I'm not sure i follow, you can upstream any security feature to AOSP, CopperheadOS dev has upstreamed lots of stuff to improve security overall which is good.
Google can do whatever they want but most of it is happening in house sadly, they could probably pay grsecurity devs to implement security features for Android & ChromeOS if they wanted to.
Re:Review: Copperhead OS
by nickpsecurity on Friday December 29, 2017 @05:55PM
(#16032580)
That last part is exactly my point. They're making billions on Android but will barely patch it. They just dont care at all since the money will go into their pockets anyway. Instead, all these small players have to show up working nearly for free swimming upstream with their enhancements making almost nothing.
Well it's already pretty hard to exploit Android, the kernel is the weak point at the moment.
I've studied the grsecurity code a lot and if you can exploit that stuff you can get high paying jobs for either red team or blue ;)
Making it harder and driving up the cost to use/write exploits and ofcourse making everyone more secure is the end goal for the sec team :D
Can you explain how 2.) follows from 1.) ? Or at least how exactly has Google incentive to keep Android insecure (especially in terms of all the security research/hardening being done by internal teams, both for Android and iOS)?
Re:Review: Copperhead OS
by nickpsecurity on Friday December 29, 2017 @05:52PM
(#16032567)
They're seperate. Bad security follows from both. For one, too little privacy is profitable for a company selling or matching against profiles obtained from surveilling their users' activities. On 2, redoing Android security or just handling it better would cost more for Google even though the problems are externalities: they cost the users, not Google. For-profit, public comoanies ignore externalities as much as possible to maximize profit.
So, Google securing Android would cost them a lot of money for fixing the customers' problems that dont affect Google. Then, it might cost them piles of money later in lost ad revenue when now-private services make customers black boxes of sorts.
I think there's a lot of middle ground to explore but surveillance or public companies don't usually go for it. Offering a paid, surveillance-off version of each ad service is one of those. You will rarely see that as simple as it is to do.
You're deliberately ignoring the constant security updates and patches Google is pushing, both monthly (https://source.android.com/security/bulletin/) and as part of OS updates: (https://android-developers.googleblog.com/2017/12/double-stu...).
1. They're a surveillance company that has more actual and potential earnings the more they know about their customers. They get good margins when their customers lack privacy with devices locked into Google by default.
2. They don't care about users' safety since make billions off Android platform but wont even patch vulnerabilities quickly. They have enough money to design a server UNIX from scratch plus a full-custom CPU plus mitigations from code injection at CPU level with all that leaving them with a few billion in revenue left out of Android alone. They just don't care since they're a public company about squeezing out every ounce of profit.
So, their incentives ensure they will leave the devices insecure. Someone will have to make their own versions that are secure like Copperhead and separation kernels before them (eg OK Labs) did. Alternatively, convince Google to offer a paid, secure option for their own internal use if nothing else with them recovering costs by eating up the cryptophone market's revenues.