New Android will be Harder to Hack

​In an effort to keep pace with Apple’s competing iOS, the latest Android version 4.1 will feature both address space layout randomization and data execution prevention.

Security researchers and veteran smart phone hackers have agreed that Google's latest Android mobile phone operating system has finally been fitted with an industry-standard defense system that is designed to protect end users against hack attacks that install malware on phone handsets. The Android version 4.1 is the first version of the Google-developed OS to include a protection known as address space layout randomization (ASLR). The ASLR system randomizes the memory locations for the library, stack, heap, and most other OS data structures to prevent hackers from knowing where their malicious payloads will be loaded, and when ASLR is combined with data execution prevention (DEP), the system can neutralize hack attacks.

Although the prior Android 4.0 was actually the first Android version to offer ASLR, the system was ineffective at stopping hack attacks because the Android's executable region, heap, libraries, and linker were loaded at the same locations each time. This arrangement made it easy for experienced hackers to design exploits to predict those spots in the Android’s memory that their malicious codes could be located. As long as a hacker knows where the codes are, they can exploit that info that to break out of everything else. Now, security experts agree that the Android version 4.1 is going to be much more difficult to hack because it is equipped with both ASLR and DEP.

Oddly enough, even though Apple's competing iOS operating system has included both ASLR and DEP for almost two years, Apple’s prior OS X “Snow Leopard” system failed to randomize many of the core parts of the operating system, making it vulnerable to hacks. Apple later fixed that flaw with the release of its OS X “Lion” system. The newest Android 4.1 system is expected to make it much harder to use a technique known as return-oriented programming when exploiting buffer overflows and other memory-corruption vulnerabilities discovered in a mobile platform. Although the 4.1 system also provides additional defenses to prevent more serious information leakage exploits, it has not yet implemented code signing. Code signing provides an additional layer of protection designed to prevent unauthorized applications from running on a device by requiring code loaded into memory to carry a valid digital signature before it can be executed, and Apple’s competing iOS system has included code signing protection for some time now.