Android 4.1 Jelly Bean Includes Full ASLR Implementation

Apple’s iOS and Google’s Android have been on opposite ends of the security continuum for the last few years, with iOS remaining resistant to malware and Android becoming a frequent target for attackers and malware authors. Google has been taking steps to change that in recent releases, and the latest version of its mobile operating system, Android 4.1 Jelly Bean, includes several new exploit mitigations and a more extensive implementation of ASLR to help defeat many kinds of exploits.

Android JellybeanApple’s iOS and Google’s Android have been on opposite ends of the security continuum for the last few years, with iOS remaining resistant to malware and Android becoming a frequent target for attackers and malware authors. Google has been taking steps to change that in recent releases, and the latest version of its mobile operating system, Android 4.1 Jelly Bean, includes several new exploit mitigations and a more extensive implementation of ASLR to help defeat many kinds of exploits.

Google first included ASLR (address space layout randomization) support in Android 4.0, known as Ice Cream Sandwich in Google’s dessert-centric nomenclature, but that implementation was only a partial solution. The ASLR support in Android 4.0 only randomized certain key locations in memory and did not prevent some common return-oriented programming attacks. Several other key parts of the Android operating system memory space were not randomized.

That’s changed with version 4.1. One change made in the new version is the addition of position-independent executables 

“As we mentioned in our previous post on Android ASLR, the executable mapping in the process address space was not randomized in Ice Cream Sandwich, making ROP-style attacks possible using the whole executable as a source of gadgets. In Jelly Bean, most binaries are now compiled/linked with the PIE flag, which means they will be properly randomized when executed,” Jon Oberheide of Duo Security wrote in an analysis of Jelly Bean’s exploit mitigations.

Google also randomized the heap in Android 4.1, as well as the linkers. 

“The custom Android linker was the last piece of the ASLR puzzle that was not randomized in Ice Cream Sandwich. In Jelly Bean, the linker is now randomized in the process address space. This means that the deficiencies in ICS pointed out in our previous blog post have all been addressed in Jelly Bean, giving it full stack, heap/brk, lib/mmap, linker, and executable ASLR,” Oberheide said.

The addition of full ASLR is a step in the right direction for Android, but there is still work to be done.

“While Android is still playing a bit of catch-up, other mobile platforms are moving ahead with more innovation exploit mitigation techniques, such as the in-kernel ASLR present in Apple’s iOS 6. One could claim that iOS is being proactive with such techniques, but in reality, they’re simply being reactive to the type of exploits that typically target the iOS platform. However, Apple does deserve credit for raising the barrier up to the point of kernel exploitation by employing effective userspace mitigations such NX, ASLR, and mandatory code signing. Thankfully, Android is getting there, and Jelly Bean is a major step towards that goal,” Oberheide said.

“Now that ASLR is implemented ‘fully’, it will certainly drive more interest towards the inherent weaknesses of 32-bit ASLR and other more platform/architecture-specific ASLR bypasses. Expect to see analysis showing just how weak ‘full ASLR’ is entropy-wise when dealing with the constraints of a 32-bit address space. When you start digging into the implementation-specific details of exploit mitigations, hilarity often results (case in point: the 1 bit of entropy in Windows stack cookies),” he said.

Suggested articles

Discussion

  • Anonymous on

    Dennis, your level of fan boy-ism for iOS is getting irritating. Your last article about the iPhone's "secure legacy" had a lot of creative license laced in. So does this post:

    "Apple's iOS and Google's Android have been on opposite ends of the security continuum for the last few years, with iOS remaining resistant to malware and Android becoming a frequent target for attackers and malware authors."

    Apple is not resistant to malware. In fact, there was a huge exploit last week found in the App Store itself. As for Android and Apple being at opposite ends of the security continuum, it really depends on whether you're looking at the big picture or a small subset. Yes, Android has issues with the Google Play store. However, select Android devices have FIPS 140-2 encryption certification. No iOS devices has this. Why? Because their security doesn't cut it. 

    Sure, Android has some issues but nothing (including iOS or other Apple products) is resistant to malware. C'mon...remember Flashback? I'd like to believe you're not that naive but you're making it hard. Bias is ok but at the very least, don't misinform readers- Threat Post is supposed to be about security and you're only doing a disservice by spreading falsoe information. Security is not having your head in the proverbial sand.

  • Ray on

    No reason to argue sheeple

Subscribe to our newsletter, Threatpost Today!

Get the latest breaking news delivered daily to your inbox.