Keeping Android safe: Security enhancements in Nougat

. . No comments:
Keeping Android safe - Dans les versions précédentes d'Android, les utilisateurs ayant des dispositifs cryptés devraient entrer leur NIP / motif / mot de passe par défaut lors du processus de démarrage pour décrypter leur zone de stockage et la finition démarrage. Avec Android 7.0 Nougat, nous avons mis à jour le schéma de chiffrement sous-jacent et simplifié le processus de démarrage pour accélérer
redémarrer votre téléphone. Maintenant principales fonctions de votre téléphone, comme l'application de téléphone et votre réveil, vous êtes prêt tout de suite avant même tapez votre code PIN.


Now that Nougat has begun to roll out, we wanted to recap these updates in a single overview and highlight a few new improvements.

Direct Boot and encryption

In previous versions of Android, users with encrypted devices would have to
enter their PIN/pattern/password by default during the boot process to decrypt
their storage area and finish booting. With Android 7.0 Nougat, we’ve updated
the underlying encryption scheme and streamlined the boot process to speed up
rebooting your phone. Now your phone’s main features, like the phone app and
your alarm clock, are ready right away before you even type your PIN, so people
can call you and your alarm clock can wake you up. We call this feature href="http://android-developers.blogspot.com/2016/04/developing-for-direct-boot.html">Direct
Boot.


Under the hood, file-based encryption enables this improved user experience.
With this new encryption scheme, the system storage area, as well as each user
profile storage area, are all encrypted separately. Unlike with full-disk
encryption, where all data was encrypted as a single unit, per-profile-based
encryption enables the system to reboot normally into a functional state using
just device keys. Essential apps can opt-in to run in a limited state after
reboot, and when you enter your lock screen credential, these apps then get
access your user data to provide full functionality.


File-based encryption better isolates and protects individual users and profiles
on a device by encrypting data at a finer granularity. Each profile is encrypted
using a unique key that can only be unlocked by your PIN or password, so that
your data can only be decrypted by you.





Encryption support is getting stronger across the Android ecosystem as well.
Starting with Marshmallow, all capable devices were required to support
encryption. Many devices, like Nexus 5X and 6P also use unique keys that are
accessible only with trusted hardware, such as the ARM TrustZone. Now with 7.0
Nougat, all new capable Android devices must also have this kind of hardware
support for key storage and provide brute force protection while verifying your
lock screen credential before these keys can be used. This way, all of your data
can only be decrypted on that exact device and only by you.

The media stack and platform hardening



In Android Nougat, we’ve both hardened and href="http://android-developers.blogspot.com/2016/05/hardening-media-stack.html">re-architected
mediaserver, one of the main system services that processes untrusted input.
First, by incorporating integer overflow sanitization, part of Clang’s href="http://clang.llvm.org/docs/UndefinedBehaviorSanitizer.html">UndefinedBehaviorSanitizer,
we prevent an entire class of vulnerabilities, which comprise the majority of
reported libstagefright bugs. As soon as an integer overflow is detected, we
shut down the process so an attack is stopped. Second, we’ve modularized the
media stack to put different components into individual sandboxes and tightened
the privileges of each sandbox to have the minimum privileges required to
perform its job. With this containment technique, a compromise in many parts of
the stack grants the attacker access to significantly fewer permissions and
significantly reduced exposed kernel attack surface.


In addition to hardening the mediaserver, we’ve added a large list of
protections for the platform, including:

App security improvements



Android Nougat is the safest and easiest version of Android for application
developers to use.


We’ve also continued to refine app permissions and capabilities to protect you
from potentially harmful apps.

System Updates



Lastly, we've made significant enhancements to the OTA update system to keep
your device up-to-date much more easily with the latest system software and
security patches. We've made the install time for OTAs faster, and the OTA size
smaller for security updates. You no longer have to wait for the optimizing apps
step, which was one of the slowest parts of the update process, because the new
JIT compiler has been href="https://developer.android.com/about/versions/nougat/android-7.0.html?utm_campaign=android_discussion_security_090616&utm_source=anddev&utm_medium=blog#doze_on_the_go">optimized
to make installs and updates lightning fast.


The update experience is even faster for new Android devices running Nougat with
updated firmware. Like they do with Chromebooks, updates are applied in the
background while the device continues to run normally. These updates are applied
to a different system partition, and when you reboot, it will seamlessly switch
to that new partition running the new system software version.




We’re constantly working to improve Android security and Android Nougat brings
significant security improvements across all fronts. As always, we appreciate
feedback on our work and welcome suggestions for how we can improve Android.
Contact us at security@android.com.
Labels:

No comments:

Post a Comment