Feeds

Android security, market place under fire

Researchers stick fingers in, developers put hands out

The Power of One Infographic

The security of Google's Android is under fire from security researchers who reckon they've identified a browser flaw that could compromise the platform.

Meanwhile, users of the first Android handset are busy venting their indignation at being asked to pay for applications.

The security issue is a buffer-overflow problem in the browser identified by researchers from Independent Security Evaluators, who blame the problem on Google's use of old open-source packages. The researchers say it has the potential to reach through the browser and execute arbitrary code.

Independent Security Evaluators have form, having identified security problems in Apple's iPhone, and informed Google of the problems last week. The researchers aren't sharing details of the flaw, but feel that announcing its existence is in the public interest - and in the interest of their own careers, obviously. The flaw requires a mark to be tricked into visiting a malicious website, but once there the site can access any information available to the browser - stored passwords, cookies and such.

The researchers note that the layered security of Android limits the damage the flaw can cause: "They can not control other, unrelated aspects of the phone, such as dialing the phone directly. This is in contrast, for example, with Apple's iPhone which does not have this application sandboxing feature and allows access to all features available to the user when compromised."

Google is apparently working on a fix, hopefully to be deployed before anyone manages to take advantage in the real world - perhaps as a way to help pay for application development.

The potential flaw means users of the G1, the only Android handset to date, have something else to moan about. They're already complaining that some applications available through the Marketplace are asking for money before running - not what they expected from an open-source device.

The problem is that the Android Marketplace won't allow developers to charge for applications, everything has to be free until Google gets round to setting up a payment system next year. Some developers are fine with that, but others are old-fashioned enough to want money, so have uploaded apps that list as free but demand payment once installed.

Clearly this is against the ethos that demands everything is gratis, and has G1 users up in arms demanding that uploaders be tarred and feathered at least. But those same users should probably worry less about their failure to understand open source, and be more concerned with the latest security threat to assault Google's platform.®

The Power of One eBook: Top reasons to choose HP BladeSystem

More from The Register

next story
Google Nest, ARM, Samsung pull out Thread to strangle ZigBee
But there's a flaw in Google's IP-based IoT system
Orange spent weekend spamming customers with TXTs
Zero, not infinity, is the Magic Number customers want
Want to beat Verizon's slow Netflix? Get a VPN
Exec finds stream speed climbs when smuggled out
US freemium mobile network eyes up Europe
FreedomPop touts 'free' calls, texts and data
'Two-speed internet' storm turns FCC.gov into zero-speed website
Deadline for comments on net neutrality shake-up extended to Friday
GoTenna: How does this 'magic' work?
An ideal product if you believe the Earth is flat
NBN Co execs: No FTTN product until 2015
Faster? Not yet. Cheaper? No data
prev story

Whitepapers

Reducing security risks from open source software
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
Application security programs and practises
Follow a few strategies and your organization can gain the full benefits of open source and the cloud without compromising the security of your applications.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Consolidation: the foundation for IT and business transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.