Jelly Bean beefs up Android security
One of the number one knocks on Android has continuously been with its security troubles. The slow updates mean that security updates don't get pushed out to devices, and there have been a few cases of "malware" popping up in the Play Store. Of course, how much of a threat those apps have posed depends on how you define "malware". Still, Google has put in a pretty solid bump in security with Android 4.1 Jelly Bean.
According to the changelog we saw yesterday, the only mention of a security update was that "device encryption" has been made "more reliable". But, some digging by Duo Security has also been looking into the new support for ASLR, which is address space layout randomization. ASLR randomizes the memory locations for most of the data structures in Android. This randomization makes it far more difficult for hackers because it randomizes where potentially malicious code would be written. This combines with Android's existing data execution prevention to make it extremely difficult to load malicious code in Jelly Bean.
ASLR isn't exactly new to Android, as it did exist in ICS, but the problem was that in ICS the support didn't really use the "randomization" part of ASLR. Without the randomization, it's easy to know where code will be deployed, making for much more effective malicious code. Jelly Bean is the first Android update to support full ASLR. Of course, iOS has implemented full ASLR since iOS 4.3, but we haven't seen a proper comparison between iOS 5 and ICS or Jelly Bean security, so it's hard to make a statement as to which is better. The last comparison we saw pitted iOS 5 against Gingerbread, which makes sense given each is the largest version on the market, but not quite fair as far as what Android offers now.
source: Duo Security via Ars Technica
Popular stories
Latest News
FCC OKs Cingular\'s purchase of AT&T Wireless
Things that are NOT allowed: