STEPHAN SOMOGYI: Hello, and welcome to the 2020 Android
Security Update.
My name is Stephan Somogyi, and I'm on the Android Platform
Security Team.
During the next few minutes, I'll be talking about some
of the things we've done over the last year since IoT 2019,
things that are new in Android 11,
and what we're thinking about for the coming year.
Before we get into any product details,
it's important to consider how Android approaches security
at the platform level.
Android runs on over two billion devices worldwide.
Some of these are high-end expensive devices,
some are mid-range, and some are low-cost devices.
Android security doesn't distinguish between any
of these at the platform level.
Our goal is to provide security to all Android users.
We believe strongly in defense in depth,
and our general security philosophy
reflects this attitude.
Throughout Android, you'll find multiple independent layers
of security architecture and mechanisms designed
to work together seamlessly to make Android holistically
secure.
But this isn't enough.
It's important to us that we can demonstrate
that the security we build is as verifiable as we can make it.
Transparency isn't only about open source.
It's also about building things like the Android security
transparency report, which delivers
data about the state of Android security across the ecosystem.
We also actively and continuously
collaborate with other security teams
at Google, who have a wide range of skills and experience
ranging from the Google account system, authentication
authorization, as well as infrastructure security.
The Android security and privacy team
has several focus areas that combine
to provide comprehensive security to all Android
devices.
Applications safety engineering protects Android devices
from application-based threats.
Platform security is dedicated to making
sure the underlying Android infrastructure is
as secure and resilient as it can be.
The security assurance team works
on our vulnerability rewards program
and on other ways of assuring the Android platform is
as resilient as possible.
As we have for many years now, we'd
like to share with you an updated
set of statistics about how we measure security
across Android.
In 2019, the total amount awarded to security researchers
who submitted vulnerabilities to one of our vulnerability
rewards programs was $6.5 million.
This is almost twice the $3.4 million
that Google awarded in 2018.
The Android-specific vulnerability rewards program
awarded $1.9 million during 2019.
This is up from 2018's $1.7 million.
For the first developer preview of Android 11,
researchers who submitted a vulnerability between May 7
and June 7 of this year were eligible for a 50% bonus
if that vulnerability was new to Android.
We made this recording just as we wrapped up this program.
After evaluating the submissions,
we awarded $16,000 of extra Android
11 bonus on top of the $32,000 that the submitting researchers
received under the regular rules.
From our perspective, this extra bonus was totally worthwhile.
We hope this is true for the researchers as well.
Making this bonus available reflects the diligent work
that the entire Android team did during Android 11's
development, our confidence that we've consistently
improved Android 11 security, and our experience
that external security research scrutiny is valuable in making
our products even better.
At first glance, it would seem logical to quantify
exploitation difficulty in a technical unit of measurement.
But economics is, in many ways, an even better measure
of a system's vulnerability.
How cheap or how expensive is it to compromise an Android
device?
Broadly speaking, anything that increases the cost
to an attacker is a worthwhile risk mitigation.
For example, in Pixel 3, we introduced
the Google-developed Titan M security processor
to protect cryptographic keys, adding
a new and formidable layer of defense
to both credential storage and overall device integrity.
We have such confidence in the Titan M security
that it's currently the top prize in the Android Security
Rewards program.
Submission of a full chain remote code execution
exploit with persistence will be rewarded with $1 million.
The Google Play Security Rewards program expanded its scope
to any application in the Play Store
with over 100 million installs.
This program resulted in over $650,000
being awarded during the second half of 2019.
Another perspective on the security of Android platforms
is third-party pricing for so-called zero days, previously
undiscovered vulnerabilities.
MobilePwn2Own is held during the fourth quarter of every year.
If you look at the evolution across 2017, 2018, and 2019,
you'll see that exploit pricing has become even
between iPhone and Pixel.
During the 2018 competition, there
are no exploits that successfully
compromised a Pixel device.
None of the exploits that targeted other Android
devices in the competition used security vulnerability
within AOSP.
Another important measure of a platform security
is how up to date devices are from a security patch
perspective.
At the end of 2018, 336 of the most popular Android devices
had 90-day or better security updates.
By the end of 2019, that number had
grown to 924 device models that have 90-day or better security
updates.
That is a very good curve for the security
of the overall Android ecosystem.
The Android Platform Security team
is in the infrastructure business.
We're security plumbers.
As anyone who's ever built infrastructure knows,
making meaningful change rarely happens quickly.
This chart shows the percentage of apps
that block clear text by default before it's
sent over the network.
At the end of 2019, 80% of Android apps
were encrypting their network traffic
by default. If you count only apps targeting
Android 9 or higher, that figure increases to 90%.
This entire effort began in 2016 with Android 7.
From a security perspective, the Android 11 release
is all about fit and finish.
This year, we focused on making sure the internals, the parts
that are often invisible to the user, got plenty of attention.
Project Mainline was introduced with Android 10.
Its main benefit is to increase the modularity and granularity
of platform subsystems within Android.
Earlier this year, thanks to Project Mainline,
we were able to quickly fix a critical vulnerability
in the media decoding subsystem.
Android 11 adds new modules and maintains the security
properties of existing ones.
For example, conscript, which provides
cryptographic primitives, maintained its Phipps
validation status in Android 11.
Biometrics is the final thing we want
to mention in terms of improvements in Android 11,
although this one is particularly
aimed at developers.
We've gotten very clear feedback from our ecosystem partners
that our previous taxonomy for the strength
of biometric authenticators wasn't clear enough.
Starting with Android 11, we're going
to use new terminology to make it less confusing for everybody
to understand the comparative strengths
of various biometric authenticators.
From here onward, the strongest class of biometric
will be known as class three, and weaker biometrics
will be class two and class one.
While at first this seems a somewhat trivial change
to even call out, it underscores the importance of attention
to detail and security.
Something that appears so simple turns out
to be quite important to our developers,
and eventually, our users, who are
the real beneficiaries of strong authentication technologies.
And that covers it for the new security features in Android 11
and for this year's Android security update.
Thank you very much for listening.