2017年Android安全回顾（英文版）_54页_2mb

Android Security 2017 Year In Review Summary

Core Content

Google released its fourth annual Android security report in 2017, highlighting significant progress in securing the Android platform. With over 2 billion active Android devices, the company emphasized its commitment to user privacy and security across all device types, including smartphones, wearables, and automobiles. The report outlined improvements in platform security, threat detection, and user protection, driven by collaboration with device manufacturers, SoC vendors, carriers, and the broader Android community.

Main Viewpoints

• Android Security Leadership: Google claimed that Android's security protections had become industry-leading, evidenced by improved metrics and increased difficulty for attackers to exploit the platform.
• Google Play Protect: This built-in security service was a key innovation, providing real-time protection against PHAs (Potentially Harmful Applications) and offering users greater visibility and control over their device security.
• Collaborative Security Model: The open-source nature of Android allows a vast community of developers and researchers to contribute to security improvements, making it more resilient to attacks.
• Proactive Threat Detection: Google implemented features such as daily PHA scanning, offline scanning, and automatic disabling of PHAs to enhance security without requiring user intervention.
• Enterprise Security Growth: The report highlighted the expansion of enterprise security features like work profiles and managed Google Play, which increased user and business confidence in Android devices.
• System-Level Enhancements: Major updates like Android 8.0 (Oreo) and Project Treble improved security through architectural changes, modular design, and faster updates.

Key Information

Google Play Protect

• Overview: Google Play Protect is a comprehensive security service integrated into Android devices with Google Play.
• Features:
  • PHA Scanning: Daily and on-demand scanning of apps to detect and remove PHAs.
  • Offline Scanning: Added in October 2017 to block PHA installs when devices are disconnected.
  • Automatic Disabling: In November 2017, PHAs could be disabled without uninstalling, minimizing user disruption.
  • User Control: Users can check scan history and security status through the Google Play app and Settings.
• Impact: In 2017, Google Play Protect identified and removed over 39 million PHAs and blocked more than 10 million harmful app installs via offline scanning.

Security Metrics

• PHA Reduction: The annual probability of downloading a PHA from Google Play dropped from 0.04% in 2016 to 0.02% in 2017, a 50% reduction.
• Device Coverage: Over 2 billion devices running Android 4.3+ with Google Play are protected by Google Play Protect.
• Exploit Pricing: The increased difficulty and cost for exploiting Android were reflected in higher exploit prices and reduced successful attacks, as seen in the Mobile Pwn2Own contest.

Platform Security Enhancements

• Android 8.0 (Oreo): Introduced major security features, including Project Treble, which improved update efficiency and security.
• Project Treble:
  • Architecture Change: Separated the Android framework from vendor-specific hardware abstraction layers (HALs), reducing privilege and improving isolation.
  • Update Efficiency: Simplified the update process, enabling faster and more frequent security patches.
• Verified Boot 2.0 (AVB):
  • Rollback Protection: Prevented attackers from reverting to older, vulnerable versions of the system.
  • Partition Signing: Used separate signing keys for different partitions, increasing flexibility and security for device manufacturers.
  • Standardization: Simplified and standardized the boot process, reducing potential vulnerabilities.

Security Analysis & Machine Learning

• Automated App Review: Google used a combination of static and dynamic analysis to detect harmful app behavior before publishing.
• Machine Learning: Expanded the use of machine learning to classify and detect PHAs by analyzing app behavior and data patterns.
• Detection Rate: Machine learning models successfully detected 60.3% of PHAs identified by Google Play Protect in 2017.

Additional Security Features

• Safe Browsing: Integrated into Android 8.0, it protects users from phishing and PHA host websites.
• Find My Device: Enhanced with new features like last known location, last connected Wi-Fi, and improved usability for users with multiple devices.
• Developer APIs: SafetyNet and Verify Apps APIs allowed developers and enterprises to leverage Google’s security capabilities for app validation and device security checks.

Conclusion

The 2017 Android security report underscores Google’s commitment to continuous improvement in protecting users from threats. Through innovations like Google Play Protect, Project Treble, and Verified Boot 2.0, along with machine learning and collaborative security efforts, Android has significantly enhanced its security posture. The report also highlights the growing trust in Android among enterprise users and the effectiveness of its open-source model in fostering a secure ecosystem.