Android has stepped its game up mitigation-wise in the new Jelly Bean release," security researcher Jon Oberheide wrote in an analysis published this week.
Oberheide notes that the central difference between Jelly Bean and other Android systems is that it incorporates Address Space Layout Randomization (ASLR), which randomizes locations in the devices' memory, along with another security feature called data execution prevention (DEP).
This is crucial because one way hackers tend to break into handsets is via memory corruption bugs, according to Ars Technica, which first reported this news. When ASLR is combined with DEP, these types of attacks can be defeated because hackers cannot locate the malicious code in the device's memory.
Besides ASLR and data execution prevention, Jelly Bean also has defenses against information leakage, buffer overflows, and additional memory vulnerabilities. However, according to Oberheide, Android has not yet added code signing, which would help fortify against unauthorized applications running on the device.
Apple's iOS already has code signing, ASLR, and DEP.
"While Android is still playing a bit of catch-up, other mobile platforms are moving ahead with more innovation exploit mitigation techniques, such as the in-kernel ASLR present in Apple's iOS 6," Oberheide wrote in the analysis. "One could claim that iOS is being proactive with such techniques, but in reality, they're simply being reactive to the type of exploits that typically target the iOS platform. However, Apple does deserve credit for raising the barrier up to the point of kernel exploitation by employing effective userspace mitigations such NX, ASLR, and mandatory code signing."
by Dara Kerr
No comments:
Post a Comment