Connect with us

Technology

How Google reduced Android’s safety vulnerabilities by 52%

Published

on

Featured image for How Google reduced Android

For years, Google has been working hard to make Android an increasingly secure OS. Attackers look for any loophole they can exploit, using mundane methods like phishing or more complex ones like memory safety vulnerabilities. Now, Google explains how the Safe Coding approach has managed to significantly reduce memory safety vulnerabilities in Android in recent years.

Google uses Safe Coding approach against memory safety vulnerabilities

Memory safety vulnerabilities are those that take advantage of memory-related bugs, such as buffer overflows, format string issues, or dangling pointers, to interact with or even write over the memory. These types of vulnerabilities are still widely present in software development. Developers try to attack them from various approaches, with mitigations and proactive detections predominating. However, Google is confident that Safe Coding is the ideal approach to minimize memory safety vulnerabilities, as evidenced by its results with Android.

The Safe Coding approach prioritizes the use of memory-safe programming languages from the start. However, there is software that is many years old and has millions of lines of key code developed on “memory-unsafe” languages. So, what is Google’s proposal in these cases? The answer is in the gradual transition to memory-safe languages (like Rust) for new features.

Basically, Google proposes that developers start implementing exclusively memory-safe languages when developing new features. In the meantime, old code based on unsafe languages will remain “unchanged” beyond the classic maintenance and bug fixes. This translates into achieving safe, efficient, and cost-effective interoperability between new and old code.

Advertisement

Android’s memory safety vulnerabilities fell 52% in 6 years

According to Google, the Safe Coding approach resulted in a drop in memory safety vulnerabilities in Android from 76% to 24% in just 6 years. However, the idea of keeping memory-unsafe code can seem counterintuitive. After all, if you’re looking for maximum security, your first thought would be to migrate all your code to a safe language. While this may be true, Google’s approach makes sense, and the company explains why.

Google memory safe vulnerabilities (1)

In software development, code efficiency and cost-effectiveness are key. There are tools or entire systems with many years of development behind them. This involves millions and millions of fundamental lines of code. While a company could simply start rewriting software from scratch based on memory-safe languages, the investment and effort are probably not worth it. The situation might be different in relatively new developments with not much time behind them, though.

Advantages of Safe Coding and interoperability

Google claims that the Safe Coding approach, which is based on code interoperability, is a cost-effective and practical way to adopt memory-safe code. This, in turn, makes it cost-effective, as it allows companies to leverage previous investments. The cost is significantly lower compared to rewriting software from scratch. It is also efficient because it allows new features to continue to be developed while integrating the new, safe code.

Using inherently memory-safe code also ensures lower costs in the long run. Previous approaches favored an endless cycle of “attack and defend” between developers and attackers. Relying on mitigations and proactive detections necessitated continuous action and investment in response to potential attacks. However, Safe Coding allows developers and companies to forget about this, focusing on maintaining and improving features or fixing bugs.

Advertisement

There is also greater productivity thanks to lower code rollback rates. That is, there are fewer emergency code rollback situations due to unexpected bugs. Google claims that Rust offers code rollback rates of less than half that of C++. Essentially, Safe Coding brings significant savings in time and money for businesses and developers. In today’s industry, which closely monitors profitability, this can be crucial.

Google reveals that it implemented interoperability between “Rust ↔︎ C++ and Rust ↔︎ Kotlin.” The company has also contributed both money and tools to power its approach. For example, Google gave $1,000,000 to the Rust Foundation to boost its evolution. It also provided its own interoperability tools, such as Crubit and autocxx.

Google memory safe vulnerabilities (3)

This is how the Safe Coding approach makes software more secure

You may still be wondering how an approach that keeps memory-unsafe code can lead to an exponential reduction of memory safety vulnerabilities. Google also explains this in its blog post, in a very technical way, but I’ll try to make it simple for everyone.

Through large-scale studies, USENIX Security and Google itself discovered an intriguing phenomenon. Basically, the research concluded that the vast majority of memory vulnerabilities in software have their origin in new code. A significant portion is also derived from recently modified code. Google also noticed that the density of Android memory safety vulnerabilities decreased progressively in old code.

Advertisement

Given that a significant portion of the issue stems from new code, it makes sense to focus on it, correct? This is the reasoning behind Google’s decision to adopt the Safe Coding approach. But why do more problems and vulnerabilities accumulate in new code? This is because every programming language has a fundamental property: maturation.

While the fundamental structure of a language can make it memory unsafe, successive updates can help mitigate this. So, theoretically, unsafe code used in older parts of the software can become less vulnerable over time. By combining the maturation of older code with new features developed in new, inherently memory-safe code, the result will be an exponential decrease in memory vulnerabilities.

Google memory safe vulnerabilities (2)

Google recommends Rust as a memory-safe language

Of course, porting parts of older code to languages like Rust can make things even safer. However, this isn’t always possible, at least not in a straightforward way. There are cases where moving a single block can bring down the whole castle. Google is adamant about Rust as a memory-safe programming language. So if you’re interested in learning programming or a new language to be competitive in today’s industry, Rust may be what you’re looking for.

Memory safety vulnerabilities aren’t the only ones out there. Malicious third parties will continue to look for ways to try to bypass the security layers of any software. However, having strong barriers in the “guts” of the software ensures that attackers will have to resort to more mundane and easily neutralized methods. For example, you can avoid being a victim of phishing by simply using common sense.

Advertisement

Source link

Continue Reading
Advertisement
Click to comment

You must be logged in to post a comment Login

Leave a Reply

Servers computers

Open Frame Server Rack | MI-7631 (Features)

Published

on

Open Frame Server Rack | MI-7631 (Features)



Our website: https://bit.ly/3sV6HYJ
Also available on Amazon: https://amzn.to/3M9SFKJ
And your other favorite vendors like, Walmart, Wayfair, etc!
———————————————————————————————————————————————————-
Servers, Mini PC’s, AV Equipment, Stereos, Routers, Modems & More: The Mount-It! portable server rack is versatile enough to be used as an AV rack (AV cabinet), small server rack or a classic networking rack. 1U shelf holds 44lbs, 2U shelf holds 66lbs.
———————————————————————————————————————————————————-
Follow us on:
Facebook: https://www.facebook.com/shopmountit
Instagram: https://www.instagram.com/mount_it_/
Visit our Website at: https://www.mount-it.com for more ergonomic solutions.
—————————————————————————————————————————————————–

source

Continue Reading

Technology

Why California is suing ExxonMobil for ‘perpetuating the lie’ of plastic recycling

Published

on

Why California is suing ExxonMobil for ‘perpetuating the lie’ of plastic recycling

California is going after ExxonMobil over what it calls a “campaign of deception” about plastic recycling.

The Golden State filed suit against the oil giant this week, alleging that it has misled consumers for years by marketing recycling as a way to prevent plastic pollution. Plastic is difficult and relatively costly to recycle, and very little of it ever gets rehashed, but the industry sold recycling as a feasible solution anyway.

That’s why California wants to hold ExxonMobil accountable for the role it says the company played in filling landfills and waterways with plastic. Plastics are made with fossil fuels, and California says ExxonMobil is the biggest producer of single-use plastic polymers.

California wants to hold ExxonMobil accountable

Advertisement

ExxonMobil defended itself in an emailed response to The Verge, writing: “For decades, California officials have known their recycling system isn’t effective. They failed to act, and now they seek to blame others. Instead of suing us, they could have worked with us to fix the problem and keep plastic out of landfills.”

The Verge spoke with California Attorney General Rob Bonta about plastic recycling and the allegations California makes in the landmark lawsuit.

This interview has been lightly edited for length and clarity.

I think a lot of people around my age grew up thinking that recycling plastic is a good thing. Why go after ExxonMobil over recycling? 

Advertisement

It’s a difficult confrontation of a truth, especially since ExxonMobil and others have been so successful at perpetuating the lie.

A 14-year-old who I met yesterday was just distraught over the fact that all of the plastic items that she carefully selected to make sure they have the chasing arrows on it and then make sure that after she used it, she placed it thoughtfully and diligently in the blue container for recycling — that 95 percent of the time, that item was not recycled. Instead, it went into the landfill, the environment, or incinerated. And so she was having a hard time, and I’m sure she’s not alone, and others will have the same difficulty getting their head around the actual truth.

It’s really important for us, in my view, to confront problems. You need to face problems to fix them. One of them is a major problem created by ExxonMobil. They have perpetuated the myth of recycling. They have been engaged in a decadelong campaign of deception in which they have tried to convince the public that recycling of plastics, including single-use plastics, is sustainable when it’s not. When they know that only 5 percent is recycled [in the US].

Why would they say that if they knew that it wasn’t true? Well, because it increases their profits. It makes people buy more. If people buy plastics and believe that no matter how much they use, how frequently they use it, if they engage in a single-use throwaway lifestyle, they’re still being good stewards of the environment because it’s all recyclable and will be reused again somewhere in someone else’s household as a plastic product — they’re much more likely to buy more. And that’s exactly what’s happened. 

Advertisement

Your office says it “uncovered never-before-seen documents” as part of its investigation into the role fossil fuel companies play in causing plastic pollution. Can you give examples of what you found? Did anything surprise you? 

What some of the new documents that have not been seen before really get at is this type of greenwashing by ExxonMobil called advanced recycling.

The documents reveal to us that this newest, latest, purportedly greatest form of recycling is neither advanced nor is it recycling. It’s an old technology. They basically heat the plastic so that it melts into its smallest component parts, and that’s been used before Exxon and Mobil merged. Each experimented with it and then decided to no longer pursue it.

And the process doesn’t actually recycle plastic into other plastic, which is what people think they mean when their plastic is being recycled. But 92 percent of what advanced recycling turns plastic waste into is transportation fuel and other chemicals and resins and materials. It’s mostly fuel for your car, fuel for your boat, fuel for your plane. It’s burned once and emitted into the air, into the environment. That is not recycling.

Advertisement

What would California get out of winning this case? 

Right now, the harm to California from ExxonMobil’s lies and deception and the myth of recycling are a billion dollars a year in taxpayer-funded cleanup and damage in terms of the plastic pollution crisis that we’re facing. 

Here are the things that we would get if we win this case, and we believe we will. We will get an injunction that says ExxonMobil can no longer lie and can no longer perpetuate the myth of recycling. That they need to tell the truth going forward — they can’t say that things can be recycled when they can’t. 

We’ll also get an abatement fund, which will be funded by billions of dollars from ExxonMobil. It will pay for ongoing plastic pollution in California that harms our people, our environment, our natural resources. It will pay for a re-education campaign so that people can learn that recycling is only 5 percent of plastic waste, 95 percent is not recycled. It could also be used to further research on microplastics, which are invisible plastic particles that are in our bodies, in the air, in our food, in our water, and to see what the human impact is of that. 

Advertisement

We’ll also get a disgorgement of profits, which means that any profits that were wrongly secured by ExxonMobil because of their lies would have to be turned over. We also have some civil penalties and some fees that we’re seeking.

You’re the first Filipino American attorney general in California, the state with the most FilAms in the US. I used to live in Long Beach, California, where there’s a big Southeast Asian community and also a lot of air pollution from all the vessel and truck traffic surrounding the port in that area. Does this ever get personal for you — the impact that pollution from oil and gas operations disproportionately has on immigrant communities

My oldest daughter, when she was in high school, she came up to me and she said, “Dad is this weird?” She said, “My friends and I have been talking, and we decided that we don’t want to have kids because we don’t want to bring a new life into a dying planet.” And I will always remember that. That was a gut punch. 

That one made me really think. It made me worry. It kept me up at night. It made me question whether we were on pace to fulfill our duty as elected officials, to pass on to the next generation a better society and world than we’ve had. I thought we might be certainly behind schedule and maybe at the risk of failing when it comes to protecting our climate and making sure that there’s a planet for tomorrow. So, that’s personal.

Advertisement

Our lived experiences, our values, drive us. But we will also always fulfill our duty, our ethical obligations, and make sure that we’re bringing cases that are strong and sound, based on facts and law. It’s consistent with my values, my lived experiences. The law and the facts all point in the same direction on this case.

Source link

Continue Reading

Technology

“Perfect storm” – CrowdStrike VP apologizes as Congress hearing into outage begins

Published

on

"Perfect storm" - CrowdStrike VP apologizes as Congress hearing into outage begins

Following July 2024 Crowdstrike incident, in which millions of Windows machines crashed due to a broken software update for its endpoint protection software, the company’s senior VP for counter adversary operations, Adam Meyers, appeared at a cybersecurity subcommittee hearing at the US House of Representatives to say the company was “deeply sorry”.

Meyers was left to testify in the absence of CEO George Kurtz who, per The Register, declined to testify. Explaining the issue to lawmakers, Meyers said that the company released 10 to 12 content updates, like the one that caused the major incident, per day, and that a “perfect storm of issues”, described in his written testimony (PDF), conspired to put much of the world’s IT’s systems into meltdown, requiring a manual fix.

Source link

Continue Reading

Servers computers

Rack Server, Tower Server & Blade Server (ICT Assignment)

Published

on

Rack Server,  Tower Server & Blade Server (ICT Assignment)

source

Continue Reading

Technology

Assassin’s Creed Shadows release date delayed to 2025

Published

on

Assassin's Creed Shadows release date delayed to 2025

Ubisoft has announced its highly-anticipated upcoming game Assassin’s Creed Shadows has been delayed until next year.

Instead of releasing it on 12 November as previously planned, it has been pushed back to 14 February 2025.

It follows the disappointing performance of another of the firm’s major titles, Star Wars Outlaws, and concerns from some about how Ubisoft is being run.

The game’s executive producer Marc-Alexis Cote said the developers “need more time to polish and refine the experience”.

Advertisement

“We understand this decision will come as disappointing news,” he said.

“But we sincerely believe this is in the best interest of the game.”

In a trading update sent to Ubisoft’s investors, seen by the BBC, the firm – which is headquartered in France – said despite the game being “feature complete” it needed more time.

“The learnings from the Star Wars Outlaws release led us to provide additional time to further polish the title,” it reads.

Advertisement

Star Wars Outlaws was released in August to strong reviews, but early players complained of bugs and glitches.

In its trading update, Ubisoft notes sales of the game were “softer than expected”, which it seemed to be putting down to a lack of polish.

Mr Cote said the firm would refund fans who had pre-ordered the game, and promised a free expansion to anyone who placed a new pre-order for the revised launch.

When it finally arrives, Assassin’s Creed Shadows will be the first game in the series to be set in Japan – a setting fans have been clamouring for since the series began in 2007.

Advertisement

The decision to push the game back beyond Christmas – usually a lucrative time for game sales – will not have been made lightly.

But the sales performance of Star Wars Outlaws caused Ubisoft’s shares to take a serious hit, when the firm would have been hoping the game would set it back on course.

They have fallen to a price of 11.32 euros a share at the time of writing – the lowest in a decade.

A minority investor wrote a letter to the board earlier this month calling for the company to either be taken private or sold to an investor.

Advertisement

Ubisoft co-founder and boss Yves Guillemot said the move to push back Assassin’s Creed Shadows’ launch was a result of the firm’s second quarter performance – which “fell sort of our expectations”.

“We remain committed to creating games for fans and players that everyone can enjoy,” he said.

Source link

Advertisement
Continue Reading

Servers computers

Dell Rack Server Series | Dell Tower Server Series | Price/Cost

Published

on

Dell Rack Server Series | Dell Tower Server Series | Price/Cost



TieDot Technologies Dealer, Distributor and Re-Seller Provides New Dell PowerEdge Rack Server and Tower Servers in Bangalore – India for price and availability Call: +91-9035020041 | +91-9036000187

source

Continue Reading

Trending

Copyright © 2024 WordupNews.com