"Protection from zero-days" -- how can you make a claim like this?
CopperheadOS: A hardened open-source operating system based on Android
71–80 of 105 posts
Re: CopperheadOS: A hardened open-source operating system based on Android
#72Earlier quoted context omitted.
I'm not affiliated with Copperhead at all, but I am familiar with the sorts of techniques they are using. Exploit mitigations, such as Address Space Layout Randomization, Control-Flow Integrity, Fine-grained Randomization, etc. provide a layer of hardening to make exploitation of a source code vulnerability harder, or even not possible on the protected device. The bug (zero-day) still exists, it's just not as exploit…
They talk a bit about them in these posts: https://copperhead.co/blog/2015/06/11/android-pax https://copperhead.co/blog/2015/07/27/hardening-bionic https://copperhead.co/blog/2015/05/11/aslr-android-zygote
https://copperhead.co/android/docs/technical_overview covers much more and is mostly up-to-date.
Re: CopperheadOS: A hardened open-source operating system based on Android
#73I like to see it enable the user to logs and optionally block connections attempt base on IP/dns names with both whitelist and blacklist. And track/logs all of them per Apk.
Whitelists and blacklists are useless security theatre. Any non-blacklisted IP could proxy to a blacklisted IP, and whitelisting just means you have to jump through hoops just to get your work done, which users will always do.
Re: CopperheadOS: A hardened open-source operating system based on Android
#74"Protection from zero-days" -- how can you make a claim like this?
"Zero-day protection" is marketing-speak for what security engineers call "exploit mitigations." Of course they don't prevent exploits; they mitigate them. Pretty typical that the marketing term is an exaggeration of the more accurate engineering one.
Exploitation can certainly be outright prevented. For example, automatic integer overflow checking reduces any integer overflow vulnerabilities to at most a denial of service attack (clean abort). _FORTIFY_SOURCE (including the more dynamic implementation in CopperheadOS) does the same thing for a large subset of buffer overflows, as does -fsanitize=bounds which is globally enabled.
Re: CopperheadOS: A hardened open-source operating system based on Android
#75Re: CopperheadOS: A hardened open-source operating system based on Android
#76You had me interested until "..based on Android."
What we need is more original codebases in the mobile ecosystem, not endless modifications on top of the same old shaky foundation.
Re: CopperheadOS: A hardened open-source operating system based on Android
#77Couldn't find the Android version it's based on?
6.0.1_r20 for the Nexus 5 and Nexus 9, and 6.0.1_r24 for the Nexus 5X. You can see the versions of the downloads page (it uses AOSP_TAG.COPPERHEADOS_TIMESTAMP) It's the same as stock. It will move to 7.0 shortly after it's released.
Re: CopperheadOS: A hardened open-source operating system based on Android
#78You had me interested until "..based on Android." What we need is more original codebases in the mobile ecosystem, not endless modifications on top of the same old shaky foundation.
That shaky foundation also has a large ecosystem of useful software. I guess it doesn't need to be "based on Android" to run Android apps, though.
I'm not too familiar with security on Android (much more familiar with iOS) – what are the weakest links?
Re: CopperheadOS: A hardened open-source operating system based on Android
#79Earlier quoted context omitted.
ASLR is a band-aid. If you need it, your system is already insecure. It's just that the attacker may need to crash your system a few times before they get in.
All systems need it. All systems are already insecure. All desktops systems already implement it. This has been the situation for years now.
No, they need tech that either contains the attack in its own partition or prevents it entirely by language/compiler-level action on the target. Both exist in academia and commercial sector with varying capabilities, prices, maturity levels, and so on. Most such things are rejected in favor of band-aids like ASLR.
And the systems continue to get hacked through the very holes covered in bandaids. As he said, if you're using a bandaid, you're covering up something inherently broken.
Re: CopperheadOS: A hardened open-source operating system based on Android
#80Interesting development. Good to see another project trying to improve the mobile situation for Android. Getting us off iOS or Android without loosing all the good apps probably isn't happening due to lock-in effects and patent issues. At the least, projects that try to allow safer use of Android apps will benefit a lot of people.