STE WILLIAMS

From this week, for a while at least, the word “Oreo” will have two popular meanings that might confuse anyone unfamiliar with smartphone OS naming conventions.

The Oreo is a famous US cookie, of course, but thanks to a commercial tie-up with Google, from August 21 the snack is also the name of the latest version of Android, version 8.0.

The connection between a circular biscuit and the piece of software bearing its name is not immediately obvious beyond the need for a Silicon Valley company to humanise the impersonality of its product empire. But behind the cute name, does Oreo add enough security goodness to the ingredients list?

Compared to Android 7.0 Nougat, launched a year ago, we see useful progress.

Play Protect

First up are tweaks to Google Play Protect, a layer of security features – a confusing number of which (the ability to locate, lock/wipe a device remotely, Play Store and device monitoring, Safe Browsing, etc), have been around for a while.

But at least Play Protect’s settings appear under the Security and Location menu rather than buried under version 7.0’s Google menu where nobody notices them. Google claims that Play Protect enforces “stricter app install controls”, although it doesn’t fully explain how.

The Autofill API

The Autofill API allows Oreo to better integrate with password managers. While these already work on Android, Autofill allows better support for data such as credit cards and addresses across multiple browsers without the need to enable specific permissions. LastPass’s Autofill beta announcement mentions improved performance.

Project Treble

This is a way for smartphones other than Google’s own to get software updates (including patches) faster than at present. The gist is that the part of the OS vendors customise is now kept separate from low-level firmware, making it much easier to update.

Instant apps

Android Instant apps is a new technology that makes it possible to run or preview apps in the cloud before installing them. This isn’t tabled as a security feature but, in a way, it is – if users can study and app’s behaviour before running it that offers some reassurance.

Other small improvements include reforming the risky setting that lets users side-load apps from beyond the Play Store. This is no longer a universal setting and must be set for each app (frankly, this should have done long ago). We are promised that rogue apps can no longer hijack the lock screen.

A new chapter

Perhaps the biggest progress in a year that has seen the usual clutch of Android security scares is simply that Android security improvements are now seen as central to its appeal rather than as entertainment for the paranoia brigade.

This is positive, but another way to assess a platform’s security improvements is to ask how well they might defends against the real-world malware targeting its users.

Google underlined this in July with an analysis of a piece of malware called Lipizzan, allegedly the work of an Israeli cyberarms group. Earlier in 2017, the company discovered a similar piece of spyware called Chrysaor.

These are rare and unusual, but they show what Oreo and every Android version from this point onwards is up against. The punchline? Chrysaor, which came from outside the Play Store, had been targeting Android users undetected for years.

Google’s response is to make Android more locked down and “iPhone-like”, hence the growing importance of Play Protect. What Lipizzan and Chrysaor tell us is that the malware writers will still look for ways to crawl through the cracks that even Google’s clever engineers don’t anticipate.

Follow @NakedSecurity
Follow @JohnEDunn

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/pys4MjErtGU/