Archive notice: This article was originally published on August 17, 2009. Links and embedded videos are preserved as part of the historical record.
Rich Cannings, the person responsible for security for Google’s Android mobile operating system, recently addressed smartphone security at the Usenix Security Conference. As mobile phones gain ever more extensive functionality, they are increasingly becoming targets for hacker attacks, he says. Smartphone manufacturers have therefore so far relied on strict control of which software may run on the device - Apple, for example, resists third-party programs and permits only software approved for the App Store. Google takes a different approach, not least because the operating system is promoted primarily for its developer friendliness. Instead of preventing attackers from gaining access to the device, the aim is to offer them as few possibilities as possible once they have gained access.
“I could build the most secure mobile phone in the world, but nobody would use it,” Cannings says. A truly secure mobile phone, according to the expert, would have no internet access, and one would also have to consider restricting the other functions. Google therefore relies on a concept similar to one already used in web applications. These are protected by the “Same Origin Policy,” which prevents websites from interacting with other internet pages currently open by the user. Applied to an operating system such as Android, this means that each program is treated like its own user account. These different user accounts for programs cannot access the data of other accounts, so a hacker who gains access to the browser, for example, can act only within it.
“In fact, the threat to smartphones is currently still low. In the first six months of this year, only 106 new malicious programs appeared for the various operating systems. Compared with malware for Windows, that is at a very low level,” Thorsten Urbanski of German security specialist G Data told the pressetext.de news service. To become interesting to cybercriminals, a platform must first be widely used. Producing malware requires considerable effort and is worthwhile only for popular operating systems. Android could become one such system - after HTC, Samsung is another major mobile-phone manufacturer with devices in its range, and use on netbooks and smartbooks is also being discussed.
Charlie Miller, security expert at Security Evaluators, confirms the usefulness of Google’s concept. In a test, he gained access to the Android MP3 player but could in fact act only within the music-playback program. He could not manipulate other applications. However, he criticizes Google for relying too heavily on this protective mechanism. Attackers could find a bug in the operating system that enables them to cross the barrier between applications in future.
A further difficulty with Android is that Google supplies the operating system but has no control over the hardware. When Miller first discovered a bug in Android, he contacted Google, which provided a patch for the security vulnerability within 24 hours. Delivering such a patch, however, is the responsibility of the relevant providers - whether the Android user actually receives the update for the vulnerabilities therefore depends largely on the mobile partners. With negligent providers, it could consequently take a long time, or never happen, before a patch actually becomes widespread on devices.
