In the first test for its users response speed, Google just released a patch to its Android operating system that corrects a bug in its browser that came to light about ten days ago, as well as some other minor details. The update process was reportedly smooth and completely automated for T-Mobile’s G1, the only commercially available phone that currently features Google’s mobile operating system.
Last week Charlie Miller, security expert, had found a security bug in the Android’s browser that could have allowed the execution of malware, software specifically designed to damage the data contained on the phone. Starting Saturday afternoon, G1 users are receiving a message inviting them to download a new, patched version of the browser, which is said to keep all the personal information — bookmarks, settings, etc. — in place. The update also brings a series of other fixes that should increase the overall efficiency of the platform (and, consequently, the battery life of all Android hand-held devices).
The first bug discovery was highly publicized by the specialized press all over the world: Miller, a security researcher that had already rooted out high-profile bugs in both Apple’s Mac OS X operating system and the iPhone, identified the bug and reported it to Google last week, on October 20th. Not much is known about the vulnerability, as Miller refused to comment on it because of security reasons: it is however known that it is a “buffer overflow” vulnerability that can be exploited by having users visiting a malicious website: “There’s a chance that the attacker could execute malicious code remotely with the same privileges as the user of the phone’s browser“, Miller said.
According to Miller’s reconstruction featured on techworld, after alerting Google a security researcher from the Android team contacted him privately for more information, also asking for what is commonly referred to as a “responsible disclosure” — in other terms, that he withhold information until a patch was released: at this point, Miller refused to wait to announce his discovery, even though he never disclosed details on how the vulnerability could be used to the advantage of crackers.
Miller’s justification for his own actions is that people should know there is a problem with the platform before they decide to buy the G1. Indeed, since much credit is attributed in the security and developer community to the person who first finds a critical bug, this behaviour is considered quite common and respectful for both the producer and the end users who are to buy the final product: “I don’t want to help the bad guys either, but people should have all the information before they make a decision to buy [the phone]. I think I’m totally in the right here“, he added.
A somewhat more detailed description of the problem can be found on the ISE site. Here it is explained that Android relies on 80 different open source packages, and that the vulnerability derives from the Android platform not using the most up-to-date version of some of them: while this is a common developing choice because of stability issues, in this case it meant the platform missed a recent update from a third-party component that corrected the problem.
Because of the publicity the vulnerability reached among the security community, Google representatives released a statement saying that the threat was not as big as it had been portrayed by some. In fact, as later pointed out by Miller himself, the architecture of the Android platform as a whole is more secure than that of the iPhone because of its compartmentalization and application sandboxing, so that each application runs as its own user and can only access its own files.




[07.01.2009 16:09], Indonesia - Jakarta:
[07.01.2009 15:47], Malaysia - Unknown City:
[07.01.2009 12:10], Japan - Unknown City:
[07.01.2009 12:07], Italy - Siena:
[07.01.2009 11:48], United States - Mountain View: