Android security is most times mostly about putting contradictory terms together in one breadth. It is not uncommon to talk about how secure Android is while at the same time knowing that a bug like the Stagefright is still a threat in a supposedly secure program. But lately Android has being putting in a lot to make sure that in spite of those inherent threats in the operating system, Android devices would never experience security melt downs on a large scale. Point is, the threats are likely to be always there, but containment before they get out of hand is the mantra .
One of the measures Android has put in place is the ability for users of Android devices to easily check the current status of their softwares. That is, in terms of how secure the devices are. It works like this basically, every month, Google releases an update that fixes the latest security problems noticed. These problems can be reported to them by just about anybody or through the Google bounty program. Nexus devices get these security patches first. Other devices would have to wait for their OEMs to post the updates to them. All responsible OEMs make sure they do it.
It was two months ago that the latest Android Security Report was released. The annual report was instituted last year to inform the developers and the public in general about the security status of Android. This year’s was the second report. As expected, the report paints a very optimistic picture. The dominant theme is that Android is safe. And the Android security team is on top of the situation as far as checking for threats in all aspects of the Android ecosystem are concerned.
If your device is an Android device, you should be very interested in the work that Adrian Ludwig, Lead Engineer of Android Security and his team are doing to secure our devices. The optimistic blog post of the annual report started off with the imperative for the report:
One important goal of releasing this report is to drive an informed conversation about Android security. We hope to accomplish this by providing more information about what we are doing, and what we see happening in the ecosystem. We strongly believe that rigorous, data-driven discussion about security will help guide our efforts to make the Android ecosystem safer.”
However, before the informed conversation on Android security starts, we have to look at the key points of what the security team has being up to in the last one year.
- Over six billion installed apps are checked everyday for malwares and other harmful bugs. Apps are also screened to make sure they are not bugs in disguise (PHAs)
- 400 million devices are scanned each day to protect users from bugs transmitted over local networks and hardwares
- The safe browsing feature in Chrome protected hundreds of millions of users from the threats posed by malicious websites (kudos on that, but I wished they’d also spent the same amount of time and resources on power saving features)
Potentially Harmful Apps (PHAs) are getting a special mention as it seems these apps are now the easiest way to infect Android devices with bugs. The report indicated that more time and resources were spent in scanning apps to weed out the PHAs. The result is that only 0.15‰ of devices erroneously got these apps from Play store. Also the Verify Apps service does its best to protect Android users who like installing apps from other sources apart from Play store. The Android security team noticed an increased number of PHAs attempting to install in Android devices from third party sources. Many of these attempts were disrupted.
Google Marshmallow and all the new security features in it got a special mentioned in the blog post. For a full report, you can download the 32 page file here to grasp the whole picture of what the Google security team did in the last one year.
The bottomline is, this is something Google had to do. The company cannot run away from the fact that in security comparison with their biggest rival, iOS, Android always comes out second best. The issue for them is to be constantly ahead of threats to their OS. But having an OS as secure as iOS would be almost impossible. The point is, as an open source program used by over 90% of OEMs, enforcing uniform standards is almost impossible. To cut cost, some manufacturers definitely cut corners to maximize profits. Unfortunately, security is one of the first variables to suffer the consequences. The best Google can do is to keep doing what they have being doing better.
photo credit: telegraph.co.uk; techtimes.com; cnbc.com; slashgear.com