1page.title=Security Enhancements in Android 4.2
2@jd:body
3
4<p>
5Android provides a multi-layered security model described in the <a href="{@docRoot}devices/tech/security/index.html">Android
6Security Overview</a>. Each update to Android includes dozens of
7security enhancements to protect users.  The following are some of the security
8enhancements introduced in Android 4.2:</p>
9
10<ul>
11<li><strong>Application verification</strong> - Users can choose to enable “Verify Apps" and
12have applications screened by an application verifier, prior to installation.
13App verification can alert the user if they try to install an app that might be
14harmful; if an application is especially bad, it can block installation.</li>
15<li><strong>More control of premium SMS</strong> - Android will provide a notification if an
16application attempts to send SMS to a short code that uses premium services
17which might cause additional charges.  The user can choose whether to allow the
18application to send the message or block it.</li>
19
20<li><strong>Always-on VPN</strong> - VPN can be configured so that applications will not have
21access to the network until a VPN connection is established.  This prevents
22applications from sending data across other networks.</li>
23
24<li><strong>Certificate Pinning</strong> - The Android core libraries now support
25<a href="https://developer.android.com/reference/android/net/http/X509TrustManagerExtensions.html">certificate pinning</a>.
26Pinned domains will receive a certificate validation
27failure if the certificate does not chain to a set of expected certificates.
28This protects against possible compromise of Certificate Authorities.</li>
29
30<li><strong>Improved display of Android permissions</strong> - Permissions have been organized
31into groups that are more easily understood by users. During review of the
32permissions, the user can click on the permission to see more detailed
33information about the permission.</li>
34
35<li><strong>installd hardening</strong> - The <code>installd</code> daemon does not run as the root user,
36reducing potential attack surface for root privilege escalation.</li>
37
38<li><strong>init script hardening</strong> - init scripts now apply <code>O_NOFOLLOW</code> semantics to
39prevent symlink related attacks.</li>
40
41<li><strong>FORTIFY_SOURCE</strong> -  Android now implements <code>FORTIFY_SOURCE</code>. This is used by
42system libraries and applications to prevent memory corruption.</li>
43
44<li><strong>ContentProvider default configuration</strong> -  Applications which target API
45level 17 will have "export" set to "false" by default for each
46<a href="https://developer.android.com/reference/android/content/ContentProvider.html">Content
47Provider</a>, reducing default attack surface for applications.</li>
48
49<li><strong>Cryptography</strong> - Modified the default implementations of SecureRandom and
50Cipher.RSA to use OpenSSL.  Added SSL Socket support for TLSv1.1 and TLSv1.2
51using OpenSSL 1.0.1</li>
52
53<li><strong>Security Fixes</strong> - Upgraded open source libraries with security fixes include
54WebKit, libpng, OpenSSL, and LibXML. Android 4.2 also includes fixes for
55Android-specific vulnerabilities. Information about these vulnerabilities has
56been provided to Open Handset Alliance members and fixes are available in
57Android Open Source Project.  To improve security, some devices with earlier
58versions of Android may also include these fixes.</li>
59
60</ul>