Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Perimeter

7/26/2007
02:04 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Startup Locks Down Mobile Linux

New version of mobile OS verifies apps, firmware, and encrypts data

A Linux startup today will officially launch a new, secure version of its operating system for mobile phones.

A la Mobile's Convergent Linux Platform (CLP) comes with anti-malware, device-level tamper protection, application sandboxing, and encrypted file system features.

"One of the unique things we're doing is [adding] a root of trust in the device, so that every piece of software must be verified before it executes," says Dirk Sigurdson, senior software engineer at a la Mobile.

While Symbian and Windows today dominate the mobile handset market, Linux is emerging as an alternative: According to ABI Research , around 204 million mobile phones will run on Linux by 2010.

Among the security features in the Linux mobile phone OS are a secure boot loader, which uses a digital signature to verify the kernel at startup; data encryption on all data on the device; application sandboxing, which puts unsigned apps in a separate sandbox; and a secure firmware update, which digitally signs and verifies the "bootloader" before firmware gets updated.

"All data stored in the device is encrypted. You can try to hack it or probe it, but it cannot be [hacked]," says Pauline Lo Alker, president and CEO of a la Mobile. "And the encryption key is protected and stored deep into device's CPU memory."

Lo Alker couldn't say which handset manufacturers will run a la Mobile's secure Linux OS yet. "We are in the thick of a few final touches on our design wins," she says, but a la Mobile is working with major mobile handset makers from Asia.

— Kelly Jackson Higgins, Senior Editor, Dark Reading

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Attackers Leave Stolen Credentials Searchable on Google
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2021
How to Better Secure Your Microsoft 365 Environment
Kelly Sheridan, Staff Editor, Dark Reading,  1/25/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: We need more votes, check the obituaries.
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-3317
PUBLISHED: 2021-01-26
KLog Server through 2.4.1 allows authenticated command injection. async.php calls shell_exec() on the original value of the source parameter.
CVE-2013-2512
PUBLISHED: 2021-01-26
The ftpd gem 0.2.1 for Ruby allows remote attackers to execute arbitrary OS commands via shell metacharacters in a LIST or NLST command argument within FTP protocol traffic.
CVE-2021-3165
PUBLISHED: 2021-01-26
SmartAgent 3.1.0 allows a ViewOnly attacker to create a SuperUser account via the /#/CampaignManager/users URI.
CVE-2021-1070
PUBLISHED: 2021-01-26
NVIDIA Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, L4T versions prior to 32.5, contains a vulnerability in the apply_binaries.sh script used to install NVIDIA components into the root file system image, in which improper access control is applied, which may lead to an un...
CVE-2021-1071
PUBLISHED: 2021-01-26
NVIDIA Tegra kernel in Jetson AGX Xavier Series, Jetson Xavier NX, TX1, TX2, Nano and Nano 2GB, all L4T versions prior to r32.5, contains a vulnerability in the INA3221 driver in which improper access control may lead to unauthorized users gaining access to system power usage data, which may lead to...