Feeds

Chrome OS leaks data to Google before switching on a VPN, says GCHQ

UK spy-base wing in new advice for BlackBerry, and Google OSes

Beginner's guide to SSL certificates

The sexy-named Communications Electronics Security Group (CESG) – the bit of GCHQ that helps Brits protect stuff from foreign spies (never mind Blighty's) – has issued fresh advice for securing BlackBerry OS 10, Android and Chrome OS 32.

It also, handily, identifies "significant risks" in the operating systems.

The guidelines on safeguarding various operating systems from miscreants – as we have previously noted – run to the OFFICIAL level of security, not SECRET or above. OFFICIAL is on a par with most business and corporate security.

The refreshed advice for Android is to the move from Jellybean to KitKat (version 4.4); enable (NSA-originated) SELinux in enforcing mode to strengthen sandboxing; use certificate pinning to tackle interception and modification of SSL-encrypted traffic; and switch on verified boot.

The latest BlackBerry 10.2.1 advice is to review Enterprise Mobility Management options in the OS, which give configurations for work-only usage, work and personal modes, and work and personal modes with remote control for the IT department.

The document notes there are cost and usability issues with the most locked-down of these modes, and asks techies to weigh up the pros and cons. It does not make any recommendations on which mode should be used.

The advice for Google's Chrome OS 32 notes that the browser-driven system relies on the advertising giant's online services for user management and authentication – and there is no ability to automatically lock a user account after a number of failed login attempts when the device has no internet connection.

CESG cautions that Chrome OS's data encryption has not been independently tested and nor has the VPN. There are no third-party VPN products for Chrome. Indeed, CESG warns:

The VPN has not been independently assured to Foundation Grade, and does not currently support some of the mandatory requirements expected from assured VPNs. The VPN can be disabled by the user and some Google traffic is sent prior to the VPN being established resulting in potential for data leakage onto untrusted networks. Without assurance in the VPN there is a risk that data transiting from the device could be compromised.

This is hardly a recommendation for the system, but then none of the rigorous GCHQ documentation is meant as a buyer's guide.

CESG also notes similar issues with Google-developed Android's VPN, plus it flags up security (or lack of) of SD cards and non-data partitions, users installing unauthorised apps and skipping security updates, and more. BlackBerry OS 10.2's VPN and native data encryption also falls short in CESG's eyes.

Corporate IT departments that shuffle kit between users will find it interesting to compare notes between their own processes and the ones recommended by the government. You wouldn’t want any secrets getting out. ®

Protecting users from Firesheep and other Sidejacking attacks with SSL

More from The Register

next story
Spies would need SUPER POWERS to tap undersea cables
Why mess with armoured 10kV cables when land-based, and legal, snoop tools are easier?
Early result from Scots indyref vote? NAW, Jimmy - it's a SCAM
Anyone claiming to know before tomorrow is telling porkies
TOR users become FBI's No.1 hacking target after legal power grab
Be afeared, me hearties, these scoundrels be spying our signals
Jihadi terrorists DIDN'T encrypt their comms 'cos of Snowden leaks
Intel bods' analysis concludes 'no significant change' after whistle was blown
Home Depot: 56 million bank cards pwned by malware in our tills
That's about 50 per cent bigger than the Target tills mega-hack
Hackers pop Brazil newspaper to root home routers
Step One: try default passwords. Step Two: Repeat Step One until success
China hacked US Army transport orgs TWENTY TIMES in ONE YEAR
FBI et al knew of nine hacks - but didn't tell TRANSCOM
Microsoft to patch ASP.NET mess even if you don't
We know what's good for you, because we made the mess says Redmond
NORKS ban Wi-Fi and satellite internet at embassies
Crackdown on tardy diplomatic sysadmins providing accidental unfiltered internet access
prev story

Whitepapers

Providing a secure and efficient Helpdesk
A single remote control platform for user support is be key to providing an efficient helpdesk. Retain full control over the way in which screen and keystroke data is transmitted.
WIN a very cool portable ZX Spectrum
Win a one-off portable Spectrum built by legendary hardware hacker Ben Heck
Saudi Petroleum chooses Tegile storage solution
A storage solution that addresses company growth and performance for business-critical applications of caseware archive and search along with other key operational systems.
Protecting users from Firesheep and other Sidejacking attacks with SSL
Discussing the vulnerabilities inherent in Wi-Fi networks, and how using TLS/SSL for your entire site will assure security.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.