Welcome to part second of Android security structure.
As you know, Google provides a set of cloud based services that are available to different compatible
Android devices.
And these services are not part of the Android open source project itself, but they are included in
too many different Android devices.
Right.
So we have the primary service for installing applications from the actual store, which is Google Play.
And you also have the services to actually push update, which is called Android Updates.
Android Updates is an update service that provides new features and security updates through either
the Web or through over the air.
OK, so now there's also the application services.
And basically it's a framework that allows Android applications to use cloud capabilities, like backing
up your application data, backing up your settings.
And also they have cloud device messaging that is called C to be N, C to the M is used for pushing
messaging to the cloud as well.
They also have another service called Verify Apps, and it basically warn you or automatically block
the installation of any type of compromised applications or any harmful applications, and also to continuously
send applications on the device and warn you about them or removing those applications automatically.
Another service is the safety net.
Now, some of you may be thinking that why I am explaining these to you?
Well, because it helps you whenever you are doing pen testing.
OK, so now going back to the services safety net is basically privacy preserving?
Well, some people call it intrusion detection system to assist Google tracking and mitigating nonsecurity
threats and also to identify other type of abnormal activity within the Android ecosystem.
OK, and now part of that is the safety net at this station service.
And it basically allows third party apps to determine whether the device is compatible and also can
assist identify the Android app, communicating with the Observer.
Right now, there's also the device manager.
So the Android device manager is a Web app and also an Android app that is actually used to locate lost
or stolen devices, which is similar to what Apple has with Find My Device function.
Now, the Android security model is actually based on the concept of applications and boxes, OK?
And each application runs its own sandbox.
Now, a long time ago, I mean, seven years ago, prior to Android was for three, these boxes were
defined by the creation of a unique Lennix Eweida.
And the idea was actually for each application at the time of installation.
Now from version four, door three, Android actually uses Selznick's, that is the security and has
Linux.
And it is actually used for defining the boundaries of the applications and works in Android.
OK, now, as part of the Android security model, Android uses SLA next to enforce Mac.
That is mandatory access control over all processes.
Right.
Even processors running with route also privileges also, but user privileges.
And this actually helps protect the operating system.
Also, Selznick's and has Android by confining privilege processes and automating the security policy
creation on that device.
Now, Android also includes Selznick's in enforcing mode, and it is basically a corresponding security
policy that works by default across those devices.
Right.
So now in enforcing mode, whenever you do security research in Android platforms, the illegitimate
actions are prevented by default and attempted violations are actually logged by the kernel to the message
and to it.
OK, Android devices manufacturers should actually gather information about these errors so they can
actually refine their software and their own Selznick's processes before enforcing them.
However, unfortunately, this doesn't happen all the time.
OK, that's one of the major differences between Apple devices and Android, although Google provides
the operating system to Android.
But it's up to the implementors to actually take care of these acute implementations and maybe some
implementations may be more secure than others.
Now, by default on Android, only the kernel and a small subset of the core applications run with their
permissions.
Right now, Android does not prevent a user or an application with root permissions from modifying the
operating system.
OK, you can also modify the kernel or any of their application.
So in general, Brud has full access to all applications and all application data.
So whenever users change their permissions on an Android device to grant access to applications, definitely
increase the security exposure to malicious applications and potential application flaws.
And that's whenever you see a lot of important applications and so on.
So, again, a lot of people that actually rule their devices has to keep in mind that whenever you
are going to go to.
Research on Android devices in a lot of cases, actually, what people do is they start from just by
adopting a device.
Now, the ability to modify an Android device that you own is important.
Developers working with the Android platform.
Right.
So on many Android devices, users actually have the capability or the ability to unlock the bootloader
in order to allow the installation of some other alternate operating system.
So some will call it custom ROMs.
And these alternate operating systems may actually allow a user to gain access for the purpose of debugging
and then system components to access the features that are not present to applications by the Android
apps by default.
OK.