Feeds

Chrome OS leaks data to Google before switching on a VPN, says GCHQ

UK spy-base wing in new advice for BlackBerry, and Google OSes

The Essential Guide to IT Transformation

The sexy-named Communications Electronics Security Group (CESG) – the bit of GCHQ that helps Brits protect stuff from foreign spies (never mind Blighty's) – has issued fresh advice for securing BlackBerry OS 10, Android and Chrome OS 32.

It also, handily, identifies "significant risks" in the operating systems.

The guidelines on safeguarding various operating systems from miscreants – as we have previously noted – run to the OFFICIAL level of security, not SECRET or above. OFFICIAL is on a par with most business and corporate security.

The refreshed advice for Android is to the move from Jellybean to KitKat (version 4.4); enable (NSA-originated) SELinux in enforcing mode to strengthen sandboxing; use certificate pinning to tackle interception and modification of SSL-encrypted traffic; and switch on verified boot.

The latest BlackBerry 10.2.1 advice is to review Enterprise Mobility Management options in the OS, which give configurations for work-only usage, work and personal modes, and work and personal modes with remote control for the IT department.

The document notes there are cost and usability issues with the most locked-down of these modes, and asks techies to weigh up the pros and cons. It does not make any recommendations on which mode should be used.

The advice for Google's Chrome OS 32 notes that the browser-driven system relies on the advertising giant's online services for user management and authentication – and there is no ability to automatically lock a user account after a number of failed login attempts when the device has no internet connection.

CESG cautions that Chrome OS's data encryption has not been independently tested and nor has the VPN. There are no third-party VPN products for Chrome. Indeed, CESG warns:

The VPN has not been independently assured to Foundation Grade, and does not currently support some of the mandatory requirements expected from assured VPNs. The VPN can be disabled by the user and some Google traffic is sent prior to the VPN being established resulting in potential for data leakage onto untrusted networks. Without assurance in the VPN there is a risk that data transiting from the device could be compromised.

This is hardly a recommendation for the system, but then none of the rigorous GCHQ documentation is meant as a buyer's guide.

CESG also notes similar issues with Google-developed Android's VPN, plus it flags up security (or lack of) of SD cards and non-data partitions, users installing unauthorised apps and skipping security updates, and more. BlackBerry OS 10.2's VPN and native data encryption also falls short in CESG's eyes.

Corporate IT departments that shuffle kit between users will find it interesting to compare notes between their own processes and the ones recommended by the government. You wouldn’t want any secrets getting out. ®

Build a business case: developing custom apps

More from The Register

next story
14 antivirus apps found to have security problems
Vendors just don't care, says researcher, after finding basic boo-boos in security software
Only '3% of web servers in top corps' fully fixed after Heartbleed snafu
Just slapping a patched OpenSSL on a machine ain't going to cut it, we're told
'Things' on the Internet-of-things have 25 vulnerabilities apiece
Leaking sprinklers, overheated thermostats and picked locks all online
How long is too long to wait for a security fix?
Synology finally patches OpenSSL bugs in Trevor's NAS
Israel's Iron Dome missile tech stolen by Chinese hackers
Corporate raiders Comment Crew fingered for attacks
Roll out the welcome mat to hackers and crackers
Security chap pens guide to bug bounty programs that won't fail like Yahoo!'s
HIDDEN packet sniffer spy tech in MILLIONS of iPhones, iPads – expert
Don't panic though – Apple's backdoor is not wide open to all, guru tells us
Researcher sat on critical IE bugs for THREE YEARS
VUPEN waited for Pwn2Own cash while IE's sandbox leaked
Four fake Google haxbots hit YOUR WEBSITE every day
Goog the perfect ruse to slip into SEO orfice
prev story

Whitepapers

Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
The Essential Guide to IT Transformation
ServiceNow discusses three IT transformations that can help CIO's automate IT services to transform IT and the enterprise.
Consolidation: The Foundation for IT Business Transformation
In this whitepaper learn how effective consolidation of IT and business resources can enable multiple, meaningful business benefits.
How modern custom applications can spur business growth
Learn how to create, deploy and manage custom applications without consuming or expanding the need for scarce, expensive IT resources.
Build a business case: developing custom apps
Learn how to maximize the value of custom applications by accelerating and simplifying their development.