Critique #4
Android Insecurity
Source: http://www.sciencedirect.com/science/article/pii/S1353485811701040#

Generally speaking, almost every issue comes up with double-edged sword. In today’s society, Android operating system is also no exception. Along with its open source code released by Google under the Apache license, the security issue is becoming more and more significant and emergency. Whether or not the Android operating system is designed with any intrinsic security initially, from this article’s perspective, the author may state a negative answer of Android as a failure both the operating system and the hardware. We can get start from an overview about what the author listed through the beginning to end in the article.

At first, the initial reason and environment about why Android developed appear to us along with the so called wrong policy-atypia at the beginning in the development cycle. It’s precisely because these non-mainstreams such as true multi-tasking that cause the current insecurity issues including multifariously malicious malware, e.g. Trojan-SMS, Fake Player, Droid Dream malware and so on. Meanwhile, the author listed the cause for concern, and also some tests on Android from the analyst view to test the security.

There are two points in the article leave me a deep impression. The first one is a series of atypical and nonstandard design of Android. To come the first, its main kernel is just a branch of mainstream in Linux research and development. Besides, Android don’t give the support to the full set of standard General Public License. Last one but not the least one, Data storage is beyond standard using a lightweight relational database and also allows the external micro SD which is not passed locked to easy access on any device. We enjoy the advantages given by the atypical design and on the other hand we encounter and need to bear the loss due to it.

Another one is the true multi-tasking function which allows not only malware apps to run silently in the background with a high priority of lifetime as long as possible and the reboot function even though being killed, but also generate SMS bombing in the background without the user being aware of it. It’s on the other side treated as an advantage of Android that attracts consumer who enjoy the convenience brought by multi-tasking. It’s hard to decide whether or not this kind of nonstandard is good or bad.

Except what have been discussed in the article, I would like to lay another stress on the memory randomization that not being mentioned by the author. The Address Space Layout Randomization (ASLR) which is other security issue can be also an issue to be talked about in the insecurity of Android. For Android operating system, memory randomize don’t be fully implemented until the release of Jelly Bean-Android 4.3, which means there have not any memory randomize techniques used in the former versions of Android system. What’s worse, code signing technology is also a mandatory need to enhance the memory randomization like iOS, which can have the ability to prevent the third party app from uploading and downloading unsigned source code. Unfortunately, Android has not put this technology into effect.

On the whole, is Android operating system a total insecurity? The answer maybe depend on individual. Even though the article conclude it as a massive failure in term of security, it’s not only the responsible of developer, but also the essential aspect is educating security awareness of user. Anyway, it’s one’s own business to weight the gain and loss.