolchain to create change. In turn, DevSecOps seeks to merge security into DevOps. This can be helpful for a business seeking both rapid and secure growth. Transforming your DevOps to DevSecOps can […]
The post How to Transform From DevOps to DevSecOps appeared first on Security Intelligence.
COVID-19 has changed the way many people work, as organizations have shifted to remote work to slow the spread. In early May, more than 100 million Americans were working from home, creating an increased need for remote collaboration tools like video conferencing. The use of Webex grew 451% between Feb. 17 and June 14 2020. […]
The post IBM Works With Cisco to Exorcise Ghosts From Webex Meetings appeared first on Security Intelligence.
Continue reading IBM Works With Cisco to Exorcise Ghosts From Webex Meetings
Posted by Kylie McRoberts, Program Manager and Alec Guertin, Security Engineer
Google’s Android Security & Privacy team has launched the Android Partner Vulnerability Initiative (APVI) to manage security issues specific to Android OEMs. The APVI is designed to drive remediation and provide transparency to users about issues we have discovered at Google that affect device models shipped by Android partners.
Android incorporates industry-leading security features and every day we work with developers and device implementers to keep the Android platform and ecosystem safe. As part of that effort, we have a range of existing programs to enable security researchers to report security issues they have found. For example, you can report vulnerabilities in Android code via the Android Security Rewards Program (ASR), and vulnerabilities in popular third-party Android apps through the Google Play Security Rewards Program. Google releases ASR reports in Android Open Source Project (AOSP) based code through the Android Security Bulletins (ASB). These reports are issues that could impact all Android based devices. All Android partners must adopt ASB changes in order to declare the current month’s Android security patch level (SPL). But until recently, we didn’t have a clear way to process Google-discovered security issues outside of AOSP code that are unique to a much smaller set of specific Android OEMs. The APVI aims to close this gap, adding another layer of security for this targeted set of Android OEMs.
The APVI covers Google-discovered issues that could potentially affect the security posture of an Android device or its user and is aligned to ISO/IEC 29147:2018 Information technology — Security techniques — Vulnerability disclosure recommendations. The initiative covers a wide range of issues impacting device code that is not serviced or maintained by Google (these are handled by the Android Security Bulletins).
The APVI has already processed a number of security issues, improving user protection against permissions bypasses, execution of code in the kernel, credential leaks and generation of unencrypted backups. Below are a few examples of what we’ve found, the impact and OEM remediation efforts.
Permission Bypass
In some versions of a third-party pre-installed over-the-air (OTA) update solution, a custom system service in the Android framework exposed privileged APIs directly to the OTA app. The service ran as the system user and did not require any permissions to access, instead checking for knowledge of a hardcoded password. The operations available varied across versions, but always allowed access to sensitive APIs, such as silently installing/uninstalling APKs, enabling/disabling apps and granting app permissions. This service appeared in the code base for many device builds across many OEMs, however it wasn’t always registered or exposed to apps. We’ve worked with impacted OEMs to make them aware of this security issue and provided guidance on how to remove or disable the affected code.
Credential Leak
A popular web browser pre-installed on many devices included a built-in password manager for sites visited by the user. The interface for this feature was exposed to WebView through JavaScript loaded in the context of each web page. A malicious site could have accessed the full contents of the user’s credential store. The credentials are encrypted at rest, but used a weak algorithm (DES) and a known, hardcoded key. This issue was reported to the developer and updates for the app were issued to users.
Overly-Privileged Apps
The checkUidPermission method in the PackageManagerService class was modified in the framework code for some devices to allow special permissions access to some apps. In one version, the method granted apps with the shared user ID com.google.uid.shared any permission they requested and apps signed with the same key as the com.google.android.gsf package any permission in their manifest. Another version of the modification allowed apps matching a list of package names and signatures to pass runtime permission checks even if the permission was not in their manifest. These issues have been fixed by the OEMs.
Keep an eye out at https://bugs.chromium.org/p/apvi/ for future disclosures of Google-discovered security issues under this program, or find more information there on issues that have already been disclosed.
Acknowledgements: Scott Roberts, Shailesh Saini and Łukasz Siewierski, Android Security and Privacy Team
Continue reading Announcing the launch of the Android Partner Vulnerability Initiative
Twitter has fixed a caching issue that could have exposed developers’ API keys and tokens. Continue reading Twitter Warns Developers of API Bug That Exposed App Keys, Tokens
The flaws are disclosed as Oracle reportedly partners with TikTok as concerns in the U.S. over spying continue. Continue reading TikTok Fixes Flaws That Opened Android App to Compromise
Apple released a new tool for developers that aims to better protect the user data that flows through iOS apps. The company’s App Attest API, a new software tool meant to “protect against security threats to your app on iOS 14 or later, reducing fraudulent use of your services,” according to an Aug. 3 bulletin to developers. App Attest API generates a cryptographic key on a user’s device that aims to authenticate that an app is what it appears, and ensure that a phone isn’t transmitting user data to a fraudulent app designed to steal their usernames and passwords or other information. Security researchers specializing in iPhones have long said that it’s difficult to determine whether hackers have successfully breached an individual device, in part because of the way Apple limits visibility onto its machines. If an app is trying to exceed its authorized permissions, it’s a challenge for forensic […]
The post Apple’s Attest API tool aims to tighten app security appeared first on CyberScoop.
Continue reading Apple’s Attest API tool aims to tighten app security
IBM X-Force has reported a huge increase in COVID-19-related spam. Malicious domains have also rapidly expanded during the first quarter of 2020. Focus on Security Fundamentals One of the key fundamental approaches for security is to ensure your security team can identify, investigate and respond to threats. We recommend mining network data to help identify potential […]
The post Focusing on the Fundamentals of Network Security appeared first on Security Intelligence.
Continue reading Focusing on the Fundamentals of Network Security