Risk
1/17/2012
02:14 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

NSA Releases Secure Android Version

National Security Agency publicly releases SE Android, a secure version of Google's Android platform that delivers app isolation and related security meausres.

The National Security Agency has made its first public release of SE Android, a secure version of Google's Android platform.

SE Android aims to close Android's security gaps by isolating apps from one another, mitigating problems with flawed or malicious apps, instituting permission and other security checks, restricting use of system facilities by apps, and taking related steps.

The project is based on SE Linux, a security-hardened version of Linux which the NSA initially released in 2000. Numerous parts of SE Linux were eventually integrated into the official Linux kernel and other Linux-based platforms. Android, too, is powered by Linux, so the fit is somewhat natural.

First announced at the Linux Security Summit in September, SE Android remains in early stages. There are not yet any pre-compiled builds of SE Android, so installation is anything but simple at this point. Those wishing to use SE Android will, for now, have to follow directions posted on the project's Web page. However, Android developers have already hit developer bulletin boards to discuss plans to release packaged versions.

One big focus of SE Android is application security. Application-level permissions control access to application components and system resources. A big change from SE Linux is that SE Android switches from Discretionary Access Control, which lets users set permissions, to Mandatory Access Control, which does not. This can, for example, prevent malicious apps from running processes that wipe a device of all data.

Sandboxing and process isolation also play large parts. Android SE isolates applications from one another and the system--unlike many apps on Google's Android Market that have broad permissions to access other apps and device elements like Bluetooth and the camera. Sandboxing prevents bypass of the application-level controls as well.

The NSA doesn't consider SE Android to be a panacea, according to a presentation from the Linux Security Summit, which cautions that SE Android is not a cure-all to mitigate all kernel vulnerabilities.

How 10 federal agencies are tapping the power of cloud computing--without compromising security. Also in the new, all-digital InformationWeek Government supplement: To judge the success of the OMB's IT reform efforts, we need concrete numbers on cost savings and returns. Download our Cloud In Action issue of InformationWeek Government now. (Free registration required.)

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2017-0290
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

CVE-2016-10369
Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

CVE-2016-8202
Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

CVE-2016-8209
Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

CVE-2017-0890
Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.