Sunday, July 29, 2012

ASLR that works - Android 4.1 Jelly Bean

Android is catching up to iOS in some aspects besides design sensibility.

Now sports better Address Space Layout Randomization (ASLR) in 4.1 Jelly Bean - where it randomizes the location of objects in memory.

Initially implemented in 4.0 ICS, it was laughed off by security experts when it failed to randomize the executable and memory regions, rendering it vulnerable to real-world attacks. So long as a hacker knows where a certain part of memory of is located, it's vulnerable. Jelly Bean finally fixed that.

Android still lacks code signing, long present in iOS where it should prevent the execution of unsigned code. Still, kudos for moving forward. Makes you think though, being Linux-based should've made it easier for these guys to implement high security features in Android. Just sayin'.