Chrome OS leaks data to Google before switching on a VPN, says GCHQ
UK spy-base wing in new advice for BlackBerry, and Google OSes
The sexy-named Communications Electronics Security Group (CESG) – the bit of GCHQ that helps Brits protect stuff from foreign spies (never mind Blighty's) – has issued fresh advice for securing BlackBerry OS 10, Android and Chrome OS 32.
It also, handily, identifies "significant risks" in the operating systems.
The guidelines on safeguarding various operating systems from miscreants – as we have previously noted – run to the OFFICIAL level of security, not SECRET or above. OFFICIAL is on a par with most business and corporate security.
The refreshed advice for Android is to the move from Jellybean to KitKat (version 4.4); enable (NSA-originated) SELinux in enforcing mode to strengthen sandboxing; use certificate pinning to tackle interception and modification of SSL-encrypted traffic; and switch on verified boot.
The latest BlackBerry 10.2.1 advice is to review Enterprise Mobility Management options in the OS, which give configurations for work-only usage, work and personal modes, and work and personal modes with remote control for the IT department.
The document notes there are cost and usability issues with the most locked-down of these modes, and asks techies to weigh up the pros and cons. It does not make any recommendations on which mode should be used.
The advice for Google's Chrome OS 32 notes that the browser-driven system relies on the advertising giant's online services for user management and authentication – and there is no ability to automatically lock a user account after a number of failed login attempts when the device has no internet connection.
CESG cautions that Chrome OS's data encryption has not been independently tested and nor has the VPN. There are no third-party VPN products for Chrome. Indeed, CESG warns:
The VPN has not been independently assured to Foundation Grade, and does not currently support some of the mandatory requirements expected from assured VPNs. The VPN can be disabled by the user and some Google traffic is sent prior to the VPN being established resulting in potential for data leakage onto untrusted networks. Without assurance in the VPN there is a risk that data transiting from the device could be compromised.
This is hardly a recommendation for the system, but then none of the rigorous GCHQ documentation is meant as a buyer's guide.
CESG also notes similar issues with Google-developed Android's VPN, plus it flags up security (or lack of) of SD cards and non-data partitions, users installing unauthorised apps and skipping security updates, and more. BlackBerry OS 10.2's VPN and native data encryption also falls short in CESG's eyes.
Corporate IT departments that shuffle kit between users will find it interesting to compare notes between their own processes and the ones recommended by the government. You wouldn’t want any secrets getting out. ®