At the RSA Conference, Google's Lead Engineer for Android Security Adrian Ludwig presented the company's philosophy for securing their mobile platform. It's a typically Google approach that relies on collecting data and building services. But at the same time it seems to fly in the face of conventional mobile security.
Invisible Security
Several times during the talk, Ludwig returned to the idea of subtle security. "Effective and invisible security evokes calm," he said. The goal was to let the user interact with their phone, tablet, or whatever was running Android without security issues getting in their way. "Not trumpeting security doesn't mean it's not there," said Ludwig. "It means it's working."
Several times during the talk, Ludwig returned to the idea of subtle security. "Effective and invisible security evokes calm," he said. The goal was to let the user interact with their phone, tablet, or whatever was running Android without security issues getting in their way. "Not trumpeting security doesn't mean it's not there," said Ludwig. "It means it's working."
This approach is markedly different from that of the security industry as a whole, he said, which relies heavily on "security theater." To him, this means apps that loudly proclaim how much they're protecting you. "Most security is ultimately about selling you more security," said Ludwig in a surprisingly frank statement at a conference that caters to security companies.
Permissions were the notable exception. "It's the one place that we're explicit about security to the user," he said. These define what an app can and cannot access, and we have encouraged readers to look at them carefully to make good decisions about what they download. Ludwig said that wasn't really the intention. "Did we think people were going to make smart decisions every time? Remember, we see what people search for everyday," he added wryly. He went on to say that permissions are there not so much for users, but to help developers make good decisions "most of the time."
This fit with another of Ludwig's surprising statements: that he doesn't see Android as an operating system, but rather a development platform. "[Android] was a set of APIs intended to create powerful applications," he said. "We deliver services in the form of applications."
What Google ProvidesWhile Ludwig spent some time discussing how the underpinnings of Android made the platform secure—including thanking the NSA for SC Linux—he also touched on more visible Google services. For example, he claimed that Google's malware detection efforts on Google Play surpass that of the entire AV industry. Though he acknowledged that it wasn't infallible.
In addition to another obvious tool like the Android Device Manager, Ludwig pointed to Google's Verified Apps service, which provides some protection for users who install apps from outside the Play store. "You probably have it on your phone and don't know it, because that's how we roll," said Ludwig.
There's also the Android Safety Net, which Ludwig said extended real-time protection to devices themselves. This looks for potential abuses, like frequently requesting to send premium SMS messages—a common tactic used to monetize malicious apps.
"I'd have to guess that this is the largest deployment of security services in the world," said Ludwig.
Diversity and Openness is GoodAndroid is known as an open platform, and Ludwig said that this approach has provided invaluable data about good actors, bad actors, and normal behavior on mobile devices. "As the world becomes more interactive and there's more data flowing back and forth, security actually gets better." Ludwig believes that this greatly differs from established security strategies, which he said depend upon isolation.
Openness has meant a fragmented Android, but Ludwig seemed to suggest that this diversity was a good thing. The enormous diversity of Android hardware and software means that it is much more difficult to affect all devices. "A single gold master with a bug affects hundreds of million of users," he said. "There is no single gold master [for Android], every device is built from source that differs."
Being open has also given security companies a place on Android. "We didn't prevent them from running on our platform," he said, no doubt making a jab at Apple. Instead, Ludwig said Google welcomed security companies in and Android benefited from their work.
Openness also facilitates academic research in the growing field of mobile security. "Mobile security is a euphemism for Android security," said Ludwig. "All of the papers are about Android security because it's the only place [researchers] have access in mobile."
Is It Working?
To demonstrate the effectiveness of Google's approach to security, Ludwig ran through a timeline of the Masterkey exploit, which careful SecurityWatch readers will recall from last summer. He said Google was able to quickly determine that there were no such exploits in the Play store when they were informed it existed. What's more, after the Bluebox researchers who discovered the exploit publicly released their data, Google apparently tracked only eight attempts per million installs.
To demonstrate the effectiveness of Google's approach to security, Ludwig ran through a timeline of the Masterkey exploit, which careful SecurityWatch readers will recall from last summer. He said Google was able to quickly determine that there were no such exploits in the Play store when they were informed it existed. What's more, after the Bluebox researchers who discovered the exploit publicly released their data, Google apparently tracked only eight attempts per million installs.
Ludwig had a similar view on Android malware as a whole, which has been widely reported to be on the rise. He attributed this more to the rapid proliferation of Android devices, and the data he presented showed a relatively small instance of malware on the enormous universe of Androids. "You get incredible headlines with basically no one being affected."
It has to be said that, so far, Google has done a terrific job of managing Android security—especially considering how smartphones burst onto the scene and came to dominate modern computing. However, there are still serious issues to be addressed going forward, like leaky apps and securing personal data.
From Google's perspective, Android has balanced security with grace. Keeping that balance will probably be how Android is judged as it matures.
