Endpoint

10/10/2017
09:00 AM
Dawn Kawamoto
Dawn Kawamoto
Slideshows
50%
50%

Key New Security Features in Android Oreo

Android 8.0 Oreo marks a major revamp of Google's mobile operating system, putting in a number of new security-hardening measures.
Previous
1 of 8
Next

Image Source: Maria Babak via Shutterstock

Image Source: Maria Babak via Shutterstock

Google is serving up a number of new security features in it new Android 8.0 Oreo - one of which is expected to put it on par with Apple's iOS when it comes to delivering software updates, say security researchers.

Android devices, which are notorious for falling behind on operating system (OS) updates and patches, should have a speedier path to the latest version of the OS under Oreo's so-called Project Treble feature.

"Enterprises will be able to maintain a more up to date fleet of devices that are patched against vulnerabilities that can lead to the loss of data," says Andrew Blaich, security researcher at Lookout.

The downside, however, is that existing devices that are not capable of supporting Android's Project Treble are likely to be left behind. As a result, Blaich adds, enterprises that fall into that camp will need to shell out more money on newer devices to take advantage of the new security features.

Oreo, which launched in August, is available on Google's Pixel and Nexus mobile devices. It will be rolled out in phases by the end of the year to other Android device manufacturers such as, Samsung, Motorola, LG, HTC, and others, according to Google's developers blog.

Most phone vendors are actively porting the Project Treble abstraction layer over to their platforms, says Brian Chappell, senior director of enterprise and solutions architecture for BeyondTrust.

Even so, not all older Android devices updated with Oreo will also have Project Treble support, Blaich cautions.

Here are seven of the hottest new security features in Android Oreo, including Project Treble: 

 

Dawn Kawamoto is an Associate Editor for Dark Reading, where she covers cybersecurity news and trends. She is an award-winning journalist who has written and edited technology, management, leadership, career, finance, and innovation stories for such publications as CNET's ... View Full Bio

Previous
1 of 8
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Mr Phen375
50%
50%
Mr Phen375,
User Rank: Apprentice
10/17/2017 | 4:04:47 AM
Do They Work
I doubt if these security features work.
More Than Half of Users Reuse Passwords
Curtis Franklin Jr., Senior Editor at Dark Reading,  5/24/2018
Is Threat Intelligence Garbage?
Chris McDaniels, Chief Information Security Officer of Mosaic451,  5/23/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Flash Poll
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
[Strategic Security Report] How Enterprises Are Attacking the IT Security Problem
Enterprises are spending more of their IT budgets on cybersecurity technology. How do your organization's security plans and strategies compare to what others are doing? Here's an in-depth look.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-11505
PUBLISHED: 2018-05-26
The Werewolf Online application 0.8.8 for Android allows attackers to discover the Firebase token by reading logcat output.
CVE-2018-6409
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. The module in charge of serving stored files gets the path from the database. Modifying the name of the file to serve on the corresponding ap_form table leads to a path traversal vulnerability via the download.php q parameter.
CVE-2018-6410
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. There is a download.php SQL injection via the q parameter.
CVE-2018-6411
PUBLISHED: 2018-05-26
An issue was discovered in Appnitro MachForm before 4.2.3. When the form is set to filter a blacklist, it automatically adds dangerous extensions to the filters. If the filter is set to a whitelist, the dangerous extensions can be bypassed through ap_form_elements SQL Injection.
CVE-2018-11500
PUBLISHED: 2018-05-26
An issue was discovered in PublicCMS V4.0.20180210. There is a CSRF vulnerability in "admin/sysUser/save.do?callbackType=closeCurrent&navTabId=sysUser/list" that can add an admin account.