Google on ‘Stagefright” exploit: not all Android bugs are this bad, thanks to Google’s security measures

Bugs may be endless, but that doesn’t mean they are harmful… at least not all them are. Lead engineer Adrian Ludwig made sure to touch on this subject after the whole ‘Stagefright’ exploit was discovered by the media. This vulnerability is said to leave about 95% of Android users exposed to hackers, who could gain access of your handset by simply sending you an MMS message with a malicious file.

As expected, this was a major cause of distress for the industry and all Android users, but Ludwig took it to Google+ to tell us we shouldn’t worry too much, as they are working on this issue and not all bugs are like this one.  In fact, it’s amazingly rare to find similar exploits, as Google takes several precautionary measures to make sure your device is protected. Let’s go through some of the most important ones.

ASLR – Address Space Layout Randomization

ASLR is a security technique that shuffles code location, making it harder for hackers to predict it. The system hides memory addresses and these values then have to be guessed.

“For the layperson — ASLR makes writing an exploit like trying to get across a foreign city without access to Google Maps, any previous knowledge of the city, any knowledge of local landmarks, or even the local language.  Depending on what city you are in and where you’re trying to go, it might be possible but it’s certainly much more difficult” -Adrian Ludwig, Android security lead engineer

non-PIE linker support removal

ASLR and PIE (position-independent executables) work together, allowing for memory location-based protection. Since Android 5.0, non-PIE content is no longer supported. This makes it harder for any attacker to make its way through the code and find what he needs in order to build an exploit.

NX – No eXecute

Google introduced NX with Android 2.3. Essentially, this is a technology used in CPUs, which seclude memory areas and limit the way code is executed. In Android, it mostly protects the stack and heap.

Fortify Source

Fortify Source is a security method that allows the system to recognize when too many bytes are being copied from a source to its destination. Hackers are known to copy more bytes than usual when they want to overflow a buffer. If such an event were to occur, the system can stop the process. In Android, all code is compiled with these protections.

RELRO – Read-Only-Relocations

Read-Only-Relocations protect internal data sections from being overwritten, in case of a bss or data overflow. It gains control over software execution flows, making attackers harmless in many ways.

And more!

Google has been working hard to keep Android secure. Even if some vulnerabilities come up here and there, Google is confident most people will be fine. More issues start arising when you unlock certain root capabilities and manage to get attacked, but not as many people ever tinker with their smartphones in that way.

Those who want to learn more about security enhancements in Android can always go ahead and take a look at Google’s official security page.

But are you really safe?

We would be lying if we told you there isn’t some risk of being hacked, despite all these security measures. The truth is, Android is the most popular mobile OS in the world. When an operating system becomes so popular, hackers start working, and we aren’t seeing an exception here.

According to Eset, Android Malware increased by 63% in 2013, compared to 2012. So did the malware families for Android. The numbers are more modest when we compare 2014 to 2013, but a 25% increase in infections (according to Alcatel-Lucent) is still a significant rise.

This is why we urge you to be smart with your devices. Try not to have MMS auto-download activated, don’t install apps from unreliable sources and make sure not to dig into weird websites. Meanwhile, Google does continue to try and improve security matters by asking for help from the developer community, which has always been the foundation of this glorious operating system.

Android Security Rewards – help Google find exploits and earn good cash

In an effort to discover possible exploits, Google is willing to offer a monetary reward to those of you who discover a vulnerability. The cash amount will depend on the severity of the hack, but Ludwig does state the Search Giant will pay up to $30,000 to anyone who provides a working remote exploit against the Nexus 6 or Nexus 9.

Adrian Ludwig goes on to mention there have been no attempt to claim the Android Security Rewards, which is a bit reassuring for users. It might also be a challenge to our beloved developers. If you are up for the challenge, just visit the Android Security Rewards page and learn all about the program.

Android Auto hidden gems: vehicle diagnostics, secret sensor support and more

Android Auto is useful and fun, but no one can deny it has much maturing to do (we figured out as much during our Hyundai Sonata review). It’s not exactly a complete replacement for vehicle infotainment and security systems currently available in the market, but Google does seem to have some pretty big plans for Android Auto to grow into.

The guys at Ars Technica took it upon themselves to do more than a consumer-based review. They flipped the developer switch on and decided to delve deeper into the operating system. Buried inside thousands of lines of code and legal information, they found some evidence of what could be future projects for the driving-optimized platform.

Disclaimer: Even though all this data and information comes straight from Google’s Android Auto system, it doesn’t necessarily mean they will all be hitting the market. This is still unannounced content, so treat it as such. Regardless, it seems unlikely that some people at Google worked hard to build each of these elements into the operating system just to see them die later. 

With that out of the way, let’s touch upon these new discoveries.

Vehicle diagnostics

Most users will find the “Car” screen is pretty basic. All you get is a button to exit Android Auto, but Google may have bigger plans for this page. Turning on developer mode will result in the appearance of four new options: “Vehicle Check”, “Service History”, “Roadside Assistance” and “More Car Apps”.

These are all pretty self-explanatory. “Vehicle Check” will allow you to see your car’s current status. It’s in charge of checking for tire pressure, oil status, windshield fluid and more. On the other hand, “Service History” will keep a record on your vehicle’s maintenance track record. Lastly, “Roadside Assistance” helps get you out of unpleasant situations by aiding you when you face major issues.

In addition to adding these sections, Google made sure to create non-functional mock-ups of the interfaces within these apps. They are simply images, but it took someone’s work and time, meaning this is likely more than just something on the back burner.

#gallery-1
margin: auto;

#gallery-1 .gallery-item
float: left;
margin-top: 10px;
text-align: center;
width: 33%;

#gallery-1 img
border: 2px solid #cfcfcf;

#gallery-1 .gallery-caption
margin-left: 0;

/* see gallery_shortcode() in wp-includes/media.php */

Hidden sensors

After digging in deeper, it was discovered that many of the sensors listed within the Android Auto code are not in use, and could suggest some very interesting features to come.

Let’s take a look at the list:

Compass
Car Speed
GPS
Night Data
Accelerometer
Gyroscope
RPM Data
Odometer
Environment Data

• Pressure
• Temperature

Fuel Level

• In Distance
• In Percentile
• Low Warning

HVAC Data

• Current Temperature
• Target Temperature

Gear Data

• Park
• Neutral
• Reverse
• Drive
• Gears “First” through “Tenth”

Driving Status

• Fully Restricted
• Limit Message
• No Keyboard
• No Video
• No Voice input
• Unrestricted

These are all sensors and situations the operating system is keeping tags on, or “listening to”. Things like the fuel level, odometer, RPM and gear data have no reason to be there… at least so far. Reading the temperature could help automate the AC, for example.

There’s also some wording in the legal writing that states the system will know if there is a passenger in the vehicle, effectively making it possible to unlock some features that would otherwise be locked while driving (for safety reasons).

Conclusion

All this information, put together, gives us hope that Android Auto will become more than just a glorified GPS and media system. The UI is great, voice actions are unbelievable and it’s a breeze to use. We just need some polishing, and making the system more thorough like these hidden gems suggest would be the perfect start.

What do you guys think of these new hidden features and characteristics? Are there any other creative uses you could find for them? Let us know in the comments below!

2016 Honda Accord with Android Auto™