Online security has being in the news a lot lately. The latest statement from Qualcomm that it showed Google’s Android how to fix an encryption flaw over a year ago is going to leave a sour taste in the mouth of most people (including mine) because did not do something to implement it.
It was just last month we did a report on the work the Android Security Team is doing to make our Android devices more secure. There was an overall sense that Google’s Android Security Team is doing all it can to make sure bugs and hackers are pushed out of Android OS.
But apparently, they are on doing enough. Is that why we keep hearing about bugs like the Stagefright exploit and others that have come to light recently?
The gist of this vexing matter is that in November 2014 and February last year, Qualcomm, makers of the Snapdragon chipset, informed Google about an exploit in Android devices using Qualcomm’s chipset. And also how to fix the issue.
However, it was only in January and May of this year that Google decided to release the patches for the problems known as CVE-2015—6339 and CVE-2015—2431. So that begs the question of why it took Google such a long time to implement the patches. It wasn’t as if Qualcomm were professional hackers seeking for a slice of Google’s Bug Bounty program.
This latest revelation all came to light because Gal Beniamini, a security researcher (also known as white hat hacker) showed how millions of Android devices are at risk. His work focused on handsets with Qualcomm processors.
The vulnerability is directly related to full disk encryption on these devices. And it affected only devices on Android Lollipop and later. That means the latest Android devices. Remember, they are supposed to be the most secure devices running the Android OS.
The process of using the exploit to decrypt an Android device is a bit complex. But in summary it goes like this: the encryption keys of Qualcomm-based Android devices are stored in the software of the phones, making it easier to exploit.
Compare this to the iPhone whose encryption keys are stored in the hardware of the phone. Which was why there was a lot of hot air when the FBI couldn’t unlock an iPhone and demanded for the encryption keys from Apple.
Nobody would have heard of the FBI’s attempt to unlock a terrorist’s iPhone if the security features were embedded in the phone’s software. It would have being easy to unlock it with sophisticated software.
Beniamini explained the process in a detailed blog post last week. The conclusion of his post is spot on:
Full disk encryption is used world-wide, and can sometimes be instrumental to ensuring the privacy of people’s most intimate pieces of information. As such, I believe the encryption scheme should be designed to be as “bullet-proof” as possible, against all types of adversaries. As we’ve seen, the current encryption scheme is far from bullet-proof, and can be hacked by an adversary or even broken by the OEMs themselves (if they are coerced to comply with law enforcement).
I hope that by shedding light on the subject, this research will motivate OEMs and Google to come together and think of a more robust solution for FDE. I realize that in the Android ecosystem this is harder to guarantee, due to the multitude of OEMs. However, I believe a concentrated effort on both sides can help the next generation of Android devices be truly uncrackable.”
Sometimes, I can appreciate the problem Google is facing to make an open source program like Android very secure. Fact is, Google cannot control how other OEMs approach the problem of pushing out security updates.
The latest post by Android Security Team is an attempt to effectively coordinate how security updates are pushed out to all Android devices . In the post, the Android team announced a series of updates for Nexus devices that would fix several security concerns. Also, other manufacturers are not left out in this update to fix the security issues.
Google and Android are trying, but it seems their best is not good enough so far.
image credits: androidheadlines.com: endgadget.com; prolinkedmag.com; bidnessetc.com