Google has begun to improve the security of the Android operating system at the firmware level, which is a component of the software package that interacts directly with the processor on the SoC (System on a Chip).
The initiative aims to extend the security of Android devices beyond the operating system, which relies on multi-core processors, to other on-chip processors for specific tasks such as mobile communications, media processing, or security modules.
This decision is supported by recent security research on the various components of the software package, including: Firmware.
"Over the past decade, there have been numerous publications, conversations and contest winners of Pwn2Own and CVE exploits targeting vulnerabilities in firmware running in these coprocessors," Google said.
The most well-known examples are attacks on vulnerabilities in co-processors such as Wi-Fi or cellular modules, which can be exploited wirelessly remotely to inject and execute arbitrary code.
Google says it is working with Android platform partners to improve the security of firmware that interacts with Android and is investigating a number of protections, such as:
Assembler-based cleaner that detects memory integrity issues that allow security vulnerabilities or bugs to exist during the code compilation phase. Google mentions them: BoundSan and IntSan.
Take advantage of risk mitigations such as CFI (Control Flow Integration), kCFI (Kernel Control Flow Integrity), ShadowCallStack, and Stack Canaries.
Memory security features are designed to prevent memory errors such as buffer overflow and UAF attacks related to improper use of dynamic memory during program execution. If a program does not delete in-memory pointers after a location in that memory is freed, an attacker may use the flaw to compromise the program.
One problem with incorporating damage controls is that they can negatively affect hardware performance, which poses a more difficult challenge when dealing with coprocessors designed for a specific set of functions where you don't have the same resources to do so, to power Android's main processing engine.
Google said that by improving how and where the defenses are activated, it can reduce the impact on Android system functionality, performance, and stability.
Google's efforts to improve firmware security are part of a larger effort to improve the security of the Android platform. In the future, the tech giant plans to extend the use of the Rust programming language to write firmware and perform all functions in a safe in-memory language.