Feeds

Chrome OS leaks data to Google before switching on a VPN, says GCHQ

UK spy-base wing in new advice for BlackBerry, and Google OSes

Internet Security Threat Report 2014

The sexy-named Communications Electronics Security Group (CESG) – the bit of GCHQ that helps Brits protect stuff from foreign spies (never mind Blighty's) – has issued fresh advice for securing BlackBerry OS 10, Android and Chrome OS 32.

It also, handily, identifies "significant risks" in the operating systems.

The guidelines on safeguarding various operating systems from miscreants – as we have previously noted – run to the OFFICIAL level of security, not SECRET or above. OFFICIAL is on a par with most business and corporate security.

The refreshed advice for Android is to the move from Jellybean to KitKat (version 4.4); enable (NSA-originated) SELinux in enforcing mode to strengthen sandboxing; use certificate pinning to tackle interception and modification of SSL-encrypted traffic; and switch on verified boot.

The latest BlackBerry 10.2.1 advice is to review Enterprise Mobility Management options in the OS, which give configurations for work-only usage, work and personal modes, and work and personal modes with remote control for the IT department.

The document notes there are cost and usability issues with the most locked-down of these modes, and asks techies to weigh up the pros and cons. It does not make any recommendations on which mode should be used.

The advice for Google's Chrome OS 32 notes that the browser-driven system relies on the advertising giant's online services for user management and authentication – and there is no ability to automatically lock a user account after a number of failed login attempts when the device has no internet connection.

CESG cautions that Chrome OS's data encryption has not been independently tested and nor has the VPN. There are no third-party VPN products for Chrome. Indeed, CESG warns:

The VPN has not been independently assured to Foundation Grade, and does not currently support some of the mandatory requirements expected from assured VPNs. The VPN can be disabled by the user and some Google traffic is sent prior to the VPN being established resulting in potential for data leakage onto untrusted networks. Without assurance in the VPN there is a risk that data transiting from the device could be compromised.

This is hardly a recommendation for the system, but then none of the rigorous GCHQ documentation is meant as a buyer's guide.

CESG also notes similar issues with Google-developed Android's VPN, plus it flags up security (or lack of) of SD cards and non-data partitions, users installing unauthorised apps and skipping security updates, and more. BlackBerry OS 10.2's VPN and native data encryption also falls short in CESG's eyes.

Corporate IT departments that shuffle kit between users will find it interesting to compare notes between their own processes and the ones recommended by the government. You wouldn’t want any secrets getting out. ®

Internet Security Threat Report 2014

More from The Register

next story
Shellshock: 'Larger scale attack' on its way, warn securo-bods
Not just web servers under threat - though TENS of THOUSANDS have been hit
Apple's new iPhone 6 vulnerable to last year's TouchID fingerprint hack
But unsophisticated thieves need not attempt this trick
PEAK IPV4? Global IPv6 traffic is growing, DDoS dying, says Akamai
First time the cache network has seen drop in use of 32-bit-wide IP addresses
Oracle SHELLSHOCKER - data titan lists unpatchables
Database kingpin lists 32 products that can't be patched (yet) as GNU fixes second vuln
Who.is does the Harlem Shake
Blame it on LOLing XSS terroristas
Researchers tell black hats: 'YOU'RE SOOO PREDICTABLE'
Want to register that domain? We're way ahead of you.
Stunned by Shellshock Bash bug? Patch all you can – or be punished
UK data watchdog rolls up its sleeves, polishes truncheon
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Storage capacity and performance optimization at Mizuno USA
Mizuno USA turn to Tegile storage technology to solve both their SAN and backup issues.
The next step in data security
With recent increased privacy concerns and computers becoming more powerful, the chance of hackers being able to crack smaller-sized RSA keys increases.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.
A strategic approach to identity relationship management
ForgeRock commissioned Forrester to evaluate companies’ IAM practices and requirements when it comes to customer-facing scenarios versus employee-facing ones.