Security-Portal.cz je internetový portál zaměřený na počítačovou bezpečnost, hacking, anonymitu, počítačové sítě, programování, šifrování, exploity, Linux a BSD systémy. Provozuje spoustu zajímavých služeb a podporuje příznivce v zajímavých projektech.

Kategorie

Lockscreen and Authentication Improvements in Android 11

Google Security Blog - 22 Září, 2020 - 23:10
Posted by Haining Chen, Vishwath Mohan, Kevin Chyn and Liz Louis, Android Security Team
[Cross-posted from the Android Developers Blog]
As phones become faster and smarter, they play increasingly important roles in our lives, functioning as our extended memory, our connection to the world at large, and often the primary interface for communication with friends, family, and wider communities. It is only natural that as part of this evolution, we’ve come to entrust our phones with our most private information, and in many ways treat them as extensions of our digital and physical identities.

This trust is paramount to the Android Security team. The team focuses on ensuring that Android devices respect the privacy and sensitivity of user data. A fundamental aspect of this work centers around the lockscreen, which acts as the proverbial front door to our devices. After all, the lockscreen ensures that only the intended user(s) of a device can access their private data.

This blog post outlines recent improvements around how users interact with the lockscreen on Android devices and more generally with authentication. In particular, we focus on two categories of authentication that present both immense potential as well as potentially immense risk if not designed well: biometrics and environmental modalities.

The tiered authentication model

Before getting into the details of lockscreen and authentication improvements, we first want to establish some context to help relate these improvements to each other. A good way to envision these changes is to fit them into the framework of the tiered authentication model, a conceptual classification of all the different authentication modalities on Android, how they relate to each other, and how they are constrained based on this classification.

The model itself is fairly simple, classifying authentication modalities into three buckets of decreasing levels of security and commensurately increasing constraints. The primary tier is the least constrained in the sense that users only need to re-enter a primary modality under certain situations (for example, after each boot or every 72 hours) in order to use its capability. The secondary and tertiary tiers are more constrained because they cannot be set up and used without having a primary modality enrolled first and they have more constraints further restricting their capabilities.

  1. Primary Tier - Knowledge Factor: The first tier consists of modalities that rely on knowledge factors, or something the user knows, for example, a PIN, pattern, or password. Good high-entropy knowledge factors, such as complex passwords that are hard to guess, offer the highest potential guarantee of identity.

    Knowledge factors are especially useful on Android becauses devices offer hardware backed brute-force protection with exponential-backoff, meaning Android devices prevent attackers from repeatedly guessing a PIN, pattern, or password by having hardware backed timeouts after every 5 incorrect attempts. Knowledge factors also confer additional benefits to all users that use them, such as File Based Encryption (FBE) and encrypted device backup.

  1. Secondary Tier - Biometrics: The second tier consists primarily of biometrics, or something the user is. Face or fingerprint based authentications are examples of secondary authentication modalities. Biometrics offer a more convenient but potentially less secure way of confirming your identity with a device.

We will delve into Android biometrics in the next section.

  1. The Tertiary Tier - Environmental: The last tier includes modalities that rely on something the user has. This could either be a physical token, such as with Smart Lock’s Trusted Devices where a phone can be unlocked when paired with a safelisted bluetooth device. Or it could be something inherent to the physical environment around the device, such as with Smart Lock’s Trusted Places where a phone can be unlocked when it is taken to a safelisted location. Improvements to tertiary authentication

    While both Trusted Places and Trusted Devices (and tertiary modalities in general) offer convenient ways to get access to the contents of your device, the fundamental issue they share is that they are ultimately a poor proxy for user identity. For example, an attacker could unlock a misplaced phone that uses Trusted Place simply by driving it past the user's home, or with moderate amount of effort, spoofing a GPS signal using off-the-shelf Software Defined Radios and some mild scripting. Similarly with Trusted Device, access to a safelisted bluetooth device also gives access to all data on the user’s phone.

    Because of this, a major improvement has been made to the environmental tier in Android 10. The Tertiary tier was switched from an active unlock mechanism into an extending unlock mechanism instead. In this new mode, a tertiary tier modality can no longer unlock a locked device. Instead, if the device is first unlocked using either a primary or secondary modality, it can continue to keep it in the unlocked state for a maximum of four hours.

A closer look at Android biometrics

Biometric implementations come with a wide variety of security characteristics, so we rely on the following two key factors to determine the security of a particular implementation:

  1. Architectural security: The resilience of a biometric pipeline against kernel or platform compromise. A pipeline is considered secure if kernel and platform compromises don’t grant the ability to either read raw biometric data, or inject synthetic data into the pipeline to influence an authentication decision.
  2. Spoofability: Is measured using the Spoof Acceptance Rate (SAR). SAR is a metric first introduced in Android P, and is intended to measure how resilient a biometric is against a dedicated attacker. Read more about SAR and its measurement in Measuring Biometric Unlock Security.

We use these two factors to classify biometrics into one of three different classes in decreasing order of security:

  • Class 3 (formerly Strong)
  • Class 2 (formerly Weak)
  • Class 1 (formerly Convenience)

Each class comes with an associated set of constraints that aim to balance their ease of use with the level of security they offer.

These constraints reflect the length of time before a biometric falls back to primary authentication, and the allowed application integration. For example, a Class 3 biometric enjoys the longest timeouts and offers all integration options for apps, while a Class 1 biometric has the shortest timeouts and no options for app integration. You can see a summary of the details in the table below, or the full details in the Android Android Compatibility Definition Document (CDD).

1 App integration means exposing an API to apps (e.g., via integration with BiometricPrompt/BiometricManager, androidx.biometric, or FIDO2 APIs)

2 Keystore integration means integrating Keystore, e.g., to release app auth-bound keys

Benefits and caveats

Biometrics provide convenience to users while maintaining a high level of security. Because users need to set up a primary authentication modality in order to use biometrics, it helps boost the lockscreen adoption (we see an average of 20% higher lockscreen adoption on devices that offer biometrics versus those that do not). This allows more users to benefit from the security features that the lockscreen provides: gates unauthorized access to sensitive user data and also confers other advantages of a primary authentication modality to these users, such as encrypted backups. Finally, biometrics also help reduce shoulder surfing attacks in which an attacker tries to reproduce a PIN, pattern, or password after observing a user entering the credential.

However, it is important that users understand the trade-offs involved with the use of biometrics. Primary among these is that no biometric system is foolproof. This is true not just on Android, but across all operating systems, form-factors, and technologies. For example, a face biometric implementation might be fooled by family members who resemble the user or a 3D mask of the user. A fingerprint biometric implementation could potentially be bypassed by a spoof made from latent fingerprints of the user. Although anti-spoofing or Presentation Attack Detection (PAD) technologies have been actively developed to mitigate such spoofing attacks, they are mitigations, not preventions.

One effort that Android has made to mitigate the potential risk of using biometrics is the lockdown mode introduced in Android P. Android users can use this feature to temporarily disable biometrics, together with Smart Lock (for example, Trusted Places and Trusted Devices) as well as notifications on the lock screen, when they feel the need to do so.

To use the lockdown mode, users first need to set up a primary authentication modality and then enable it in settings. The exact setting where the lockdown mode can be enabled varies by device models, and on a Google Pixel 4 device it is under Settings > Display > Lock screen > Show lockdown option. Once enabled, users can trigger the lockdown mode by holding the power button and then clicking the Lockdown icon on the power menu. A device in lockdown mode will return to the non-lockdown state after a primary authentication modality (such as a PIN, pattern, or password) is used to unlock the device.

BiometricPrompt - New APIs

In order for developers to benefit from the security guarantee provided by Android biometrics and to easily integrate biometric authentication into their apps to better protect sensitive user data, we introduced the BiometricPrompt APIs in Android P.

There are several benefits of using the BiometricPrompt APIs. Most importantly, these APIs allow app developers to target biometrics in a modality-agnostic way across different Android devices (that is, BiometricPrompt can be used as a single integration point for various biometric modalities supported on devices), while controlling the security guarantees that the authentication needs to provide (such as requiring Class 3 or Class 2 biometrics, with device credential as a fallback). In this way, it helps protect app data with a second layer of defenses (in addition to the lockscreen) and in turn respects the sensitivity of user data. Furthermore, BiometricPrompt provides a persistent UI with customization options for certain information (for example, title and description), offering a consistent user experience across biometric modalities and across Android devices.

As shown in the following architecture diagram, apps can integrate with biometrics on Android devices through either the framework API or the support library (that is, androidx.biometric for backward compatibility). One thing to note is that FingerprintManager is deprecated because developers are encouraged to migrate to BiometricPrompt for modality-agnostic authentications. Improvements to BiometricPrompt

Android 10 introduced the BiometricManager class that developers can use to query the availability of biometric authentication and included fingerprint and face authentication integration for BiometricPrompt.

In Android 11, we introduce new features such as the BiometricManager.Authenticators interface which allows developers to specify the authentication types accepted by their apps, as well as additional support for auth-per-use keys within the BiometricPrompt class.

More details can be found in the Android 11 preview and Android Biometrics documentation. Read more about BiometricPrompt API usage in our blog post Using BiometricPrompt with CryptoObject: How and Why and our codelab Login with Biometrics on Android.

Kategorie: Hacking & Security

Google Chrome Bugs Open Browsers to Attack

Threatpost - 22 Září, 2020 - 20:44
Google's new release of Chrome 85.0.4183.121 for Windows, Mac, and Linux fixes 10 security flaws.
Kategorie: Hacking & Security

Known Citrix Workspace Bug Open to New Attack Vector

Threatpost - 22 Září, 2020 - 19:20
Windows MSI files provide an opening for attackers even though the bug was mostly patched in July.
Kategorie: Hacking & Security

Fedora Sliverblue: Prakticky nezničitelný Linux pro mámu, tátu i pro tebe

Zive.cz - bezpečnost - 22 Září, 2020 - 19:00
** Linux je zdarma a je pro něj mnohem méně malwaru ** Jenže pro většinu je neznámý a snadno ho sami poškodí ** Fedora Silverblue je read-only. Rozbijete ji jen velmi těžko
Kategorie: Hacking & Security

Nový zvonek s kamerou od Netatmo ukáže návštěvu bez složité instalace a paušálů

Zive.cz - bezpečnost - 22 Září, 2020 - 18:45
Už v lednu 2019 jsem na CESu poprvé viděl nového člena rodiny Netatmo - chytrý zvonek. Původně měl přijít na trh na podzim 2019, ale trvalo to podstatně déle. Teprve nyní (od 28. září) se začne prodávat za cenu osm tisíc korun. Dva roky dlouhé otálení přitom nemělo nějaký vliv na vnější design, ...
Kategorie: Hacking & Security

Microsoft Overhauls Patch Tuesday Security Update Guide

Threatpost - 22 Září, 2020 - 18:15
Microsoft announced a new Security Guide to help cybersecurity professionals more quickly untangle relevant bugs in its monthly security bulletins.
Kategorie: Hacking & Security

Firefox 81 Release Kills High-Severity Code-Execution Bugs

Threatpost - 22 Září, 2020 - 17:14
Mozilla has fixed three high-severity flaws with the release of Firefox 81 and Firefox ESR 78.3.
Kategorie: Hacking & Security

Activision Refutes Claims of 500K-Account Hack

Threatpost - 22 Září, 2020 - 17:10
The Call of Duty behemoth said that the reports of widespread hacks are false.
Kategorie: Hacking & Security

Google Cloud Buckets Exposed in Rampant Misconfiguration

Threatpost - 22 Září, 2020 - 16:12
A too-large percentage of cloud databases containing highly sensitive information are publicly available, an analysis shows.
Kategorie: Hacking & Security

Unsecured Microsoft Bing Server Exposed Users' Search Queries and Location

The Hacker News - 22 Září, 2020 - 15:18
A back-end server associated with Microsoft Bing exposed sensitive data of the search engine's mobile application users, including search queries, device details, and GPS coordinates, among others. The logging database, however, doesn't include any personal details such as names or addresses. The data leak, discovered by Ata Hakcil of WizCase on September 12, is a massive 6.5TB cache of log
Kategorie: Hacking & Security

Top 5 ways ransomware is delivered and deployed

InfoSec Institute Resources - 22 Září, 2020 - 15:05

Introduction If your computer has not yet been affected by ransomware, odds are it could soon be. With ransom payments averaging more than $80,000 in Q4 2019, the coveted malicious software is fast becoming cybercriminals’ weapon of choice. Ransomware utilizes internal systems to encrypt a chain of files and deactivate recovery processes, preventing access to […]

The post Top 5 ways ransomware is delivered and deployed appeared first on Infosec Resources.

Top 5 ways ransomware is delivered and deployed was first posted on September 22, 2020 at 8:05 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
Kategorie: Hacking & Security

Security theatrics or strategy? Optimizing security budget efficiency and effectiveness

InfoSec Institute Resources - 22 Září, 2020 - 15:03

Introduction I am a staunch advocate of the consideration of human behavior in cybersecurity threat mitigation. The discipline of behavioral ecology is a good place to start. This subset of evolutionary biology observes how individuals and groups react to given environmental conditions — including the interplay between people and an environment.  The digital world is […]

The post Security theatrics or strategy? Optimizing security budget efficiency and effectiveness appeared first on Infosec Resources.

Security theatrics or strategy? Optimizing security budget efficiency and effectiveness was first posted on September 22, 2020 at 8:03 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
Kategorie: Hacking & Security

Exploiting leading antivirus software: RACK911 Labs details vulnerabilities

InfoSec Institute Resources - 22 Září, 2020 - 15:01

How an antivirus works Antivirus programs are designed to keep your computer safe from malware and other malicious content. In order to minimize the damage that a potentially malicious file can pose to a computer, antivirus programs are designed to scan files as soon as they are installed on a computer. If they are determined […]

The post Exploiting leading antivirus software: RACK911 Labs details vulnerabilities appeared first on Infosec Resources.

Exploiting leading antivirus software: RACK911 Labs details vulnerabilities was first posted on September 22, 2020 at 8:01 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
Kategorie: Hacking & Security

British Hacker Sentenced to 5 Years for Blackmailing U.S. Companies

The Hacker News - 22 Září, 2020 - 13:32
A UK man who threatened to publicly release stolen confidential information unless the victims agreed to fulfill his digital extortion demands has finally pleaded guilty on Monday at U.S. federal district court in St. Louis, Missouri. Nathan Francis Wyatt , 39, who is a key member of the infamous international hacking group 'The Dark Overlord,' has been sentenced to five years in prison and
Kategorie: Hacking & Security

Řidič Tesly za jízdy spal, jeho auto uhánělo po dálnici rychlostí 150 km/h. Čeká ho soudní proces

Zive.cz - bezpečnost - 22 Září, 2020 - 07:55
9. července tohoto roku obdržela kanadská policie stížnost na nebezpečnou jízdu na dálnici číslo 2 poblíž obce Ponoka v provincii Alberta. Vyslala na místo hlídku, která zachytila Teslu Model S, jejíž řidič za volantem tvrdě spal a měl sklopenou sedačku, zatímco vůz jel v autonomním režimu, ...
Kategorie: Hacking & Security

TANSTAAFL! The Tragedy of the Commons Meets Open-Source Software>

LinuxSecurity.com - 21 Září, 2020 - 23:37
Open-source projects can become victims of their own success. What can developers do to secure their open-source software?
Kategorie: Hacking & Security

Fileless Malware Tops Critical Endpoint Threats for 1H 2020

Threatpost - 21 Září, 2020 - 23:27
When it comes to endpoint security, a handful of threats make up the bulk of the most serious attack tools and tactics.
Kategorie: Hacking & Security

Announcement of the passing of Jari Fredriksson>

LinuxSecurity.com - 21 Září, 2020 - 22:43
Today we learned of the passing of a long-time contributor to the Linux and SpamAssassin communities. Jari Fredriksson ran a mirror for sa-update for a long time, contributed to our masscheck system, tested numerous releases, and has given us tons of great feedback over the years. He'll be missed. May his memory be a blessing.
Kategorie: Hacking & Security

Unsecured Microsoft Bing Server Leaks Search Queries, Location Data

Threatpost - 21 Září, 2020 - 22:07
Data exposed included search terms, location coordinates, and device information - but no personal data.
Kategorie: Hacking & Security

DHS Issues Dire Patch Warning for ‘Zerologon’

Threatpost - 21 Září, 2020 - 21:29
The deadline looms for U.S. Cybersecurity and Infrastructure Security Agency’s emergency directive for federal agencies to patch against the so-called ‘Zerologon’ vulnerability.
Kategorie: Hacking & Security
Syndikovat obsah