site: security.googleblog.com
Capslock: What is your code really capable of?
https://security.googleblog.com/2023/09/capslock-what-is-your-code-really.html [security.googleblog.com]
2023-09-17 02:39
tags:
development
security
Avoiding bad dependencies can be hard without appropriate information on what the dependency’s code actually does, and reviewing every line of that code is an immense task. Every dependency also brings its own dependencies, compounding the need for review across an expanding web of transitive dependencies. But what if there was an easy way to know the capabilities–the privileged operations accessed by the code–of your dependencies?
source: L
OpenTitan - open sourcing transparent, trustworthy, and secure silicon
https://security.googleblog.com/2019/11/opentitan-open-sourcing-transparent.html [security.googleblog.com]
2019-11-07 16:05
tags:
bios
cloud
hardware
security
Today, along with our partners, we are excited to announce OpenTitan - the first open source silicon root of trust (RoT) project. OpenTitan will deliver a high-quality RoT design and integration guidelines for use in data center servers, storage, peripherals, and more. Open sourcing the silicon design makes it more transparent, trustworthy, and ultimately, secure.
Adopting the Arm Memory Tagging Extension in Android
https://security.googleblog.com/2019/08/adopting-arm-memory-tagging-extension.html [security.googleblog.com]
2019-08-04 16:54
tags:
android
cpu
defense
development
security
update
vapor
As part of our continuous commitment to improve the security of the Android ecosystem, we are partnering with Arm to design the memory tagging extension (MTE). Memory safety bugs, common in C and C++, remain one of the largest vulnerabilities in the Android platform and although there have been previous hardening efforts, memory safety bugs comprised more than half of the high priority security bugs in Android 9.
We believe that memory tagging will detect the most common classes of memory safety bugs in the wild, helping vendors identify and fix them, discouraging malicious actors from exploiting them. During the past year, our team has been working to ensure readiness of the Android platform and application software for MTE. We have deployed HWASAN, a software implementation of the memory tagging concept, to test our entire platform and a few select apps. This deployment has uncovered close to 100 memory safety bugs. The majority of these bugs were detected on HWASAN enabled phones in everyday use. MTE will greatly improve upon this in terms of overhead, ease of deployment, and scale. In parallel, we have been working on supporting MTE in the LLVM compiler toolchain and in the Linux kernel. The Android platform support for MTE will be complete by the time of silicon availability.
source: grugq
Security Issue with Bluetooth Low Energy (BLE) Titan Security Keys
https://security.googleblog.com/2019/05/titan-keys-update.html [security.googleblog.com]
2019-05-17 14:05
tags:
auth
hardware
security
wifi
Due to a misconfiguration in the Titan Security Keys’ Bluetooth pairing protocols, it is possible for an attacker who is physically close to you at the moment you use your security key -- within approximately 30 feet -- to (a) communicate with your security key, or (b) communicate with the device to which your key is paired.
Bluetooth security is... challenging.
Introducing Adiantum: Encryption for the Next Billion Users
https://security.googleblog.com/2019/02/introducing-adiantum-encryption-for.html [security.googleblog.com]
2019-02-08 19:43
tags:
android
crypto
defense
paper
security
storage
Where AES is used, the conventional solution for disk encryption is to use the XTS or CBC-ESSIV modes of operation, which are length-preserving. Currently Android supports AES-128-CBC-ESSIV for full-disk encryption and AES-256-XTS for file-based encryption. However, when AES performance is insufficient there is no widely accepted alternative that has sufficient performance on lower-end ARM processors.
To solve this problem, we have designed a new encryption mode called Adiantum. Adiantum allows us to use the ChaCha stream cipher in a length-preserving mode, by adapting ideas from AES-based proposals for length-preserving encryption such as HCTR and HCH. On ARM Cortex-A7, Adiantum encryption and decryption on 4096-byte sectors is about 10.6 cycles per byte, around 5x faster than AES-256-XTS.
Paper link: https://tosc.iacr.org/index.php/ToSC/article/view/7360
Announcing some security treats to protect you from attackers’ tricks
https://security.googleblog.com/2018/10/announcing-some-security-treats-to.html [security.googleblog.com]
2018-11-01 01:56
tags:
auth
browser
cloud
ux
web
Highlight here seems to be this one.
When your username and password are entered on Google’s sign-in page, we’ll run a risk assessment and only allow the sign-in if nothing looks suspicious. We’re always working to improve this analysis, and we’ll now require that JavaScript is enabled on the Google sign-in page, without which we can’t run this assessment.
I remember being impressed that gmail still worked in lynx some time back. No more.
source: HN
Mitigating Spectre with Site Isolation in Chrome
https://security.googleblog.com/2018/07/mitigating-spectre-with-site-isolation.html [security.googleblog.com]
2018-07-12 13:59
tags:
browser
defense
security
sidechannel
update
Speculative execution side-channel attacks like Spectre are a newly discovered security risk for web browsers. A website could use such attacks to steal data or login information from other websites that are open in the browser. To better mitigate these attacks, we’re excited to announce that Chrome 67 has enabled a security feature called Site Isolation on Windows, Mac, Linux, and Chrome OS. Site Isolation has been optionally available as an experimental enterprise policy since Chrome 63, but many known issues have been resolved since then, making it practical to enable by default for all desktop Chrome users.
Android Security Ecosystem Investments Pay Dividends for Pixel
http://security.googleblog.com/2018/01/android-security-ecosystem-investments.html [security.googleblog.com]
2018-01-18 19:38
tags:
android
browser
concurrency
exploit
javascript
security
This blog post covers the technical details of the exploit chain. The exploit chain includes two bugs, CVE-2017-5116 and CVE-2017-14904. CVE-2017-5116 is a V8 engine bug that is used to get remote code execution in sandboxed Chrome render process. CVE-2017-14904 is a bug in Android’s libgralloc module that is used to escape from Chrome’s sandbox. Together, this exploit chain can be used to inject arbitrary code into system_server by accessing a malicious URL in Chrome.
Securing communications between Google services with Application Layer Transport Security
http://security.googleblog.com/2017/12/securing-communications-between-google.html [security.googleblog.com]
2017-12-15 02:09
tags:
crypto
networking
security
Within our infrastructure, we protect service-to-service communications at the application layer using a system called Application Layer Transport Security (ALTS). ALTS authenticates the communication between Google services and helps protect data in transit. Today, we’re releasing a whitepaper, “Application Layer Transport Security,” that goes into detail about what ALTS is, how it protects data, and how it’s implemented at Google.
New hardware protections for your lock screen with the Google Pixel 2
https://security.googleblog.com/2017/11/lock-it-up-new-hardware-protections-for.html [security.googleblog.com]
2017-11-15 03:08
tags:
android
auth
hardware
security
The new Google Pixel 2 ships with a dedicated hardware security module designed to be robust against physical attacks. This hardware module performs lockscreen passcode verification and protects your lock screen better than software alone.
Another option for file sharing
http://security.googleblog.com/2017/02/another-option-for-file-sharing.html [security.googleblog.com]
2017-02-23 02:28
tags:
auth
beta
cloud
networking
release
storage
Security Through Transparency
https://security.googleblog.com/2017/01/security-through-transparency.html [security.googleblog.com]
2017-01-13 18:34
tags:
crypto
library
networking
release
security
ux
A solution would need to reliably scale to internet size while providing a way to establish secure communications through untrusted servers. It became clear that if we combined insights from Certificate Transparency and CONIKS we could build a system with the properties we wanted and more. The result is Key Transparency, which we’re making available as an open-source prototype today.
https://github.com/google/key-transparency/
Key Transparency provides a lookup service for generic records and a public, tamper-proof audit log of all record changes. While being publicly auditable, individual records are only revealed in response to queries for specific IDs.
Pixel Security
http://security.googleblog.com/2016/11/pixel-security-better-faster-stronger.html [security.googleblog.com]
2016-11-18 01:12
tags:
android
crypto
linux
security
Some interesting changes, trying out file based encryption.