Android-2017年Android安全回顾（英文版）-2018.3-56页-2mb

Android Security 2017 Year In Review Summary

Core Content

Android security made significant strides in 2017, with a focus on reducing the number of Potentially Harmful Applications (PHAs), improving user security visibility and control, and enhancing platform-level protections. Google Play Protect, a built-in security feature, became a central part of these efforts, offering real-time on-device and cloud-based protection against PHAs, deceptive websites, and other threats. The report highlights the collaborative nature of Android's security improvements, involving device manufacturers, SoC vendors, telecom carriers, and the broader Android community.

Main Points

• Improved PHA Detection and Removal:

  • Android devices that only download apps from Google Play are 9 times less likely to get a PHA than those from other sources.
  • Google Play Protect scans for PHAs daily and can automatically disable or remove them, reducing exposure time and impact.
  • In 2017, daily scans led to the removal of approximately 39 million PHAs.
  • Offline PHA scanning was introduced in October 2017, blocking over 10 million harmful app installs.
  • In November 2017, Google Play Protect began automatically disabling PHAs without requiring users to uninstall them.

• Enhanced Platform Security:

  • Android Oreo (8.0) introduced Project Treble, a major architectural change that improved security by modularizing the system and isolating hardware abstraction layers (HALs).
  • Verified Boot 2.0 was re-architected to work with Treble, providing stronger security through partition-specific signing keys and rollback protection.
  • Additional security features include encryption, hardware-backed security, sandboxing, SELinux, userspace hardening, and Verified Boot.

• Security Ecosystem and Collaboration:

  • Google works closely with device manufacturers, SoC vendors, and carriers to ensure consistent and effective security across the ecosystem.
  • The open source nature of Android allows for a large community of developers and researchers to identify and mitigate vulnerabilities.
  • Google's Android Security Rewards program offers some of the highest rewards in the industry, and the Mobile Pwn2Own contest showed that core Android platform exploits were not rewarded in 2017, indicating improved security.

• Enterprise Security Enhancements:

  • The work profile feature helps separate business and personal data, enhancing privacy and security for enterprise users.
  • Managed Google Play was introduced, offering a curated app store for enterprise customers.
  • The number of 30-day active devices running managed Google Play increased by 2000% in 2017.
  • The Verify Apps API allows administrators to check device security status and identify PHAs.

• Security Metrics and Improvements:

  • The annual probability of downloading a PHA from Google Play dropped from 0.04% in 2016 to 0.02% in 2017, a 50% reduction.
  • Over 2 billion devices are protected by Google Play Protect.
  • Security patches were delivered to over 30% more devices in 2017 than in 2016.
  • Google Play Protect reviewed about 23 million new apps in 2017, up 65% from 2016.
  • Machine learning models successfully detected 60.3% of PHAs identified by Google Play Protect in 2017.

Key Features and Services

• Google Play Protect:

  • Provides real-time protection against PHAs, deceptive websites, and other threats.
  • Offers user-initiated scans, automatic PHA removal, and integration with the Google Play app.
  • Is enabled on over 2 billion devices running Android 4.3+ with Google Play.

• Find My Device:

  • Helps users locate lost or stolen devices.
  • Available by default on Android 4.4 and above.
  • Features include last known location, last connected Wi-Fi access point, battery level, and improved usability for users with multiple devices.

• Safe Browsing:

  • Introduced in 2007, it helps users avoid phishing and PHA host sites.
  • In Android 8.0, it became an opt-in feature for apps.
  • Works with Chrome to protect over 3 billion devices and show over a million warnings a month.

• Developer APIs:

  • SafetyNet Attestation API: Helps apps verify they are running on a genuine Android device.
  • reCAPTCHA API: Protects apps from bots and spam.
  • Verify Apps API: Enables device security checks and PHA detection for enterprise use.

Security Trends and Analysis

• Machine Learning:

  • Used to detect and classify PHAs by analyzing app behavior and patterns.
  • In 2017, new models based on deep neural networks were introduced to improve PHA detection and classification.

• Third-Party Validation:

  • Independent security research and contests like Mobile Pwn2Own indicated improved security, with no core Android platform exploits being rewarded in 2017.

• Open Source Advantage:

  • Android's open source model allows for a large and diverse community of defenders to contribute to security improvements.
  • This community includes device manufacturers, SoC vendors, carriers, and researchers.

Conclusion

2017 marked a year of substantial progress in Android security, with a focus on user protection, platform improvements, and collaboration across the ecosystem. Google Play Protect and Android Oreo (8.0) were central to these efforts, offering enhanced security features and faster updates. The open source nature of Android and the global community of defenders played a critical role in strengthening the platform's security posture. As Android continues to evolve, the commitment to security remains strong, with ongoing efforts to protect users and their data.