Android Security State of the Union 2014
(Google):
https://static.googleusercontent.com/media/source.android.com/en/us/devices/tech/security/reports/Google_Android_Security_2014_Report_Final.pdf
"In 2014, the Android platform made numerous significant improvements
in platform security technology, including enabling deployment of full
disk encryption, expanding the use of hardwareprotected cryptography,
and improving the Android application sandbox with an SELinuxbased
Mandatory Access Control system (MAC). Developers were also provided
with improved tools to detect and react to security vulnerabilities,
including the nogotofail project and the SecurityProvider. We
provided device manufacturers with ongoing support for fixing security
vulnerabilities in devices, including development of 79 security
patches, and improved the ability to respond to potential
vulnerabilities in key areas, such as the updateable WebView in
Android 5.0."
- - -
I just finished reading the entire report. I must simultaneously
congratulate Google for their work improving app security on newer
versions of Android -- and I must express my strong disappointment
that the report seems to effectively ignore the impact of
vulnerabilities associated with known WebView bugs affecting vast
numbers of Android users who cannot update their phones to the newer
versions, having been abandoned in this respect by OEMs, mobile
carriers, and/or Google itself. Nor has (as far as I know) Google
reached out proactively to the extremely large number of affected
Android users to warn them of these vulnerabilities and inform them
about potential workarounds that are available in various instances.
--Lauren--
Lauren Weinstein ([email protected]): http://www.vortex.com/lauren
Founder:
- Network Neutrality Squad: http://www.nnsquad.org
- PRIVACY Forum: http://www.vortex.com/privacy-info
Co-Founder: People For Internet Responsibility: http://www.pfir.org/pfir-info
Member: ACM Committee on Computers and Public Policy
Lauren's Blog: http://lauren.vortex.com
Google+: http://google.com/+LaurenWeinstein
Twitter: http://twitter.com/laurenweinstein
Tel: +1 (818) 225-2800 / Skype: vortex.com
_______________________________________________
pfir mailing list
http://lists.pfir.org/mailman/listinfo/pfir
