10-04-2020 , 07:44 PM
Google today announced the launch of a new program specifically designed to deal with security vulnerabilities the company finds in third-party Android devices and software serviced by Android OEMs.
"Google’s Android Security & Privacy team has launched the Android Partner Vulnerability Initiative (APVI) to manage security issues specific to Android OEMs," Program Manager Kylie McRoberts and Security Engineer Alec Guertin explained.
"The APVI is designed to drive remediation and provide transparency to users about issues we have discovered at Google that affect device models shipped by Android partners."
Closing the security gap:
This program adds to Google's other initiatives surrounding its efforts to discover and address Android security issues with the help of security researchers and the Android community including the Android Security Rewards Program (ASR) (for Android system) and the Google Play Security Rewards Program (for third-party apps).
Issues affecting the Android Open Source Project (AOSP) impact all Android devices and are disclosed through ASR reports released via Android Security Bulletins (ASB) each month.
However, vulnerabilities Google discovers outside of the Android Open Source Project (AOSP) based code that only affect a small subset of Android OEM devices weren't previously disclosed via a public program.
The AVPI initiative fixes this and improves overall Android OEM device security by letting users know when Google finds security bugs in Android device code that is not serviced or maintained by Google.
"The APVI has already processed a number of security issues, improving user protection against permissions bypasses, execution of code in the kernel, credential leaks, and generation of unencrypted backups," Google said.
Several Android OEM vulnerabilities already disclosed:
Among the Google-discovered issues already processed through the AVPI, Google highlighted weaknesses that could lead to "permissions bypasses, execution of code in the kernel, credential leaks and generation of unencrypted backups" on Mediatek, Digitime, Meizu, ZTE, Transsion, Vivo, Oppo, or Huawei devices.
Google provided several examples of vulnerabilities .previously discovered in Android OEM devices including a permission bypass issue impacting a third-party pre-installed over-the-air (OTA) update tool, credential leaking via the built-in password manager of a popular pre-installed web browser, and unnecessary permissions access for privileged apps.
Future vulnerability disclosures of Google-discovered security issues under the AVPI as well as info on already disclosed issues can be found at https://bugs.chromium.org/p/apvi/.
Yesterday, Google also announced the Fuzzilli Research Grant Program, a research grant designed to sponsors researchers' efforts to discover security issues in web browser JavaScript engines — JavaScriptCore (Safari), v8 (Chrome, Edge), or Spidermonkey (Firefox) — through fuzz testing (aka fuzzing).
"JavaScript engine security continues to be critical for user safety, as demonstrated by recent in-the-wild 0day exploits abusing vulnerabilities in v8, the JavaScript engine behind Chrome," according to Project Zero security researcher Samuel Groß.
Source
"Google’s Android Security & Privacy team has launched the Android Partner Vulnerability Initiative (APVI) to manage security issues specific to Android OEMs," Program Manager Kylie McRoberts and Security Engineer Alec Guertin explained.
"The APVI is designed to drive remediation and provide transparency to users about issues we have discovered at Google that affect device models shipped by Android partners."
Closing the security gap:
This program adds to Google's other initiatives surrounding its efforts to discover and address Android security issues with the help of security researchers and the Android community including the Android Security Rewards Program (ASR) (for Android system) and the Google Play Security Rewards Program (for third-party apps).
Issues affecting the Android Open Source Project (AOSP) impact all Android devices and are disclosed through ASR reports released via Android Security Bulletins (ASB) each month.
However, vulnerabilities Google discovers outside of the Android Open Source Project (AOSP) based code that only affect a small subset of Android OEM devices weren't previously disclosed via a public program.
The AVPI initiative fixes this and improves overall Android OEM device security by letting users know when Google finds security bugs in Android device code that is not serviced or maintained by Google.
"The APVI has already processed a number of security issues, improving user protection against permissions bypasses, execution of code in the kernel, credential leaks, and generation of unencrypted backups," Google said.
Several Android OEM vulnerabilities already disclosed:
Among the Google-discovered issues already processed through the AVPI, Google highlighted weaknesses that could lead to "permissions bypasses, execution of code in the kernel, credential leaks and generation of unencrypted backups" on Mediatek, Digitime, Meizu, ZTE, Transsion, Vivo, Oppo, or Huawei devices.
Google provided several examples of vulnerabilities .previously discovered in Android OEM devices including a permission bypass issue impacting a third-party pre-installed over-the-air (OTA) update tool, credential leaking via the built-in password manager of a popular pre-installed web browser, and unnecessary permissions access for privileged apps.
Future vulnerability disclosures of Google-discovered security issues under the AVPI as well as info on already disclosed issues can be found at https://bugs.chromium.org/p/apvi/.
Yesterday, Google also announced the Fuzzilli Research Grant Program, a research grant designed to sponsors researchers' efforts to discover security issues in web browser JavaScript engines — JavaScriptCore (Safari), v8 (Chrome, Edge), or Spidermonkey (Firefox) — through fuzz testing (aka fuzzing).
"JavaScript engine security continues to be critical for user safety, as demonstrated by recent in-the-wild 0day exploits abusing vulnerabilities in v8, the JavaScript engine behind Chrome," according to Project Zero security researcher Samuel Groß.
Source