{"id":112928,"date":"2024-01-15T23:28:03","date_gmt":"2024-01-15T21:28:03","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/obnovlenie-zashhishhyonnoj-android-platformy-grapheneos"},"modified":"2024-01-15T23:28:03","modified_gmt":"2024-01-15T21:28:03","slug":"obnovlenie-zashhishhyonnoj-android-platformy-grapheneos","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/obnovlenie-zashhishhyonnoj-android-platformy-grapheneos","title":{"rendered":"Aktualizace zabezpe\u010den\u00e9 Android platformy GrapheneOS","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Byla vyd\u00e1na nov\u00e1 verze zabezpe\u010den\u00e9 mobiln\u00ed platformy GrapheneOS 2024011300, kter\u00e1 je odvozen\u00e1 od k\u00f3dov\u00e9 z\u00e1kladny Android (AOSP, Android Open Source Project) s roz\u0161\u00ed\u0159en\u00fdmi a upraven\u00fdmi funkcemi pro zv\u00fd\u0161en\u00ed bezpe\u010dnosti a ochranu soukrom\u00ed. Tento projekt se d\u0159\u00edve vyv\u00edjel pod n\u00e1zvem AndroidHardening a je\u0161t\u011b p\u0159edt\u00edm se odtrhnul od projektu CopperheadOS po konfliktu jeho zakladatel\u016f. V GrapheneOS je ofici\u00e1ln\u011b podporov\u00e1na v\u011bt\u0161ina aktu\u00e1ln\u00edch za\u0159\u00edzen\u00ed Google Pixel (Pixel 4\/5\/6\/7\/8, Pixel Fold, Pixel Tablet). V\u00fdvoj projektu je \u0161\u00ed\u0159en pod licenc\u00ed MIT. <\/p>\n

GrapheneOS zahrnuje mnoho experiment\u00e1ln\u00edch technologi\u00ed zam\u011b\u0159en\u00fdch na pos\u00edlen\u00ed izolace aplikac\u00ed, podrobn\u00e9 \u0159\u00edzen\u00ed p\u0159\u00edstupu, blokaci b\u011b\u017en\u00fdch zranitelnost\u00ed a zt\u00ed\u017een\u00ed pr\u00e1ce exploit\u016f. Nap\u0159\u00edklad platforma pou\u017e\u00edv\u00e1 vlastn\u00ed implementaci malloc a upravenou variantu libc s ochranou p\u0159ed po\u0161kozen\u00edm pam\u011bti, stejn\u011b jako p\u0159\u00edsn\u011bj\u0161\u00ed odd\u011blen\u00ed adresn\u00edho prostoru proces\u016f. M\u00edsto JIT se v Android Runtime pou\u017e\u00edv\u00e1 pouze proaktivn\u00ed (AOT, ahead-of-time) kompilace. V j\u00e1dru Linuxu byly zahrnuty r\u016fzn\u00e9 dodate\u010dn\u00e9 ochrann\u00e9 mechanismy, nap\u0159\u00edklad do slub byly p\u0159id\u00e1ny kan\u00e1rkov\u00e9 zna\u010dky pro zablokov\u00e1n\u00ed p\u0159ete\u010den\u00ed buffer\u016f. Pro pos\u00edlen\u00ed izolace aplikac\u00ed jsou pou\u017e\u00edvan\u00e9 SELinux a seccomp-bpf. <\/p>\n

Je mo\u017en\u00e9 poskytnout p\u0159\u00edstup k s\u00ed\u0165ov\u00fdm operac\u00edm, senzor\u016fm, adres\u00e1\u0159i a perifern\u00edm za\u0159\u00edzen\u00edm (USB, fotoapar\u00e1t) pouze vybran\u00fdm aplikac\u00edm. \u010cten\u00ed ze schr\u00e1nky je povoleno pouze aplikac\u00edm, ve kter\u00fdch je aktu\u00e1ln\u011b aktivn\u00ed vstupn\u00ed fokus. V\u00fdchoz\u00edm nastaven\u00edm je zak\u00e1z\u00e1no z\u00edsk\u00e1vat informace o IMEI, MAC adrese, s\u00e9riov\u00e9m \u010d\u00edsle SIM karty a dal\u0161\u00edch hardwarov\u00fdch identifik\u00e1torech. Byla p\u0159ijata dodate\u010dn\u00e1 opat\u0159en\u00ed pro izolaci proces\u016f souvisej\u00edc\u00edch s Wi-Fi a Bluetooth a zamezen\u00ed \u00fanik\u016fm v d\u016fsledku bezdr\u00e1tov\u00e9 aktivity. Mnoho mechanism\u016f z projektov\u00e9ho v\u00fdvoje bylo p\u0159eneseno do hlavn\u00ed k\u00f3dov\u00e9 z\u00e1kladny Android. <\/p>\n

GrapheneOS aplikace pou\u017e\u00edv\u00e1 kryptografickou verifikaci stahovan\u00fdch komponent\u016f a pokro\u010dil\u00e9 \u0161ifrov\u00e1n\u00ed dat na \u00farovni souborov\u00fdch syst\u00e9m\u016f ext4 a f2fs (data jsou \u0161ifrov\u00e1na pomoc\u00ed AES-256-XTS a n\u00e1zvy soubor\u016f \u2014 AES-256-CTS s vyu\u017eit\u00edm HKDF-SHA512 pro generaci samostatn\u00e9ho kl\u00ed\u010de pro ka\u017ed\u00fd soubor), a to nejen na blokov\u00e9m za\u0159\u00edzen\u00ed. Data v syst\u00e9mov\u00fdch odd\u00edlech a v ka\u017ed\u00e9m u\u017eivatelsk\u00e9m profilu jsou \u0161ifrov\u00e1na r\u016fzn\u00fdmi kl\u00ed\u010di. Vyu\u017e\u00edvaj\u00ed se dostupn\u00e9 hardwarov\u00e9 schopnosti ke zrychlen\u00ed \u0161ifrovac\u00edch operac\u00ed. Na zamykac\u00ed obrazovce se zobrazuje tla\u010d\u00edtko pro ukon\u010den\u00ed relace, po jeho\u017e stisknut\u00ed se kl\u00ed\u010de pro de\u0161ifrov\u00e1n\u00ed resetuj\u00ed a \u00falo\u017ei\u0161t\u011b se p\u0159evede do neaktivovan\u00e9ho stavu. Vyskytuje se mo\u017enost zak\u00e1zat instalaci dal\u0161\u00edch aplikac\u00ed pro vybran\u00e9 u\u017eivatelsk\u00e9 profily. Pro ochranu proti pokus\u016fm o uh\u00e1dnut\u00ed hesla je nasazena syst\u00e9m zpo\u017ed\u011bn\u00ed, kter\u00e1 z\u00e1vis\u00ed na po\u010dtu ne\u00fasp\u011b\u0161n\u00fdch pokus\u016f (od 30 sekund do 1 dne). <\/p>\n

Sou\u010d\u00e1st\u00ed GrapheneOS mnohem z\u00e1sadn\u011bji nejsou aplikace a slu\u017eby Google, ani alternativn\u00ed implementace slu\u017eeb Google, jako je microG. Z\u00e1rove\u0148 je v\u0161ak mo\u017enost instalace slu\u017eeb Google Play v samostatn\u00e9m izolovan\u00e9m prost\u0159ed\u00ed, kter\u00e9 nem\u00e1 \u017e\u00e1dn\u00e9 speci\u00e1ln\u00ed privilegium. Projekt tak\u00e9 vyv\u00edj\u00ed n\u011bkolik vlastn\u00edch aplikac\u00ed zam\u011b\u0159en\u00fdch na ochranu informac\u00ed a soukrom\u00ed. Nap\u0159\u00edklad nab\u00edz\u00ed prohl\u00ed\u017ee\u010d Vanadium zalo\u017een\u00fd na Chromiu a modifikovanou verzi enginu WebView, zabezpe\u010den\u00e9ho prohl\u00ed\u017ee\u010de PDF, firewall, aplikaci Auditor pro verifikaci za\u0159\u00edzen\u00ed a odhalov\u00e1n\u00ed vniknut\u00ed, aplikaci pro pr\u00e1ci s kamerou zam\u011b\u0159enou na zaji\u0161t\u011bn\u00ed soukrom\u00ed a syst\u00e9m pro vytv\u00e1\u0159en\u00ed \u0161ifrovan\u00fdch z\u00e1loh Seedvault. <\/p>\n

Mezi zm\u011bnami v nov\u00e9 verzi: <\/p>\n