Compiler-based security mitigations in Android P

> The UndefinedBehaviorSanitizer's (UBSan) signed and unsigned integer overflow sanitization was first utilized when hardening the media stack ... we've expanded usage of these sanitizers in the media framework with each release.

It's a great step but for anyone else looking to capitalize on UBSan make sure you couple it with fuzzing or some other testing strategy that will go beyond just coverage. UBSan won't find latent code that overflows if you don't give it inputs that actually cause overflows.

If this is deployed in release builds — in production — then it is effective in mitigating anything which isn't covered in fuzzing. Your application/process gets terminated, which is perfectly acceptable behavior.

Yup, defense-in-depth requires broad(coverage) and deep(overlapping) holistic solutions. There’s too many defenses on too many platforms to enumerate comprehensively, but they’re discoverable.

Afl for overall fuzzing:

http://lcamtuf.coredump.cx/afl

Klee for generating minimal test-cases automatically:

http://klee.github.io (by LLVM)

Property-based testing to specify test-cases manually:

https://github.com/silentbicycle/theft

http://www.quviq.com/products

Toolchain docs:

https://clang.llvm.org/docs

https://gcc.gnu.org/onlinedocs

Binutils gold (new ld) linker https://sourceware.org/git/gitweb.cgi?p=binutils-gdb.git;a=t...

Compiler defensive best-practices source docs:

https://blog.quarkslab.com/clang-hardening-cheat-sheet.html

https://security.stackexchange.com/questions/24444/what-is-t...

https://www.phoronix.com/scan.php?page=news_item&px=GNU-Glib...

PIE and PIC https://stackoverflow.com/q/2463150/246672

https://www.netbsd.org/gallery/presentations/khorben/asiabsd...

https://edgeofus.com/information-security-2/how-to-harden-cc...

https://developers.redhat.com/blog/2018/03/21/compiler-and-l...

https://fedoraproject.org/wiki/Changes/Harden_All_Packages

https://www.owasp.org/index.php/C-Based_Toolchain_Hardening

and lots of reading man pages for latest code and DuckDuckGoing

As I see it, the main 'security' problems faced by Android are caused by lack of control and transparency for the user.

Until security threats created by the blinkered users - and by the lack of timely updates - are made obvious to them, such 'mitigations' are weak tea indeed.

The meager adoption of Oreo, barely 10% after one year, with most OEM only now adopting Nougat for their mid-ranges has finally done it.

In one of IO 2018's keynotes they briefly mentioned that update processes will be part of future Play Services certification.

> The UndefinedBehaviorSanitizer's (UBSan) signed and unsigned integer overflow sanitization

.. but unsigned overflow is not UB? Sure it might not be desirable always, but that is completely different type of problem