Home
Mobiles
Mobiles News
Android Oreo Security Enhancements Detailed by Google

Android Oreo Security Enhancements Detailed by Google

By Jagmeet Singh | Updated: 22 December 2017 19:03 IST

Highlights

Google develops Android Verified Boot 2.0 with Project Treble
Android Oreo includes new OEM Lock Hardware Abstractions Layer
Google implements Control Flow Integration (CFI)

Google has detailed all the key security enhancements that it has designed for Android Oreo. The latest Android platform is already running on a list of mobile devices including the recent Pixel and Nexus models - but as per the latest November figures, it comprises 0.5 percent of active Android devices.

Android Marshmallow and Nougat already enhanced hardware security on devices. But with Android Oreo, Google has provided a new reference implementation of its Verified Boot that is designed to prevent devices from booting up with tampered software. The reference implementation, called Android Verified Boot 2.0, runs with Project Treble to enable security updates such as a common footer format and rollback protection. The latter among the two is designed to prevent a device to boot if downgraded to an older OS version, which could include some vulnerabilities. Initially, Google's Pixel 2 and Pixel 2 XL are available with the newest development, though the Android maker recommends all device manufacturers to add the same feature to their new devices.

Apart from the new Verified Boot version, Android Oreo includes the new OEM Lock Hardware Abstractions Layer (HAL) that allows devices manufacturers to implement the way how they protect whether a device is locked, unlocked, or unlockable. Google has also claimed to have invested support in tamper-resistant hardware, including the development of a physical chip that can prevent software and hardware attacks on the new Pixel 2 family. It also resists physical penetration attacks.

Android Oreo also enables an enhanced isolation by removing direct hardware access from the default media frameworks. Similarly, Google has enabled Control Flow Integration (CFI) across all media components to disallow arbitrary changes to the original control flow graph to make it harder for attackers to perform malicious activities. Oreo version also has seccomp filtering, hardened usercopy, Privileged Access Never (PAN) emulation, and Kernel Address Space Layout Randomisation (KASLR). Additionally, Google has isolated WebView by splitting the rendering engine into a separate process and running the same in an isolated sandbox to restrict external resources. You can read the detailed blog post to understand all the behind-the-scenes developments.

Comments

For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.