Researcher: Jellybean fixes Ice Cream Sandwich’s exploit weakness

Android Jelly Bean (4.1) comes with a notable exploit mitigation enhancement, but it could still be some months before it reaches users.

The arrival of Jelly Bean means Android now contains a “full” implementation of Address Space Layout Randomisation (ASLR), marking a significant improvement in Ice Cream Sandwich’s (ICS 4.0) in-built methods of thwarting attacks that exploit memory corruption vulnerabilities, according to Duo Security researcher Jon Oberheide.

ASLR was implemented in ICS 4.0, but as Oberheide points out, it was only partial, and was left exposed to “ROP” or return oriented programming attacks. The fuller implementation significantly reduces the chances those attacks will be successful.

Oberheid had previously said ASLR in ICS was “largely ineffective for mitigating real-world attacks, due to the lack of randomisation of the executable and linker memory regions.”

Accuvant security researcher and smartphone exploit specialist Charlie Miller told Ars Technica the addition of full ASLR and DEP means it will be “pretty difficult” to write exploits for the OS.

ASLR and another important exploit mitigation technology Data Execution Prevention (DEP) are migrating from well-established implementations in desktop OSes to mobile devices, but are at different stages of development in Apple’s iOS and Google’s Android.

Oberheid suggests iOS 6 takes anti-exploitation the next level with kernel level ASLR, but also points out that Android could achieve a lot by enforcing mandatory code signing. While that is already employed through the iOS App Store, it is not perfect either and was last year circumvented by Miller.

Despite the anti-exploit improvements in Jelly Bean, it’s unlikely users will benefit from that until many months later, with many Australian carriers only releasing ICS in the past few weeks.

Released in March this year, ICS reached 10.7 per cent share of all Androids in early July, while Gingerbread (2.3-2.32) dominated at 63 per cent, followed by Froyo (2.2) at 17.7 per cent.

Follow @CSO_Australia and sign up to the CSO Australia newsletter.

• Tweet