‘Big step forward’: Android Oreo update provides stronger security

In the smartphone wars, Android has always tended to lose out to the iPhone in the security department. The Android OS has always had more exploitable areas, and while this is not to say that iPhone is bulletproof, hackers tend to seek the path of least resistance (which in this case, is the Google designed OS). The developers of the Android operating system are generally cognizant of its flaws, but their ability to fix these flaws has always been hit or miss. It is this reality that Google hopes to change with the newest Android OS update. Android Oreo, also known as Android 8.0 or the “O” update, was released August 21, and cybersecurity specialists are quite pleased with their analysis of the changes. The most comprehensive, and readable, exploration of the new security features came from Kaspersky Lab’s Threatpost. I recommend reading the entire article, which can be found here, however, I will try to explore what I find to be the most important changes in Android Oreo from an InfoSec perspective.

One major addition in Android Oreo is the function of creating a kernel lockdown. Hackers have progressively been able to utilize exploits at the kernel level over the years, resulting in roughly 39 percent of reported exploits being related to the kernel. Recognizing this issue, Google has configured Android Oreo to, as Tom Spring states in his Threatpost article, filter “system calls to the kernel using a configurable policy” using something called secure computing mode or “Seccomp.” By securing the kernel, the most malleable level of an operating system, Android will undoubtedly be able to counter root level attacks.

Another huge update in Android 8.0 is about app permissions. With all of the trouble that has been occurring with third-party apps, this particular feature is quite useful. When downloading third-party apps prior to Android Oreo, side-loading required the user to check a box that allowed any and all “unknown sources” to have whatever permissions they desired. This of course carries huge risks, as malicious actors can leverage these permissions to attack a device on multiple fronts. In Android Oreo, the global permission is eliminated in favor of a “by-app” permission basis. The greater control should allow users to prevent intrusive third-party apps, and also encourage them to employ better security tactics.

This only scratches the surface of everything that is in Android Oreo, but hopefully it shows how Android developers are becoming more intuitive in their OS design with regards to security. Cybersecurity researchers are feeling optimistic at the very least about this update. When discussing the update with Threatpost, Duo Security senior research and development engineer Kyle Lady stated the following:

Android O is a big step forward… it used to be if you cared about security you had to pay a premium and buy an iPhone. Soon, even a $50 Android device running Oreo will be on par with a $1,000 iPhone X when it comes to security.

Whether this will come to pass remains to be seen, as the OS update is only currently available on a handful of Google Pixel smartphones. When Android Oreo is given the green light to update on more than just this (for example on Samsung phones and beyond), then we will really be able to see a thorough test of its capabilities.