Android Gets 'Dns Over Tls' To Encrypt Dns Requests

Android gets a feature that causes dns requests to be encrypted so that ISPs do not see which websites their subscribers seek, so XDA reports. Dns (domain name system) is similar to the phonebook and, among other things, translates domain names into IP addresses.

If an Internet user enters a domain name in his browser, the computer sends a request to a dns server, which then returns the website's ip address to the browser, which can load the website. Often these requests go to the internet server's dns server. However, the requests are unencrypted, allowing anyone who has access to the connection that can see.

Dns over tls is a protocol that encrypts dns requests, as does https for traffic to and from websites. The encryption of tls must prevent tapping and manipulating dns requests in the network, thus protecting the privacy of users. Inside the Android Open Source Project (AOSP), code has now appeared that indicates that dns is added to tls on Android.

Users could immediately enable or disable it using the OS's Developer Options. The feature may be added to Android 8.1. Users who want to use dns over tls must choose a dns server that supports this. In addition, the encrypted dns requests will still be visible to this dns server.

Google Hacks Samsung Galaxy S6 During Internal Competition

During an internal competition at the offices of Google are employees of the Internet giant has managed to hack a Samsung Galaxy S6 Edge, which ultimately resulted in 11 serious vulnerabilities. Google has a team of hackers called Project Zero.

The team looks for vulnerabilities in popular software. This time, the hackers also decided to look at a handset from Samsung. Most Android devices are namely not created by Google, but by external parties, known as Original Equipment Manufacturers (OEMs). These manufacturers use the Android Open Source Project (AOSP) as the basis for their devices.According to Google, OEMs are an important area for Android screening.

Namely manufacturers add all kinds of code and applications increasing, which can introduce new vulnerabilities. The manufacturers decide if and when they deploy updates. After previously having been created by a Google Nexus device examined Project Zero now decided to look at the safety of an OEM device. In addition to finding vulnerabilities, the researchers were also curious to see how quickly they were resolved. It was ultimately for the Samsung Galaxy S6 Edge chosen because a high-end device with many users.

Competition

It was then decided to organize a match between the North American members of Project Zero and the European section. The teams were given a week's time for the challenge. Eventually there were 11 vulnerabilities discovered and reported to Samsung. Eight of the leaks were patched by Samsung during patch cycle of October. The remaining three will be resolved this month. Who the match between the two teams eventually won, Google has not disclosed.

Android Again Hit By Leak In Media Server

Researchers have discovered a vulnerability in the media server of Android again, the same part where previously several other vulnerabilities were found, including severe Stage Fright leak . Through the latest vulnerability an attacker can execute arbitrary code on the device with the media rights server.

Thus, an attacker can take photos, create videos and previously made videos. The problem is present in Android 2.3 to 5.1.1, which represents almost all Android devices in circulation. To be attacked, the user must first install a malicious app via the vulnerability. This app does not require any permission, which can give users a false sense of security. Once activated an attacker could execute arbitrary code with the rights of media server.

The media server is involved in all kinds of media-related tasks, such as taking pictures, reading MP4 files and recording videos. "This allows the user privacy at risk", says Wish Wu of the Japanese anti-virus company Trend Micro discovered that the vulnerability. The virus fighter warned Google on June 19 that the leak as "high severity" labeled. On August 1, Google has published a patch for the Android Open Source Project (AOSP), but it is unclear if the update has already among users and suppliers is spread.